Tessl • The management layer for AI agent skills

SkillPublic

attack-tree-construction

Build comprehensive attack trees to visualize threat paths. Use when mapping attack scenarios, identifying defense gaps, or communicating security risks to stakeholders.

Quality

70%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./skills/attack-tree-construction/SKILL.md

Quality

Content

50%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is well organized with sensible sections and useful, non-obvious limitations content, but it is held back by a tripled authorization banner, absence of any worked example or notation, an unnumbered workflow without explicit checkpoints, and a dangling reference to a missing playbook file.

Suggestions

Remove the duplicated authorization text: the "AUTHORIZED USE ONLY" line at line 23 restates the top banner almost verbatim; keep one banner plus the confirmation gate.

Fix the dangling reference: either create `resources/implementation-playbook.md` with the promised patterns and templates, or remove both mentions of it and inline a minimal example.

Number the instruction steps (confirm scope -> decompose -> annotate -> validate tree structure -> export) and attach the existing validation requirement as an explicit checkpoint with a fix-and-revalidate loop.

Dimension	Reasoning	Score
Conciseness	The sections are individually tight, but the authorization warning is stated three times (top banner, "AUTHORIZED USE ONLY: Use this skill only for authorized security assessments..." at line 23, and the Safety section's stakeholder guidance), which is more than minor trimmable redundancy.	3 / 5
Actionability	The instructions give concrete methodological direction ("Decompose into sub-goals with AND/OR structure", "Annotate leaves with cost, skill, time, and detectability") but no worked example, notation, or output format; the deferred playbook file does not exist, so key details are missing.	3 / 5
Workflow Clarity	A sequence is present (confirm scope, decompose, annotate, map mitigations) and a validation requirement is stated ("Validate a finite acyclic tree... before recursion/export"), but steps are loose bullets with implicit checkpoints and no error-recovery loop.	3 / 5
Progressive Disclosure	The body is well sectioned and the reference to `resources/implementation-playbook.md` is clearly signaled in both Instructions and Resources, but that file does not exist in the bundle, leaving navigation broken rather than one-level-deep and resolvable.	3 / 5
	Total	12 / 20 Passed

Description

78%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong description with an explicit what-and-when structure and natural trigger phrases in the security domain. Its main gaps are limited action specificity and a slightly broad stakeholder-communication trigger that could overlap related security skills.

Dimension	Reasoning	Score
Specificity	The description names the domain and one concrete action ("Build comprehensive attack trees to visualize threat paths") but does not list several specific actions, matching the '1-2 concrete actions' anchor rather than the 'several specific actions' anchor.	3 / 5
Completeness	It explicitly answers both what ("Build comprehensive attack trees to visualize threat paths") and when ("Use when mapping attack scenarios, identifying defense gaps, or communicating security risks to stakeholders") with multiple concrete trigger phrases.	5 / 5
Trigger Term Quality	Natural trigger phrases like "mapping attack scenarios", "identifying defense gaps", and "communicating security risks" give good keyword coverage, though common variations such as "threat modeling" or "threat hunting" are missing.	4 / 5
Distinctiveness Conflict Risk	"Attack trees" carves a clear niche, but the broad trigger "communicating security risks to stakeholders" creates minor overlap risk with general security-reporting or risk-communication skills.	4 / 5
	Total	16 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: sickn33/agentic-awesome-skills
Path: skills/attack-tree-construction/SKILL.md
Revision: 8aa4123

Reviewed: 9 days ago

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.

attack-tree-construction

Table of Contents

Is this your skill?