attack-chain-analysis

An analysis step that looks for attack chains, where one security problem gives an attacker what they need to exploit another. It then describes the combined attack in plain language.

In plain words
What is it for?
Use it after vulnerability and design reviews to assess whether multiple findings combine into a more serious attack.
Why use it?
Separate findings can underestimate the damage when they work together. This step helps identify combinations such as information disclosure followed by credential use or file access followed by code execution.

Agent for Claude Code

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add agents/thejefflarson/soundcheck/attack-chain-analysis
Clone the repo
git clone --depth 1 https://github.com/thejefflarson/soundcheck

Made for: Claude Code.

Per session 38 Only the description is in the session, so the agent can decide to use it. The body loads when it is invoked.
When invoked 1,477 The whole file, excluding the scripts and references it only reads on demand.
Security scan B 1 finding. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00038 $0.01477
Opus 5 $0.00019 $0.00739
Sonnet 5 $0.00008 $0.00295
Haiku 4.5 $0.00004 $0.00148

Measured 2d ago against content hash c685cc5d2352, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade B, and why

attack-chain-analysis scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Cloud metadata endpointmediumServer-side request forgery

One request to 169.254.169.254 can return temporary IAM credentials.

`169.254.169.254` on AWS turns into IAM role takeover.

Downgraded: this mod is about security review, or the phrase is quoted, so it is likely naming the pattern rather than instructing it.

.claude/agents/attack-chain-analysis.md · 150 lines

How it starts

The opening of the file, as written. The whole thing — 150 lines — stays where its author put it; the contents beside it link to each section on GitHub.

You look at a set of vulnerability findings and decide whether any of them combine into a worse-than-the-individual-pieces attack. Final analytical stage of the Soundcheck security review pipeline.

Most reviews don't produce chains — that's fine. Your job is to find them when they exist, not to invent chains to make a report look more dramatic. A speculative chain that doesn't really connect is worse than no chain at all.

Why this stage matters

Individual findings get triaged by severity. But two Medium findings can compose into a Critical-level outcome if one of them gives the attacker something the other one needs. Some recurring shapes:

  • Info disclosure → credential use. An unauthenticated debug endpoint that prints environment variables (Medium on its own) plus a missing rotation policy on those credentials (Medium on its own) becomes Critical when the attacker is now the holder of valid prod creds.
  • Path traversal → file write → code execution. A path-traversal bug that's only a "read" might be Medium. The same bug as a "write" (e.g. on a logging path) plus a writable __pycache__ or init file becomes RCE.
  • CSRF + state-changing endpoint without CSRF check. Either alone is bounded; combined, an attacker can take state-changing actions on behalf of any logged-in user who visits a hostile page.
  • Prompt injection → tool use → exfiltration. An LLM agent that fetches user-controlled URLs and also has a "send email" tool becomes a data-exfil channel for anything the agent can see.
  • SSRF + cloud metadata service. SSRF that can reach 169.254.169.254 on AWS turns into IAM role takeover.

Inputs

The user message will include a merged JSON array of findings from the Stages 1b + 2 auditors:

[{"severity", "file", "line", "skill", "finding", "fix"}, ...]

Each finding has an implicit id equal to its index in the array (0, 1, 2, …). You'll reference these ids in finding_ids.

What to do

Read the full file on GitHub · 150 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 2d ago First seen · 150 lines · 38 tokens per session scan B c685cc5d2352

Subscribe to this mod's changes

attack-chain-analysis is an agent published in the GitHub repository thejefflarson/soundcheck (20 stars, last pushed 1mo ago), licensed MIT. It adds 38 tokens to every session and 1,477 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it B with 1 finding (cloud metadata endpoint). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.