What problem does it solve? Security assessors need a systematic way to identify supply-chain weaknesses—dependency confusion openings, typosquat candidates, CI/CD workflow injection points, and leaked internal package names—using only publicly accessible sources, without crossing into unauthorized offensive action. ## Core Features & Use Cases - Dependency-Confusion Discovery: Extracts internal package names from JS bundles, package.json files, and requirements.txt, then checks npm/PyPI/RubyGems for unclaimed names. - GitHub Actions Injection Scanning: Flags pull_request_target misuse, untrusted context interpolation, and mutable-tag action references across public org workflows. - Registry and SBOM Mining: Enumerates Docker Hub/GHCR images, extracts secrets from layers with trufflehog, and maps SBOM dependency versions to known CVEs via OSV. - Use Case: During an external assessment of a company with a public GitHub org, run the recon steps to find that an internal package referenced in their JS bundle is unclaimed on npm and their workflows use unpinned third-party actions—both reportable findings. ## Quick Start Use the supply-chain-attack-recon skill to enumerate the target organization's public GitHub repos and check their internal package names for dependency-confusion exposure.
