Borrowing it
Nothing to install: this file belongs to ayuksel-tenb/tenable-attack-mapper. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/ayuksel-tenb/tenable-attack-mapper/main/.claude/skills/show-matrix/SKILL.mdgit clone --depth 1 https://github.com/ayuksel-tenb/tenable-attack-mapperWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/ayuksel-tenb/tenable-attack-mapper/show-matrix)<a href="https://agentmods.dev/skills/ayuksel-tenb/tenable-attack-mapper/show-matrix"><img src="https://agentmods.dev/badge/skills/ayuksel-tenb/tenable-attack-mapper/show-matrix.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00083 | $0.00994 |
| Opus 5 | $0.00042 | $0.00497 |
| Sonnet 5 | $0.00017 | $0.00199 |
| Haiku 4.5 | $0.00008 | $0.00099 |
Grade A, and why
show-matrix scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
for i in $(seq 1 30); do curl -fsS -o /dev/null "http://localhost:${VIEWER_PORT:-8080}/" && break; sleep 1; done How it starts
The opening of the file, as written. The whole thing — 78 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Show the ATT&CK matrix
End-to-end: from a clone of tenable-attack-mapper with a configured .env,
produce a VPR-scored ATT&CK matrix in the browser, mapping live Security Center
findings. The mapping core stays here; this skill does the visible side-effecting
steps (clone, compose, open browser) with Bash. Run everything from the
tenable-attack-mapper repo root.
Steps
-
Check config. Ensure
.envexists with the Security Center URL/keys (TSC_URL/TSC_ACCESS_KEY/TSC_SECRET_KEY). Semantic mapping uses the localclaudeCLI (no API key needed). If.envis missing, tell the user tocp .env.example .envand fill it in, then retry. Do not invent credentials. -
Clone the viewer if missing:
[ -d attack-navigator ] || git clone https://github.com/ayuksel-tenb/attack-navigator -
Point the viewer's "Open in SC" links at the same Security Center. Copy the
TSC_URLfrom.envintoattack-navigator/.envasSC_URL:SC_URL=$(grep -E '^TSC_URL=' .env | cut -d= -f2-) printf 'SC_URL=%s\n' "$SC_URL" > attack-navigator/.env -
Map findings → layer. This connects to the SC in
.env, pulls open findings, maps them to ATT&CK (deterministic + semantic), and writes the layer the viewer reads:uv run tenable-attack-mapper run --out attack-navigator/layers/layer.json --report coverage.md- Do NOT pipe through
tail/head— that hides the progress the tool prints to stderr (Pulled N findings,semantic: batch i/N done). Let it stream. - On a cold cache this takes a few minutes (maps ~thousands of findings via the LLM API) — expected, do not cancel; relay the progress as it streams. Re-runs are instant (cache).
- If slow/rate-limited, lower concurrency:
TASC_SEMANTIC_WORKERS=4 uv run …. - (No
uv?pip install -e . && tenable-attack-mapper run ….)
- Do NOT pipe through
-
Bring up the viewer (custom ATT&CK matrix UI). If port 8080 is taken, set
VIEWER_PORTto a free port (e.g. 8090) and use it everywhere below:cd attack-navigator && docker compose up -d viewer && cd ..
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago First seen · 78 lines · 83 tokens per session scan A b9a8cd02f18a
show-matrix is a skill published in the GitHub repository ayuksel-tenb/tenable-attack-mapper (5 stars, last pushed 2mo ago), licensed MIT. It adds 83 tokens to every session and 994 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
conducting-full-scope-red-team-engagement
Plan and execute a comprehensive red team engagement covering reconnaissance through post-exploitation using MITRE ATT&CK-aligned TTPs to evaluate an organization's detection and response capabilities.
conducting-full-scope-red-team-engagement
Plan and execute a comprehensive, MITRE ATT&CK-aligned red team engagement spanning threat modeling, reconnaissance, initial access, and post-exploitation to evaluate an organization's detection, prevention, and response against APT-style behavior. Use when scoping or running a full-scope, objective-based engagement…
release-and-publish
Ship a release end-to-end across every registry the project targets (npm, MCP Registry, GitHub Releases for .mcpb bundles, GHCR). Runs the final verification gate, pushes commits and tags, then publishes to each applicable destination. Assumes git wrapup (version bumps, changelog, commit, annotated tag) is already…
design-mcp-server
Design the tool surface, resources, and service layer for a new MCP server. Use when starting a new server, planning a major feature expansion, or when the user describes a domain/API they want to expose via MCP. Produces a design doc at docs/design.md that drives implementation.
add-tool
Scaffold a new MCP tool definition. Use when the user asks to add a tool, create a new tool, or implement a new capability for the server.
api-linter
MCP definition linter rules reference. Use when bun run lint:mcp or bun run devcheck reports a lint error or warning (format-parity, schema-is-object, name-format, server-json-, etc.) and you need to understand the rule, its severity, and how to fix it. Every rule ID the linter emits has an entry in this doc.