What problem does it solve? Organizations risk dependency confusion attacks when internal package names, registry priorities, or lockfile settings allow external registries to resolve private dependencies. This Skill plans an evidence-gated, authorized validation of those supply-chain boundaries without publishing packages or triggering builds. ## Core Features & Use Cases - Static Configuration Audit: Reviews package manifests, lockfiles, registry mappings, and CI dependency install configs in read-only mode. - Local Resolution Simulation: Uses a local resolver model to test whether internal dependencies would incorrectly resolve to unauthorized registries. - Strict Evidence Gating: Treats WAF blocks, timeouts, and scanner hits as inconclusive, and stops immediately on third-party data or irreversible side effects. - Use Case: A security team suspects their npm scope is misconfigured. The Skill audits the registry config and lockfile, simulates resolution priority locally, and produces owner-confirmed evidence without registering or publishing any package name. ## Quick Start Use hunt-dependency-confusion to plan an authorized, read-only validation of whether our internal package names could be resolved from public registries.
