How do I install the Attack Navigator Layers skill?

Run npx skillmds@latest add mhaggis/attack-navigator-layers in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Attack Navigator Layers safe to use?

SkillMD's automated safety review verdict for this skill is PASS. Independent scanners report: SkillSpector: PASS, Skill Scanner: PASS. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Attack Navigator Layers?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Attack Navigator Layers free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Attack Navigator Layers?

MHaggis (@mhaggis) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Attack Navigator Layers by mhaggis — Agent Skill

Name: Attack Navigator Layers
Author: MHaggis

File contents

MITRE ATT&CK Coverage Analysis

⚡ ULTRA-FAST TOOLS (Use These!)

All queries use pre-computed denormalized tables - instant results, minimal tokens.

Quick Coverage Check (~200 bytes)

quick_coverage_check(group_id: "G0016", covered_ids: [...])

Returns: { covered: 45, gaps: 22, coverage_percent: 67%, top_gaps: [...] }

Batch Check Multiple Groups (ONE call)

batch_coverage_check(
  group_ids: ["G0016", "G0032", "G0045"],
  covered_ids: [...]
)

Get Common Groups (no search needed)

get_common_groups()

Returns top 20 groups by technique count - pre-computed, instant.

Lightweight ID Queries (indexed lookups)

get_technique_ids_by_tactic(tactic: "execution")
get_technique_ids_by_platform(platform: "Windows")

Returns just IDs - no full technique objects.

Layer Generation

Coverage Layer

generate_coverage_layer(covered_ids: [...], name: "My Coverage")

Threat Group Layer

generate_group_layer(group_id: "G0016", name: "APT29 TTPs")

Gap Layer

generate_gap_layer(covered_ids: [...], target_ids: [...], name: "Gap Analysis")

Efficient Workflows

"What's my coverage against APT29?" (2 calls max)

# Option 1: Just stats? ONE call!
quick_coverage_check(group_id: "G0016", covered_ids: your_ids)

# Option 2: Need layer? TWO calls
techs = get_group_techniques(group_id: "G0016")
layer = generate_gap_layer(covered_ids: your_ids, target_ids: techs, name: "vs APT29")

"Check multiple threat actors" (ONE call)

batch_coverage_check(
  group_ids: ["G0016", "G0032", "G0045"],
  covered_ids: your_ids
)

DON'T (heavy/slow)

list_techniques_by_tactic(...)  # Returns full objects
search_groups(query: "APT")     # When you know the ID

DO (fast/efficient)

get_technique_ids_by_tactic(...)  # Just IDs, indexed
quick_coverage_check(...)         # Pre-computed stats
get_common_groups()               # No search needed

Database Optimizations

This MCP uses:

Denormalized lookup tables for instant technique-tactic/platform queries
Pre-computed group stats for instant group info
Technique summaries for lightweight list operations
Indexed foreign keys for fast joins

Result: ~10-100x faster than naive queries.

---name: attack-navigator-layersdescription: Creates MITRE ATT&CK Navigator layers and analyzes coverage. Use when generating coverage layers, gap analysis, threat actor comparisons, or checking detection coverage against ATT&CK.---# MITRE ATT&CK Coverage Analysis## ⚡ ULTRA-FAST TOOLS (Use These!)All queries use **pre-computed denormalized tables** - instant results, minimal tokens.### Quick Coverage Check (~200 bytes)```quick_coverage_check(group_id: "G0016", covered_ids: [...])```Returns: `{ covered: 45, gaps: 22, coverage_percent: 67%, top_gaps: [...] }`### Batch Check Multiple Groups (ONE call)```batch_coverage_check( group_ids: ["G0016", "G0032", "G0045"], covered_ids: [...])```### Get Common Groups (no search needed)```get_common_groups()```Returns top 20 groups by technique count - pre-computed, instant.### Lightweight ID Queries (indexed lookups)```get_technique_ids_by_tactic(tactic: "execution")get_technique_ids_by_platform(platform: "Windows")```Returns just IDs - no full technique objects.## Layer Generation### Coverage Layer```generate_coverage_layer(covered_ids: [...], name: "My Coverage")```### Threat Group Layer```generate_group_layer(group_id: "G0016", name: "APT29 TTPs")```### Gap Layer```generate_gap_layer(covered_ids: [...], target_ids: [...], name: "Gap Analysis")```## Efficient Workflows### "What's my coverage against APT29?" (2 calls max)```# Option 1: Just stats? ONE call!quick_coverage_check(group_id: "G0016", covered_ids: your_ids)# Option 2: Need layer? TWO callstechs = get_group_techniques(group_id: "G0016")layer = generate_gap_layer(covered_ids: your_ids, target_ids: techs, name: "vs APT29")```### "Check multiple threat actors" (ONE call)```batch_coverage_check( group_ids: ["G0016", "G0032", "G0045"], covered_ids: your_ids)```## DON'T (heavy/slow)```list_techniques_by_tactic(...) # Returns full objectssearch_groups(query: "APT") # When you know the ID```## DO (fast/efficient)```get_technique_ids_by_tactic(...) # Just IDs, indexedquick_coverage_check(...) # Pre-computed statsget_common_groups() # No search needed```## Database OptimizationsThis MCP uses:- **Denormalized lookup tables** for instant technique-tactic/platform queries- **Pre-computed group stats** for instant group info- **Technique summaries** for lightweight list operations- **Indexed foreign keys** for fast joinsResult: ~10-100x faster than naive queries.

Frequently asked questions

Attack Navigator Layers