Security Attack Path Analysis

Objective

Turn validated or still-plausible findings into explicit attacker stories, structured attack-path analysis facts, severity calibration, and a final reportability decision grounded in the threat model.

Artifact Resolution

The path references in this skill are the default locations for this phase. If the user explicitly provides a different path for a required input or output, use the user-provided path instead of the corresponding default path referenced in this skill. If a required input is still missing, stop and ask the user for it before continuing. Use the shared scan artifact path conventions in ../../references/scan-artifacts.md.

Standard scans and Deep Scan workers assess attack paths within their ordinary Standard scan workflow; neither invokes this separate phase skill.

Compact Workbench-Backed Diff Mode

When a workbench-backed $security-diff-scan has a scanId, load the per-scan threat model and read the validated candidates with list_codex_security_candidates({ scanId, cursor?, limit? }). Analyze every reportable or deferred candidate, preserve every discovery and validation field and the original candidate order, and submit all decisions together with one record_candidate_attack_paths({ scanId, attackPaths: [{ candidateId, attackPath }] }) call. Submit attackPaths: [] when no candidate enters this phase. The existing tool atomically updates the stored candidates; do not create per-finding reports, receipts, or manual candidate ledgers in this compact diff mode. Keep attack-path facts, counterevidence, severity calibration, and policy adjustment as separate reasoning steps. Other scan and standalone workflows retain their existing artifact behavior.