Security Attack Path Analysis

Objective

Turn validated or still-plausible findings into explicit attacker stories, structured attack-path analysis facts, severity calibration, and a final reportability decision grounded in the threat model.

Artifact Resolution

The path references in this skill are the default locations for this phase. If the user explicitly provides a different path for a required input or output, use the user-provided path instead of the corresponding default path referenced in this skill. If a required input is still missing, stop and ask the user for it before continuing. Use the shared scan artifact path conventions in ../../references/scan-artifacts.md.

Compact Standard-Scan Mode

When $security-scan explicitly invokes this skill in compact standard-scan mode, load the per-scan threat model and the enriched <discovery_dir>/candidate_ledger.jsonl. Analyze, in one invocation, every row whose validation disposition is reportable or deferred. Add one nested attack_path record to each row that enters the phase, using the compact record shape in ../../references/scan-artifacts.md, while preserving every discovery and validation field and the original row order.

In this mode, the nested record replaces the per-finding attack-path report and receipt. Rewrite the ledger atomically. Keep attack-path facts, counterevidence, severity calibration, and policy adjustment as separate reasoning steps even though their output is compact. All reachability, instance-preservation, and evidence requirements still apply; only the artifact packaging changes.