Installs into .claude/skills of the current project.
Are you the author of Attack Path Map?
Add the live security badge to your README. It updates with every re-scan.
[](https://www.skillsdirectory.com/skills/sodejm-attack-path-map)
---
name: attack-path-map
description: Prepare evidence-cited ATT&CK behavior mapping, Attack Flow representation, and blocked Wiz graph query intents.
---
# Mapping and query intent
Map an action to a technique only when its described behavior matches an entry in an approved, pinned local ATT&CK bundle. A CVE or asset label alone is insufficient. Keep uncertain IDs as proposed reviews. Serialize Attack Flow actions and conditions only after a local versioned reference contract is approved.
For Wiz, use `scripts/attackpath.py query-intent --start ID --target ID --scope SCOPE`. Its `blocked_pending_docs` result is a request shape, not executable Wiz syntax. Do not render or execute API calls until approved operation, relationship, pagination, authentication, and field documentation is supplied. See `docs/integration-boundaries.md`.
