Community画像github.com

wshobson/attack-tree-construction

包括的な攻撃ツリーを構築して脅威パスを可視化します。攻撃シナリオのマッピング、防御のギャップ特定、またはセキュリティリスクの関係者への伝達に使用します。

attack-tree-construction とは？

このスキルは、セキュリティ分析と脅威モデリングに特化したAIエージェント向けツールです。攻撃ツリー（Attack Tree）を体系的に構築することで、潜在的な攻撃経路を可視化し、防御策の優先順位付けや脆弱性の洗い出しを支援します。主にAIアシスタント（Claude Codeなど）と連携し、ユーザーが入力したシステム構成や脅威情報に基づいて、階層的な攻撃ツリーを自動生成します。これにより、セキュリティ専門家でなくても複雑な攻撃シナリオを理解しやすくなり、防御戦略の策定や関係者とのコミュニケーションが効率化されます。特に、Webアプリケーション、ネットワークインフラ、クラウド環境などの多様なシステムに対応可能で、標準的な攻撃手法（MITRE ATT&CKフレームワークなど）を参照しながら、カスタマイズされたツリーを提供します。スキルの実装はMarkdown形式で出力され、視覚的な表現も可能です。

対応~Claude Code~Codex CLI~Cursor
npx skills add https://github.com/wshobson/agents/tree/main/skills/attack-tree-construction

Installed? Explore more 画像 skills: steipete/songsee, affaan-m/frontend-design, mattpocock/improve-codebase-architecture · View all 6 →

オリジナルを見る→すべてのスキルを見る

お気に入りのAIに質問する

このエージェントスキルを事前に読み込んだ状態で新しいチャットを開きます。

OpenAIChatGPTClaudeClaudeGeminiGeminiGrokGrokPerplexityPerplexityDeepSeekDeepSeek

ドキュメント

attack-tree-construction は何をしますか？

包括的な攻撃ツリーを構築して脅威パスを可視化します。攻撃シナリオのマッピング、防御のギャップ特定、またはセキュリティリスクの関係者への伝達に使用します。

概要

このスキルは、セキュリティ分析と脅威モデリングのための攻撃ツリー（Attack Tree）を自動生成します。攻撃ツリーは、システムへの潜在的な攻撃経路を階層的に表現し、ルートノードが最終目標、リーフノードが具体的な攻撃手法を示します。

使用方法

以下のようなプロンプトで使用できます：

攻擊ツリーを構築してください。
システム：Webアプリケーション（フロントエンド：React、バックエンド：Node.js、データベース：PostgreSQL）
想定脅威：SQLインジェクション、XSS、認証バイパス

特徴

  • 自動生成：入力されたシステム情報に基づいて階層的な攻撃ツリーを生成
  • フレームワーク対応：MITRE ATT&CKなどの標準的な攻撃フレームワークを参照可能
  • 可視化：Markdown形式で出力され、ツリー構造が明確に表現されます
  • カスタマイズ：特定のシステムや脅威シナリオに合わせてツリーを調整可能

例

# 攻撃ツリー：Webアプリケーション
## 目標：データベースの機密データを取得する

### OR: データベースに直接アクセスする
- SQLインジェクション脆弱性を悪用する
- データベース認証情報を盗む

### AND: アプリケーション層を突破する
- XSS攻撃を実行する
- 認証バイパスを試みる
  - セッションハイジャック
  - ブルートフォース攻撃

注意事項

  • このスキルは教育目的およびセキュリティ評価目的で使用してください
  • 実際の攻撃を促進するものではありません
  • 生成された攻撃ツリーは防御策の策定に活用してください

Individual skills in this repo

This repo contains 20 individual skills — each has its own dedicated page.

wshobson/accessibility-compliance

Implement WCAG 2.2 compliant interfaces with mobile accessibility, inclusive design patterns, and assistive technology support. Use when auditing accessibility, implementing ARIA patterns, building for screen readers, or ensuring inclusive user experiences.

wshobson/airflow-dag-patterns

Build production Apache Airflow DAGs with best practices for operators, sensors, testing, and deployment. Use when creating data pipelines, orchestrating workflows, or scheduling batch jobs.

wshobson/angular-migration

Migrate from AngularJS to Angular using hybrid mode, incremental component rewriting, and dependency injection updates. Use when upgrading AngularJS applications, planning framework migrations, or modernizing legacy Angular code.

wshobson/anti-reversing-techniques

Understand anti-reversing, obfuscation, and protection techniques encountered during software analysis. Use this skill when analyzing malware evasion techniques, when implementing anti-debugging protections for CTF challenges, when reverse engineering packed binaries, or when building security research tools that need to detect virtualized environments.

wshobson/api-design-principles

Master REST and GraphQL API design principles to build intuitive, scalable, and maintainable APIs that delight developers. Use when designing new APIs, reviewing API specifications, or establishing API design standards.

wshobson/architecture-decision-records

Write and maintain Architecture Decision Records (ADRs) following best practices for technical decision documentation. Use when documenting significant technical decisions, reviewing past architectural choices, or establishing decision processes.

wshobson/architecture-patterns

Implement proven backend architecture patterns including Clean Architecture, Hexagonal Architecture, and Domain-Driven Design. Use this skill when designing clean architecture for a new microservice, when refactoring a monolith to use bounded contexts, when implementing hexagonal or onion architecture patterns, or when debugging dependency cycles between application layers.

wshobson/async-python-patterns

Master Python asyncio, concurrent programming, and async/await patterns for high-performance applications. Use when building async APIs, concurrent systems, or I/O-bound applications requiring non-blocking operations.

wshobson/auth-implementation-patterns

Master authentication and authorization patterns including JWT, OAuth2, session management, and RBAC to build secure, scalable access control systems. Use when implementing auth systems, securing APIs, or debugging security issues.

wshobson/avoid-ai-writing

Audit and rewrite prose so it stops reading as machine-generated. Use this skill when asked to remove AI-isms, clean up AI writing, edit a draft for AI tells, audit a README, changelog, release note, PR description, or blog post for machine-sounding prose, or make text sound less like AI. Supports a detect-only mode, a rewrite mode, and an edit-in-place mode, with optional voice and context profiles.

wshobson/backtesting-frameworks

Build robust backtesting systems for trading strategies with proper handling of look-ahead bias, survivorship bias, and transaction costs. Use when developing trading algorithms, validating strategies, or building backtesting infrastructure.

wshobson/bash-defensive-patterns

Master defensive Bash programming techniques for production-grade scripts. Use when writing robust shell scripts, CI/CD pipelines, or system utilities requiring fault tolerance and safety.

wshobson/bats-testing-patterns

Master Bash Automated Testing System (Bats) for comprehensive shell script testing. Use when writing tests for shell scripts, CI/CD pipelines, or requiring test-driven development of shell utilities.

wshobson/bazel-build-optimization

Optimize Bazel builds for large-scale monorepos. Use when configuring Bazel, implementing remote execution, or optimizing build performance for enterprise codebases.

wshobson/before-you-build

Pre-build product and feature risk review for founders, product managers, and AI-assisted builders. Use this skill when the user is about to build a landing page, MVP, SaaS product, internal tool, agent workflow, or major feature and needs to check demand, positioning, monetization, retention, trust, distribution, and adoption risk before implementation starts.

wshobson/billing-automation

Build automated billing systems for recurring payments, invoicing, subscription lifecycle, and dunning management. Use when implementing subscription billing, automating invoicing, or managing recurring payment systems.

wshobson/binary-analysis-patterns

Master binary analysis patterns including disassembly, decompilation, control flow analysis, and code pattern recognition. Use when analyzing executables, understanding compiled code, or performing static analysis on binaries.

wshobson/block-no-verify-hook

Configure a PreToolUse hook to prevent AI agents from skipping git pre-commit hooks with --no-verify and other bypass flags. Use when setting up Claude Code projects that enforce commit quality gates.

wshobson/brand-landingpage

Brand-first landing page designer — runs a brand-identity interview (colors, typography, shape language), then generates and iterates on a polished landing page via Stitch with deployment-ready HTML. Use when the user asks to create, design, or build a landing page, homepage, or marketing page and has no established visual direction. Skip when they have a design mockup, need a dashboard or app UI, are working at component level, building a multi-page app, or restyling with known design tokens — use frontend-design instead.

wshobson/changelog-automation

Automate changelog generation from commits, PRs, and releases following Keep a Changelog format. Use when setting up release workflows, generating release notes, or standardizing commit conventions.

関連スキル

steipete/songsee

Generate spectrograms and feature-panel visualizations from audio with the songsee CLI.

community

affaan-m/frontend-design

Create distinctive, production-grade frontend interfaces with high design quality. Use when the user asks to build web components, pages, or applications and the visual direction matters as much as the code quality.

community

mattpocock/improve-codebase-architecture

Scan a codebase for deepening opportunities, present them as a visual HTML report, then grill through whichever one you pick.

community

lobehub/add-provider-doc

Add documentation for a new AI provider — usage docs, env vars, Docker config, image resources.

community

addyosmani/browser-testing-with-devtools

Tests in real browsers via Chrome DevTools MCP. Use when building or debugging anything that runs in a browser. Use when you need to inspect the DOM, capture console errors, analyze network requests, profile performance, or verify visual output with real runtime data. Requires the chrome-devtools MCP server to be configured.

community

bytedance/chart-visualization

This skill should be used when the user wants to visualize data. It intelligently selects the most suitable chart type from 26 available options, extracts parameters based on detailed specifications, and generates a chart image using a JavaScript script.

community
← More 画像 skills