skills.rest
bpnrockstar
bpnrockstarCOMMUNITY
Explore all skills by this author →
GitHub

supply-chain-attack-recon

Identify software supply-chain vulnerabilities in public GitHub repositories, Docker images, and SBOMs.

Updated Jul 1, 2026
Search Tags:#CI/CD security#vulnerability identification#supply-chain security#Docker security#external reconnaissance
One-click install
npx skills add https://github.com/bpnrockstar/UnifiedBugHunter --skill supply-chain-attack-recon-bpnrockstar
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: supply-chain-attack-recon
Source: https://github.com/bpnrockstar/UnifiedBugHunter/tree/main/skills/supply-chain-attack-recon
Command: npx skills add https://github.com/bpnrockstar/UnifiedBugHunter --skill supply-chain-attack-recon-bpnrockstar

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill provides comprehensive external reconnaissance for identifying potential software supply-chain vulnerabilities, helping organizations identify risks before they become compromised.

Core Features & Use Cases

  • Vulnerability Identification: Detects package-namespace squatting, dependency-confusion, and CI/CD misconfigurations.
  • External Reconnaissance: Focuses on public artifacts, including GitHub repositories, Docker images, and SBOMs.
  • Use Case: Before a penetration test, use this Skill to discover potential vulnerabilities in a target's external software dependencies and CI/CD pipelines.

Quick Start

Use the supply-chain-attack-recon skill to perform external reconnaissance on a target organization.

Frequently Asked Questions about supply-chain-attack-recon

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I detect software supply-chain vulnerabilities before a penetration test?▼

External reconnaissance identifies software supply-chain vulnerabilities by scanning publicly available artifacts like GitHub repositories, Docker images, and SBOMs for package-namespace squatting, dependency-confusion, and CI/CD misconfigurations.

What is dependency-confusion and how does external reconnaissance identify it?▼

Dependency-confusion occurs when a package manager inadvertently pulls malicious public code instead of an internal package. External reconnaissance identifies this by analyzing public package namespaces against an organization's internal usage patterns.

Can I check for CI/CD security misconfigurations in public GitHub repositories?▼

Yes, you can check for CI/CD security misconfigurations by performing external reconnaissance on publicly available GitHub repositories to detect insecure pipeline settings and exposed software supply-chain vulnerabilities.

Does external reconnaissance work for finding namespace squatting in Docker images?▼

Yes, external reconnaissance works for finding namespace squatting by assessing publicly available Docker images and package registries to detect malicious lookalike packages targeting an organization's software supply-chain.

What are the limitations of external reconnaissance for software supply-chain security?▼

External reconnaissance is limited to publicly available artifacts like GitHub repositories, Docker images, and SBOMs, meaning it cannot detect internal CI/CD misconfigurations or vulnerabilities hidden behind private access controls.

Related Skills

Explore More Software Engineering Skills→
n4igmen4igme

supply-chain-attack-recon

Identify external supply-chain exposure vectors for software targets.

Community
Advanced
EntroVyxEntroVyx
3

supply-chain-attack-recon

Identify package-namespace squatting and dependency-confusion vulnerabilities in public GitHub organizations.

Community
Advanced
robit-manrobit-man

supply-chain-forensics

Analyze dependency integrity, build pipelines, and SBOM composition for supply chain security.

Community
Advanced
cmndcntrlcybercmndcntrlcyber
3

supply-chain-attack-recon

Identify software supply-chain vulnerabilities via package squatting and dependency confusion.

Community
Advanced