skills.rest
cmndcntrlcyber
cmndcntrlcyberCOMMUNITY
Explore all skills by this author →
GitHub

supply-chain-attack-recon

Identify software supply-chain vulnerabilities via package squatting and dependency confusion.

3|Updated Nov 12, 2025
Search Tags:#vulnerability detection#dependency confusion#supply-chain security#external recon#software supply-chain
One-click install
npx skills add https://github.com/cmndcntrlcyber/rtpi --skill supply-chain-attack-recon-cmndcntrlcyber
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: supply-chain-attack-recon
Source: https://github.com/cmndcntrlcyber/rtpi/tree/main/knowledge_seed/bug_hunter_skills/supply-chain-attack-recon
Command: npx skills add https://github.com/cmndcntrlcyber/rtpi --skill supply-chain-attack-recon-cmndcntrlcyber

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires alex-birsan-dependency-confusion, supply-chain-research, github-actions-security, and includes scripts (resource) and references (resource) and assets (resource) components.

What problem does it solve?

This Skill automates external reconnaissance for potential vulnerabilities in a software supply-chain, providing actionable insights into attack vectors and potential targets.

Core Features & Use Cases

  • Reconnaissance and Identification: Automates the identification of package-namespace squatting candidates, dependency-confusion vulnerabilities, GitHub Actions injection opportunities, container image registry exposure, SBOM mining, and more.
  • Targeting: Use when the target has a public GitHub org, accessible build artifacts/SBOMs, Docker images on public registries, or internal package names in JS bundles.
  • Use Case: Detecting a target that has a public GitHub organization, you can use this Skill to discover and flag potential vulnerabilities within their supply-chain, including dependency confusion and package name squatting.

Quick Start

To get started, specify the target brand name as 'TARGET' and trigger the skill to initiate external reconnaissance.

Frequently Asked Questions about supply-chain-attack-recon

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I discover software supply-chain vulnerabilities in a public GitHub organization?▼

To discover software supply-chain vulnerabilities, you can automate external reconnaissance to examine package-namespace squatting, dependency-confusion, and GitHub Actions injection opportunities within the target organization.

What is dependency confusion and how do I detect it externally?▼

Dependency confusion occurs when package managers pull malicious public packages instead of internal ones. You can detect it externally by analyzing internal package names found in JS bundles and comparing them against public registries.

Can I scan Docker images and SBOMs for external supply-chain security gaps?▼

Yes, supply-chain reconnaissance can mine Software Bills of Materials (SBOMs) and public container image registries to identify exposed build artifacts and potential security gaps in the target's infrastructure.

What is the best way to automate package-namespace squatting reconnaissance?▼

The best way to automate package-namespace squatting reconnaissance is to specify the target brand name and trigger an automated scan that identifies security gaps across public GitHub and package registries.

Do I need private access to run dependency-confusion reconnaissance on a target?▼

No, you do not need private access. This external reconnaissance requires only access to public GitHub and package registries to gather information on potential software supply-chain attack vectors.

Related Skills

n4igmen4igme

supply-chain-attack-recon

Identify external supply-chain exposure vectors for software targets.

Community
Advanced
EntroVyxEntroVyx
3

supply-chain-attack-recon

Identify package-namespace squatting and dependency-confusion vulnerabilities in public GitHub organizations.

Community
Advanced
jmaglyjmagly
175

supply-chain-forensics

Analyze software supply chains with SBOM generation, dependency verification, and SLSA mapping.

Community
Advanced
bpnrockstarbpnrockstar

supply-chain-attack-recon

Identify software supply-chain vulnerabilities in public GitHub repositories, Docker images, and SBOMs.

Community
Advanced