rea
Reverse engineer anything with agents, from app behavior down to native binaries.
420k
@morlutoSecurity
Plugin
sitf
Generates SITF-compliant attack flow JSON files from incident reports, red team or pentest findings, and attack descriptions, and proposes new techniques when attack steps have no existing mapping. Useful for security analysts documenting supply chain attacks and breaches.
Plugin Signal65/100Solid
maintained94
capable29
documented80
adopted48
Claude Code
$ npx -y skills add wiz-sec-public/SITF --agent claude-code
Codex
$ npx skills add wiz-sec-public/SITF -a codex
Cursor
$ npx skills add wiz-sec-public/SITF -a cursor
Gemini CLI
$ npx skills add wiz-sec-public/SITF -a gemini-cli
GitHub Copilot
$ npx skills add wiz-sec-public/SITF -a github-copilot
OpenCode
$ npx skills add wiz-sec-public/SITF -a opencode
Windsurf
$ npx skills add wiz-sec-public/SITF -a windsurf
What's inside
3 Skills
/attack-flowGenerate SITF-compliant attack flow JSON files from attack descriptions or incident reports. Use when analyzing supply chain attacks, breaches, or security incidents./red-team-flowGenerate SITF-compliant attack flow JSON from red team or pentest reports. Accepts report files, URLs, or pasted findings. Use when documenting offensive security engagements./technique-proposalGenerate a PR-ready technique proposal when an attack step doesn't map to existing SITF techniques. Use after /attack-flow identifies technique gaps.
README
SDLC Infrastructure Threat Framework (SITF)
A comprehensive framework for analyzing and defending against attacks targeting Software Development Lifecycle infrastructure.
Quick Start
🌐 Try Online (No Installation Required)
Launch the Flow Builder - Interactive tool for mapping attack flows
Explore Techniques Visually - Interactive visual explorer with filtering and search
🤖 Use with Claude AI
Automated Attack Flow Generation - Use Claude skills to automatically generate SITF-compliant attack flows and technique proposals:
| Skill | Purpose |
|---|---|
/attack-flow | Generate flows from public incidents and breach reports |
/red-team-flow | Generate flows from red team/pentest engagement reports |
/technique-proposal | Create new technique definitions when gaps are identified |
See SKILLS.md for detailed usage instructions and examples.
📁 Use Locally
Launch builder locally - Download visualizer.html locally, open and build offline
Explore techniques - Download techniques-library.html locally, open and browse techniques offline
📖 Documentation
Read the Implementation Guide - Complete methodology, case studies, and usage instructions
What is SITF?
SITF helps security teams analyze supply chain attacks by:
- Visualizing attack stages across SDLC components (Endpoint, VCS, CI/CD, Registry, Production)
- Identifying the risks that enabled each attack technique
- Mapping risks to appropriate security controls
- Understanding attack paths and lateral movement patterns
Framework Components
- 5 Infrastructure Components: Endpoint/IDE, VCS, CI/CD, Registry, Production/Cloud
- 75+ Attack Techniques: Pre-mapped with enabling risks and security controls
- Dual Control Types: Protective controls (prevent attacks) and Detective controls (detect attacks)
- Framework Mappings: Controls mapped to industry frameworks (OWASP SPVS)
- Interactive Visualizer: Drag-and-drop interface for building attack flow diagrams
- Real-World Case Studies: CircleCI breach, Shai-Hulud-2, TrustWallet, tj-actions, CodeBreach, s1ngularity
Documentation
- IMPLEMENTATION_GUIDE.md - Start here for complete framework overview
- TECHNIQUE_LIBRARY.md - Reference catalog of all techniques
- techniques.json - Machine-readable source of truth for all techniques
- app/README.md - Visualizer setup and usage
- SKILLS.md - Claude AI skills documentation and usage examples
Claude AI Skills
SITF includes Claude AI skills for automated attack flow generation. See SKILLS.md for complete documentation.
| Skill | Input | Output |
|---|---|---|
/attack-flow | Incident name, URL, or web search | sample-flows/<name>.json |
/red-team-flow | Engagement report (file/URL/text) | flows/red-team/<name>.json |
/technique-proposal | Gap description | technique-proposals/<id>.md |
Contributing
Adding or Modifying Techniques
Manual Method:
- Edit
techniques.json- the source of truth - Run
python3 build-techniques.pyto regenerate documentation and web app - Commit all changes (JSON, Markdown, and HTML)
- Submit PR or use locally
Automated Method (with Claude):
- Use
/technique-proposalto generate a complete technique definition - Add the generated JSON to
techniques.json - Run
python3 build-techniques.pyto regenerate documentation - Submit PR with the proposal rationale
The build script generates:
TECHNIQUE_LIBRARY.md- Human-readable documentationapp/techniques-library.html- Visual technique explorer with filtering and searchapp/visualizer.html- Interactive attack flow builder
Creating Attack Flows
Manual Method:
- Use the online visualizer to build flows interactively
Automated Method (with Claude):
- Use
/attack-flow <attack-name> websearchto automatically generate flows from incident reports
Target Audience: Incident Response Teams, Security Architects, Threat Intelligence Teams, Security Engineers
Focus: Protecting producer organizations (software vendors, OSS maintainers) who create supply chain components
Starting April 14 2026, SITF is licensed under CC BY-NC 4.0. Versions prior to this date remain under CC BY-NC-ND 4.0.
Stars on GitHub
Momentum
- stars in total
- 185
File tree
Similar plugins.
@morlutoreverse-skill
A skill pack for authorized reverse engineering, security research, and penetration testing that routes tasks to the right skill and sets up needed tools on demand. It covers API security assessment and Android APK analysis, among others.
46 skills45k
@zhaoxuya520cybersecurity-skills
Gives an AI agent the step-by-step workflow a senior security analyst follows, covering when to use each technique, what to check first, how to run it and how to verify the result. Covers incident response, forensics, threat intelligence, malware analysis, penetration testing and red teaming.
200 skills36k
@mukul975watermarks-remover
Agent skill + stdlib Python service to strip multi-vendor AI provenance marks from text and files, for privacy and hygiene on content you own. The skill is a thin client: it drives the machinery over HTTP, so the agent host needs no Python.
2 skills1 hook26k
@guillaumemeyerQuestions about sitf.
Install it with the command on its page. It includes attack-flow, red-team-flow, technique-proposal. Its skills do not fire on their own yet. Free and open source.
- What is sitf?
- wiz-sec-public/sitf is a security plugin that ships skills for analyzing and defending against attacks on software development lifecycle infrastructure. Use it to turn incident reports and red team findings into SITF attack flow JSON, or to propose new techniques for unmapped attack steps.
- How do I install sitf?
- Run these in Claude Code: npx -y skills add wiz-sec-public/SITF --agent claude-code. Then prompt normally.
- Does sitf auto-invoke its skills?
- Not yet. It is indexed on Flowy as a plain plugin.
- Is sitf free?
- Yes. Flowy is free and open source, with nothing gated. You can read every skill in full before you install.
- Which coding agents can use sitf's skills?
- sitf installs in Claude Code, and its skills also install in Codex, Cursor, Gemini CLI, GitHub Copilot, OpenCode and Windsurf with the skills CLI. Each skill's page has the install command. Flowy's auto-invocation, which fires a skill when your prompt matches, runs in Claude Code only.
Is this plugin yours?
Claim it with GitHubSubmit a pluginPromote it