How do I install the Tradecraft Attack Path Mapping skill?

Run npx skillmds@latest add noorqureshi/tradecraft-attack-path-mapping in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Tradecraft Attack Path Mapping safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Tradecraft Attack Path Mapping?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Tradecraft Attack Path Mapping free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Tradecraft Attack Path Mapping?

NoorQureshi (@noorqureshi) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Tradecraft Attack Path Mapping by noorqureshi

Name: Tradecraft Attack Path Mapping
Author: NoorQureshi

Tradecraft Attack Path Mapping

Model the target as an attack graph — nodes (assets, identities, trust) and edges (a technique that gets you from one to the next) — and find the shortest path to the objective. Load when many findings need to be assembled into a route, on "how do these bugs connect", AD/cloud lateral- movement planning, or to explain how a foothold reaches crown jewels.

NoorQureshi Updated Sep 17, 2026

File contents

Attack-path mapping

When it applies

You have several footholds/findings and need to see how they combine into a route to the objective — or you're defending and want to know which single edge, if cut, breaks the most paths.

Why it works

Attackers think in graphs; defenders who do too find the choke points. Modelling principals → permissions → resources as edges makes "can A reach D?" a reachability query, and surfaces multi-step paths no single finding reveals (this is why BloodHound changed AD assessment).

Method

Nodes: assets (hosts, buckets, DBs), identities (users, roles, service accounts), and secrets.
Edges = a technique you can actually run: "user→host" (valid creds / RCE), "host→identity" (token/cred theft — privesc-*, cloud-imds-ssrf), "identity→identity" (delegation, role assumption — ad-*, cloud-iam-privesc), "identity→data" (read access). Label each edge with its skill.
Build the graph: BloodHound (AD), PMapper/Cartography (AWS/cloud IAM), or a hand-drawn graph in notes.md for smaller scopes.
Query for paths: shortest path from a controlled node to the objective; enumerate alternates.
Pick the path: lowest cost/noise, highest reliability. Each edge becomes an ordered lead in the scenario (tradecraft-attack-scenarios).
Defensive read: rank edges by how many objective-paths traverse them — those are the remediation priorities (kill the edge, not just the node).

Gotchas

An edge you can't actually execute is not an edge — validate the technique, don't assume it.
Graphs go stale as you change the environment (new creds, revoked tokens); re-query after each win.
Don't collect the whole graph when one path proves impact — least action.

Verify success

You can state the full path — node by node, edge by edge, each edge a runnable technique — from a starting position to the objective, and name the one edge whose removal breaks it.

References

BloodHound / SharpHound; NCC PMapper; AWS/GCP Cartography; MITRE ATT&CK flow.

---name: tradecraft-attack-path-mappingdescription: Model the target as an attack graph — nodes (assets, identities, trust) and edges (a technique that gets you from one to the next) — and find the shortest path to the objective. Load when many findings need to be assembled into a route, on "how do these bugs connect", AD/cloud lateral- movement planning, or to explain how a foothold reaches crown jewels.---# Attack-path mapping## When it appliesYou have several footholds/findings and need to see how they combine into a route to the objective— or you're defending and want to know which single edge, if cut, breaks the most paths.## Why it worksAttackers think in graphs; defenders who do too find the choke points. Modellingprincipals → permissions → resources as edges makes "can A reach D?" a reachability query, andsurfaces multi-step paths no single finding reveals (this is why BloodHound changed AD assessment).## Method1. **Nodes**: assets (hosts, buckets, DBs), identities (users, roles, service accounts), and secrets.2. **Edges = a technique you can actually run**: "user→host" (valid creds / RCE), "host→identity" (token/cred theft — `privesc-*`, `cloud-imds-ssrf`), "identity→identity" (delegation, role assumption — `ad-*`, `cloud-iam-privesc`), "identity→data" (read access). Label each edge with its skill.3. **Build the graph**: BloodHound (AD), PMapper/Cartography (AWS/cloud IAM), or a hand-drawn graph in `notes.md` for smaller scopes.4. **Query for paths**: shortest path from a controlled node to the objective; enumerate alternates.5. **Pick the path**: lowest cost/noise, highest reliability. Each edge becomes an ordered lead in the scenario (`tradecraft-attack-scenarios`).6. **Defensive read**: rank edges by how many objective-paths traverse them — those are the remediation priorities (kill the edge, not just the node).## Gotchas- An edge you can't actually execute is not an edge — validate the technique, don't assume it.- Graphs go stale as you change the environment (new creds, revoked tokens); re-query after each win.- Don't collect the whole graph when one path proves impact — least action.## Verify successYou can state the full path — node by node, edge by edge, each edge a runnable technique — from astarting position to the objective, and name the one edge whose removal breaks it.## ReferencesBloodHound / SharpHound; NCC PMapper; AWS/GCP Cartography; MITRE ATT&CK flow.

Frequently asked questions