skills.rest
n4igme
n4igmeCOMMUNITY
Explore all skills by this author →
Website𝕏@nevrectlGitHub

supply-chain-attack-recon

Identify external supply-chain exposure vectors for software targets.

Updated Jun 23, 2024
Search Tags:#reconnaissance#supply-chain#github-actions#dependency-confusion#osint#sbom#container-registry
One-click install
npx skills add https://github.com/n4igme/randscript --skill supply-chain-attack-recon-n4igme
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: supply-chain-attack-recon
Source: https://github.com/n4igme/randscript/tree/main/llm/skills/claude-hunter/skills/supply-chain-attack-recon
Command: npx skills add https://github.com/n4igme/randscript --skill supply-chain-attack-recon-n4igme

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

External reconnaissance of software supply-chain attack surface to identify dependency-confusion candidates, internal-package-name leakage, GitHub Actions injection openings, container image registry exposure, SBOM mining, and CI/CD configuration exposure. Reconnaissance and identification ONLY; actual publishing or typosquat attacks require explicit written sign-off because they can affect the entire npm/PyPI ecosystem.

Core Features & Use Cases

  • Identify package-namespace squatting candidates, dependency-confusion vulnerabilities, GitHub Actions injection openings, container image registry exposure, SBOM mining, internal-package-name leakage, and CI/CD configuration exposure.
  • Use when the target has a public GitHub organization, build artifacts/SBOMs are reachable, docker images are on public registries, or internal-looking package names appear in JS bundles.
  • Note: External-only boundary; actual publishing or typosquat activities require explicit authorization.

Quick Start

Run an external reconnaissance pass against the target's public GitHub organization to identify dependency-confusion candidates, internal-package-name leakage, SBOM exposure, and CI/CD configuration exposure.

Frequently Asked Questions about supply-chain-attack-recon

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I find dependency-confusion vulnerabilities in a public GitHub organization?▼

Supply-chain reconnaissance identifies dependency-confusion candidates by analyzing external exposure vectors like internal-package-name leakage in JS bundles and public build logs, surfacing targets vulnerable to namespace squatting without active exploitation.

What is SBOM mining for software supply-chain risk assessment?▼

SBOM mining extracts reachable Software Bill of Materials artifacts from public build logs or repositories to enumerate component dependencies, exposing internal package leakage and third-party risk vectors across the target's software supply chain.

Can I detect GitHub Actions injection opportunities through external reconnaissance?▼

Yes, external supply-chain reconnaissance analyzes public GitHub Actions workflows and CI/CD configurations to identify script injection openings, workflow trigger exposures, and secrets leakage vectors without accessing internal repository settings.

How do I check container image registry exposure for software supply-chain risks?▼

Supply-chain reconnaissance scans public container image registries and Docker images associated with the target to identify exposed images, leaked internal layers, and metadata that reveals build pipeline configuration details.

Does this supply-chain reconnaissance tool perform active typosquat or package publishing attacks?▼

No, it enforces an external-only boundary for reconnaissance and identification. Actual package publishing or typosquat attacks against npm or PyPI require explicit written authorization because they impact the entire ecosystem.

When do I need external supply-chain reconnaissance for a software target?▼

You need it when the target has a public GitHub organization, accessible SBOMs, public Docker images, reachable build logs, or when internal-looking package names appear in JS bundles, signaling potential supply-chain attack surface.

Related Skills

Explore More Software Engineering Skills→
grivera82grivera82

supply-chain-attack-recon

Enumerate public GitHub orgs, dependencies, SBOMs, and CI/CD configurations for supply-chain risks.

Community
Advanced
elementalsoulselementalsouls
3.3k

supply-chain-attack-recon

Identifies and maps external supply-chain attack surfaces from public GitHub, registries, and SBOMs.

Community
Advanced
robit-manrobit-man

supply-chain-forensics

Analyze dependency integrity, build pipelines, and SBOM composition for supply chain security.

Community
Advanced
uphiagouphiago
1.1k

supply-chain-attack-recon

Identify external software supply chain attack surfaces across public GitHub organizations, container registries, and package repositories.

Community
Advanced