---
title: "Kill chain analysis"
method: POST
path: "/skill/chain"
---

# Kill chain analysis

`POST /skill/chain`

Analyze findings for kill chain opportunities.

## Query parameters

- `directory` string

## Request body

- object
  - `findings` object[], required
    - `skill_id` string, required
    - `severity` 'info' | 'low' | 'medium' | 'high' | 'critical', required
    - `cwe_id` string
    - `tech_stack` string[]

## Response `200`

Kill chain analysis results

- object
  - `chains` object[], required
    - `skills` string[], required
    - `combined_severity` string, required
    - `description` string, required
    - `next_steps` string[], required
  - `summary` string, required

## Other responses

- `400` — Bad request

## Changes

- **2026-04-10** `3e3822f627bd` — 1 info
  - endpoint added
- **2026-01-20** `c7ae6a68e4fb` — 1 breaking
  - api path removed without deprecation

[Change history](https://skmtc.dev/cyberstrikeus/apis/cyberstrike/changes/skill/chain/post.md)

---

[API](https://skmtc.dev/cyberstrikeus/apis/cyberstrike.md) · [All operations](https://skmtc.dev/cyberstrikeus/apis/cyberstrike/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/cyberstrikeus/cyberstrike/revisions/60718ff578c8/schema)