SITF skill
Delivery-chain threat framework with three Claude skills that turn an attack report into a technique map and control gaps.
- 185 ★ on the repository
- Last commit
Minimal access
Why this level
- Red-team reports and incident write-ups can contain sensitive data, so store the flows carefully.
Install
- Works in
In your terminal, with SkillFoxx CLI
npx skillfoxx add skills/sitfDetects the agents on your machine, shows the access level and pins the version.
Other ways to install
Access and checks
How we reviewMinimal accessThe tool runs nothing and makes no network calls.
- Red-team reports and incident write-ups can contain sensitive data, so store the flows carefully.
This is third-party code. Review the repository files before installing.
What it does
SITF (SDLC Infrastructure Threat Framework) is an analysis framework for attacks on software development infrastructure from Wiz researchers. It describes five components (endpoint and IDE, version control, CI/CD, package registry, production and cloud), more than 75 techniques with enabling risks and security controls and a mapping of controls to OWASP SPVS. The repository includes case studies of real incidents: CircleCI, Shai-Hulud-2, TrustWallet, tj-actions, CodeBreach and s1ngularity. Three skills live in `.claude/skills/`. `/attack-flow` builds an attack flow from an incident name, link or web search. `/red-team-flow` does the same from a security-assessment report. `/technique-proposal` drafts a new technique when none in the library fits. The output is JSON flows for the interactive visualizer plus an analysis of control gaps. The visualizer and the technique library open as standalone HTML pages, locally too.
Who it is for. Supply-chain and DevSecOps security specialists who analyze incidents such as CI compromise and want attack flows and control gaps from a ready methodology.
Good fit when
- After a public CI compromise an attack flow is built step by step.
- A technique map and uncovered controls come out of a red-team report.
- A new method has no library entry and a proposal must be drafted.
- The team is shown the interactive visualizer on a real incident case.
Not a fit when
- A vulnerability scanner or automated code check is needed, while the framework only analyzes and describes.
- Instructions for carrying out attacks are wanted, but the materials target defense.
- The environment is not Claude Code, since the skills live in `.claude/skills/`.
Example request
Build an attack flow for the tj-actions incident, map the steps to SITF techniques and show which controls were missing.Limitations
The skills target Claude Code and live inside the repository, and the author gives no install command: clone the project or copy the folders. Attack flows are built from public reports and web search, so accuracy depends on the source, and the skill only suggests closing technique gaps through `/technique-proposal`. The mapping to OWASP SPVS does not cover every technique. The materials serve defense, but red-team reports contain sensitive details, so mind how they are stored.
How to disable. Delete the cloned repository or the copied `attack-flow`, `red-team-flow` and `technique-proposal` folders from the skills directory. Generated JSON flows sit in `sample-flows/` and `flows/red-team/`.
FAQ
Which skills are there?
`/attack-flow` for an incident, `/red-team-flow` for a security-assessment report and `/technique-proposal` for drafting a new technique.
Do I need to install anything for the visualizer?
No. Open it online from the project page or download `app/visualizer.html` and work offline.
What does the framework include?
Five infrastructure components, more than 75 techniques with risks and controls, a mapping to OWASP SPVS and case studies of real attacks.
Where does a skill write its output?
`/attack-flow` writes JSON to `sample-flows/<name>.json`, `/red-team-flow` to `flows/red-team/<name>.json` and technique proposals go to `technique-proposals/<id>.md`.
Where are the techniques in machine-readable form?
In `techniques.json`, the source of truth for `TECHNIQUE_LIBRARY.md` and the technique library page.
Discussion
No questions or reviews yet.
Related
SkillsClaude Code CyberSecurity Skills
Claude Code CyberSecurity Skill Collection
A set of 22 cybersecurity skills for Claude Code: recon, vulnerability assessment, incident response, red and blue team, malware analysis
A library of offensive security skills for the Claude Skills system: red team methodology across dozens of areas
A Claude Code skill that finds vulnerabilities in one session: threat model, verified findings, CWE and CVSS report.
A cybersecurity skill library: forensics, incident response, pentesting, cloud and malware analysis mapped to MITRE ATT&CK and NIST
Cybersecurity Skills
Cybersecurity Skills for AI Agents
42 security skills for Claude Code, Cursor and Codex: code and cloud audits, authorization-gated pentesting and incident response
Ten pentest skills for Claude Code and Gemini CLI: recon, SQL injection, XSS, LFI and a report, driven by plain-language requests
README in short
Built on an industry framework with a technique library and visualizer, not a one-off prompt for attack analysis.