---
title: "Attack Tree Construction - Air Market"
description: "Talking about security risk in the abstract rarely convinces anyone or finds anything. An attack tree lays out the routes an attacker could take to a goal, branch by branch, so gaps become visible an…"
canonical: "https://airmarket.ai/app/attack-tree-construction"
---

[Air Market](/) / [Security](/category/security) / Attack Tree Construction

Skill by [Seth Hobson](/@wshobson)

# Attack Tree Construction

Draw out how an attacker would actually get in

## What this does

Talking about security risk in the abstract rarely convinces anyone or finds anything. An attack tree lays out the routes an attacker could take to a goal, branch by branch, so gaps become visible and the risk becomes something you can show people. Reach for it when mapping threats or making a case to stakeholders.

### Top 3 things it does for you

- Map the paths an attacker could take
- Find where your defenses have gaps
- Explain a security risk to people who are not engineers

## Information

**Attack Tree Construction at a glance**

|  |  |
| --- | --- |
| Kind | Skill |
| Publisher | [Seth Hobson](/@wshobson) |
| Category | [Security](/category/security) |
| Works with | Agent Skills - an open standard supported by 40+ agents |
| Size | 22 KB |
| Licence | MIT |
| Repository | [wshobson/agents](https://github.com/wshobson/agents/tree/be57c0b2e3c05c528ca6132b87410b385718775f/plugins/security-scanning/skills/attack-tree-construction) |
| GitHub stars | 39,077 (as of Nov 2026) |
| Installs | 18,800, counted by skills.sh (Nov 2026) |

## Security report

**Verified.** AIR scanned this exact version of Attack Tree Construction and flagged nothing. AIR's verdict: **safe**.

**What Attack Tree Construction's check was run against**

|  |  |
| --- | --- |
| Commit | be57c0b2e3c05c528ca6132b87410b385718775f |
| Content hash | df6eb596e41916b66fbf6754ca3f0c4294a0fc4b3a1be2bed97e074a90da2635 |
| Files read | [Browse the files at this exact commit](https://github.com/wshobson/agents/blob/be57c0b2e3c05c528ca6132b87410b385718775f/plugins/security-scanning/skills/attack-tree-construction/SKILL.md) |

A scan is named by the exact content it read, not by a version number. A different version is a different artifact, and nothing here applies to a version AIR has not scanned.

[Read the full security report for Attack Tree Construction](/security/attack-tree-construction)

## About Attack Tree Construction

This is about building attack trees that make threat paths visible.

Use it when mapping attack scenarios, identifying gaps in your defenses, or communicating security risks to stakeholders who need to see the shape of the problem.

## What's inside

- SKILL.md - instructions
- references/details.md - reference

## Questions

### Is Attack Tree Construction safe to install?

AIR scanned this exact version of Attack Tree Construction and flagged nothing. AIR's verdict: safe. The verdict is named by the content that was read, at commit be57c0b2e3c0, so it cannot drift onto a version nobody scanned. The full report is at https://airmarket.ai/security/attack-tree-construction.

### How do I install Attack Tree Construction?

Open https://airmarket.ai/app/attack-tree-construction on Air Market and use the install action: Air Market hands Claude a prompt naming this exact skill, and Claude sets it up. Source, pinned to the exact commit this listing describes: https://github.com/wshobson/agents/tree/be57c0b2e3c05c528ca6132b87410b385718775f/plugins/security-scanning/skills/attack-tree-construction. Install from that link, not the branch.

## Related on Air Market

- [More Security listings](/category/security)
- [Everything by Seth Hobson](/@wshobson)

---

Canonical URL: <https://airmarket.ai/app/attack-tree-construction>