skills.rest
Kisilev13
Kisilev13COMMUNITY
Explore all skills by this author →
GitHub

supply-chain-attack-recon

Identify software supply-chain vulnerabilities via external GitHub and registry reconnaissance.

Updated Jun 18, 2026
Search Tags:#vulnerability#reconnaissance#GitHub Actions#supply-chain#dependency confusion
One-click install
npx skills add https://github.com/Kisilev13/Hermes-Agent-Workspace --skill supply-chain-attack-recon-kisilev13
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: supply-chain-attack-recon
Source: https://github.com/Kisilev13/Hermes-Agent-Workspace/tree/main/skills/supply-chain-attack-recon
Command: npx skills add https://github.com/Kisilev13/Hermes-Agent-Workspace --skill supply-chain-attack-recon-kisilev13

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires trufflehog, gitleaks, dependency-confusion, packj, Lift, Snyk vuln-db, actionlint, OSSGadget, semgrep, osv-scanner, and includes scripts (resource) and references (resource) and assets (resource) components.

What problem does it solve?

This Skill performs external reconnaissance on a software supply-chain to identify potential vulnerabilities such as dependency confusion, GitHub Actions injection, and internal package name leakage.

Core Features & Use Cases

  • GitHub Org Discovery: Identify targets with public GitHub orgs and enumerate their public repositories.
  • Internal Package-Name Discovery: Detect internal package names in JS/Android bundles and package.json files.
  • Dependency-Confusion Vulnerability Check: Validate if internal-looking package names are registerable on public registries.
  • Typosquat Candidates: Identify potential typosquat candidates around external dependencies.
  • GitHub Actions Workflow Injection Scan: Scan public repositories for GitHub Actions workflows that may lead to injection vulnerabilities.
  • Docker/Container Image Registry Mining: Enumerate Docker images on public registries and inspect layers for secrets.
  • SBOM/Artifact Metadata Leakage: Identify SBOMs and JSON dependency lockfiles in public releases.
  • Internal Registry URL Leakage: Detect leakage of internal registry URLs in configuration files.
  • npm/PyPI Organizational Presence: Check for public npm and PyPI scopes associated with the target organization.

Quick Start

Use the supply-chain-attack-recon skill to perform reconnaissance on the target organization 'example-organization'.

Frequently Asked Questions about supply-chain-attack-recon

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I check a GitHub organization for dependency confusion vulnerabilities?▼

To check for dependency confusion, you discover internal package names in public repositories and validate if they are registerable on public registries. This identifies if public packages can hijack internal dependencies.

What is a GitHub Actions workflow injection scan and how does it work?▼

A GitHub Actions workflow injection scan identifies public repositories with workflows susceptible to injection vulnerabilities. It analyzes workflow files to detect unsafe handling of user-controlled inputs, preventing potential code execution during CI/CD pipelines.

How do I find leaked secrets in Docker container images on public registries?▼

Finding leaked secrets in Docker images involves enumerating public container registries and inspecting image layers. This reconnaissance extracts configuration files and embedded credentials to detect sensitive data exposure in the supply chain.

Can I detect internal registry URL leakage in public repository configuration files?▼

Yes, you can detect internal registry URL leakage by scanning configuration files in public repositories. This reconnaissance identifies exposed private registry endpoints, revealing internal infrastructure details and potential attack surfaces.

Do I need trufflehog and gitleaks to perform software supply-chain reconnaissance?▼

Yes, tools like trufflehog, gitleaks, and dependency-confusion checkers are required. This skill orchestrates these dependencies alongside semgrep and osv-scanner to perform comprehensive external reconnaissance on GitHub orgs and public registries.

What is the best way to identify typosquat candidates for external dependencies?▼

The best way to identify typosquat candidates is to enumerate external dependencies from package.json and lockfiles, then generate similarity checks against public registries. This detects malicious packages mimicking legitimate library names.

Related Skills

Explore More Software Engineering Skills→
chatbotkitchatbotkit
13

supply-chain-attack-recon

Identifies and maps external supply-chain risks from public GitHub orgs and registries.

Official
Advanced
cmndcntrlcybercmndcntrlcyber
3

supply-chain-attack-recon

Identify software supply-chain vulnerabilities via package squatting and dependency confusion.

Community
Advanced
manastalukdarmanastalukdar
1

secrets-scan

Scan codebases and Git history for exposed secrets using Gitleaks and TruffleHog.

Community
Advanced
dandudzidandudzi
2

sast-configuration

Automate SAST tool selection, configuration, and CI/CD integration.

Community
Advanced