CtrlK
BlogDocsLog inGet started
Tessl Logo
SkillPublic

attack-tree-construction

Build comprehensive attack trees to visualize threat paths. Use when mapping attack scenarios, identifying defense gaps, or communicating security risks to stakeholders.

Quality

71%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide
SecuritybySnyk

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./plugins/security-scanning/skills/attack-tree-construction/SKILL.md
SKILL.md
Quality
Evals
Security

Quality

Content

51%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The skill body is well-structured with exemplary progressive disclosure, but it reads as a concept reference rather than a working guide: it explains attack-tree basics Claude already knows while omitting the actual construction workflow, which lives entirely in the reference file. Adding an inline step-by-step procedure and a small worked example would substantially raise actionability and workflow clarity.

Suggestions

Add an ordered construction workflow to the body (e.g., 1. Define the root goal from the attacker's objective, 2. Enumerate sub-goals and refine to leaf attacks, 3. Assign cost/time/skill/detection attributes, 4. Identify the cheapest low-detection paths and map mitigations), since the body currently has no sequence at all.

Include one small worked example tree inline (a labeled diagram with attributes filled in) so the skill is actionable without requiring the reader to open references/details.md for the first concrete artifact.

Trim the Core Concepts section: replace the ASCII tree and OR/AND/leaf explanation (which Claude already knows) with just the skill's own conventions — the chosen symbols and the four-attribute scale — to improve token efficiency.

DimensionReasoningScore

Conciseness

The document is compact overall, but the Core Concepts section (ASCII tree diagram, node-type table) re-explains attack tree semantics Claude already knows and could be trimmed to conventions the skill actually defines (symbol and attribute choices).

3 / 5

Actionability

The node-type table and attribute value scales ($, $$, $$$; Hours/Days/Weeks) provide concrete conventions, but no inline worked example or construction procedure exists — all executable templates are deferred to references/details.md, leaving the body itself descriptive rather than instructive.

3 / 5

Workflow Clarity

No ordered construction steps are present (e.g., define root goal, enumerate vectors, assign attributes, identify cheapest path); sequence is only implied by section order, and the sole validation mention ('Validate with experts') is a best-practice bullet, not a checkpoint.

2 / 5

Progressive Disclosure

The body is a clear overview with a well-signaled, one-level-deep reference ('Full template library lives in references/details.md. Read that file when you need concrete templates'), and the referenced file exists with no nested references; content is appropriately split.

5 / 5

Total

13

/

20

Passed

Description

78%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong description with explicit what/when structure and natural trigger phrases. Its main gaps are limited action coverage and missing common synonyms like 'threat modeling'.

DimensionReasoningScore

Specificity

Names the domain and 1-2 concrete actions ('Build comprehensive attack trees to visualize threat paths') but stops short of the several specific actions anchor; coverage of what the skill does is not comprehensive.

3 / 5

Completeness

Clearly answers both what ('Build comprehensive attack trees to visualize threat paths') and when ('Use when mapping attack scenarios, identifying defense gaps, or communicating security risks to stakeholders') with concrete trigger phrases, matching the top anchor's structure.

5 / 5

Trigger Term Quality

Good natural trigger coverage ('mapping attack scenarios', 'identifying defense gaps', 'communicating security risks to stakeholders'), but common variations like 'threat modeling', 'red team', or 'pentest planning' are absent, so it falls short of the comprehensive synonym coverage anchor.

4 / 5

Distinctiveness Conflict Risk

Attack tree construction is a distinct niche with domain-specific triggers, but 'communicating security risks' overlaps slightly with general threat-modeling or risk-communication skills, so it is mostly rather than fully distinct.

4 / 5

Total

16

/

20

Passed

Validation

100%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository

wshobson/agents

Path

plugins/security-scanning/skills/attack-tree-construction/SKILL.md

Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.