skills.rest
EntroVyx
EntroVyxCOMMUNITY
Explore all skills by this author →
GitHub

supply-chain-attack-recon

Identify package-namespace squatting and dependency-confusion vulnerabilities in public GitHub organizations.

3|1|Updated Jul 2, 2026
Search Tags:#ci/cd#github#reconnaissance#supply-chain#dependency-confusion#security-audit
One-click install
npx skills add https://github.com/EntroVyx/hermes-agent-offsec --skill supply-chain-attack-recon-entrovyx
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: supply-chain-attack-recon
Source: https://github.com/EntroVyx/hermes-agent-offsec/tree/main/skills/offsec/redteam/supply-chain-attack-recon
Command: npx skills add https://github.com/EntroVyx/hermes-agent-offsec --skill supply-chain-attack-recon-entrovyx

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires gh, jq, curl, docker, trufflehog, gitleaks, and includes scripts (resource) and references (resource) components.

What problem does it solve?

This skill addresses the difficulty of identifying software supply-chain vulnerabilities, such as dependency confusion, typosquatting, and CI/CD pipeline misconfigurations, within public-facing target infrastructure.

Core Features & Use Cases

  • Attack Surface Mapping: Automatically discovers public GitHub organizations, internal package names, and exposed build artifacts.
  • Vulnerability Identification: Scans for dependency-confusion candidates, typosquatting opportunities, and insecure GitHub Actions workflow patterns.
  • Use Case: Use this skill to audit a target's public GitHub repositories and package registry presence to identify potential entry points for supply-chain attacks before they are exploited by malicious actors.

Quick Start

Use the supply-chain-attack-recon skill to audit the target organization for internal package name leaks and insecure CI/CD workflow configurations.

Frequently Asked Questions about supply-chain-attack-recon

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I identify dependency-confusion vulnerabilities in public GitHub repositories?▼

To identify dependency-confusion vulnerabilities, you scan public GitHub organizations for internal package names and check if those namespaces are unregistered in public registries. This skill automates that reconnaissance to map potential injection vectors.

What is a supply-chain attack reconnaissance and how does it map attack surfaces?▼

Supply-chain attack reconnaissance involves discovering exposed build artifacts, internal package leaks, and insecure CI/CD workflows in public infrastructure. It maps attack surfaces by enumerating repositories and analyzing package metadata for security misconfigurations.

Can I use trufflehog and gitleaks to scan GitHub Actions workflows for secret leakage?▼

Yes, you can use trufflehog and gitleaks alongside standard shell utilities to scan GitHub Actions workflows. This skill integrates those dependencies to detect secret leakage and insecure CI/CD pipeline configurations across target organizations.

How do I audit public codebases for typosquatting and package-namespace squatting candidates?▼

Auditing for typosquatting involves analyzing package metadata from public GitHub organizations and container registries. This skill identifies package-namespace squatting candidates by enumerating repositories and mapping exposed build artifacts.

Do I need Docker and GitHub CLI installed to perform external reconnaissance on software supply chains?▼

Yes, you need Docker, GitHub CLI (gh), jq, and curl installed. These dependencies are required to enumerate repositories, analyze container registries, and execute scripts that identify CI/CD configuration exposures.

What is the best way to find insecure GitHub Actions workflow patterns in public organizations?▼

The best way to find insecure GitHub Actions patterns is through automated external reconnaissance of public repositories. This skill targets CI/CD configurations to identify insecure workflow patterns and potential injection vectors before exploitation.

Related Skills

Explore More Software Engineering Skills→
InnerScopeHearingInnerScopeHearing

supply-chain-guard

Secure repositories with cooldowns, SHA-pinning, leak scans, and CycloneDX SBOM generation.

Official
Advanced
uphiagouphiago
1.1k

supply-chain-attack-recon

Identify external software supply chain attack surfaces across public GitHub organizations, container registries, and package repositories.

Community
Advanced
kinnerkarmanishkinnerkarmanish

security-auditor

Detect vulnerabilities and misconfigurations across codebases using static analysis, dependency checks, and secret detection.

Community
Advanced
jassicsjassics
6

dependency-supply-chain-review

Review third-party dependencies for typosquatting, dependency confusion, and malicious scripts.

Community
Advanced