skills.rest
Skobyn
SkobynCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

supply-chain-attack-recon

Analyze public GitHub repos, Docker images, and package configs for supply-chain vulnerabilities.

Updated Jun 24, 2026
Search Tags:#vulnerability#github#reconnaissance#docker#supply-chain
One-click install
npx skills add https://github.com/Skobyn/talon --skill supply-chain-attack-recon-skobyn
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: supply-chain-attack-recon
Source: https://github.com/Skobyn/talon/tree/main/skills/supply-chain-attack-recon
Command: npx skills add https://github.com/Skobyn/talon --skill supply-chain-attack-recon-skobyn

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires github, docker, curl, jq, python3, and includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill provides external reconnaissance for software supply-chain attack surfaces, identifying potential vulnerabilities such as package-namespace squatting, dependency-confusion, and GitHub Actions injection openings.

Core Features & Use Cases

  • External Reconnaissance: Identifies package-namespace squatting candidates, dependency-confusion vulnerabilities, GitHub Actions injection openings, container image registry exposure, and more.
  • Use Case: Use this Skill to identify potential vulnerabilities in a target's software supply chain before they are exploited.
  • Step-by-Step Process: This Skill guides through the process of discovering a target's public GitHub organization, enumerating public repos for sensitive artifacts, internal package-name discovery, dependency-confusion vulnerability check, typosquat candidates, GitHub Actions workflow injection scan, Docker/container image registry mining, SBOM/artifact metadata leakage, internal registry URL leakage, and npm/PyPI organizational presence.

Quick Start

Use the supply-chain-attack-recon skill to perform a reconnaissance on the target organization 'targetorg'.

Frequently Asked Questions about supply-chain-attack-recon

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
What is software supply-chain reconnaissance and how does it find dependency-confusion vulnerabilities?▼

Software supply-chain reconnaissance identifies external attack surface vulnerabilities by analyzing public GitHub repositories and package configurations. It detects dependency-confusion by discovering internal package names and checking if they are unclaimed on public registries.

How do I check a GitHub organization for Actions workflow injection vulnerabilities?▼

To check for GitHub Actions injection vulnerabilities, you scan the target organization's public repositories. This Skill automates enumerating repositories and analyzing workflow files for untrusted input handling openings.

Can I scan Docker Hub and GHCR for exposed container image registry vulnerabilities?▼

Yes, you can scan Docker Hub and GHCR for exposed container images. This Skill utilizes the Docker API to mine public container image registries and identify potential artifact metadata leakage.

Do I need GitHub and Docker API access to perform package-namespace squatting reconnaissance?▼

Yes, you need access to public GitHub and Docker Hub or GHCR APIs. The reconnaissance process utilizes GitHub API, Docker API, curl, jq, and python3 to enumerate repositories and analyze package namespaces.

What is the best way to discover typosquat candidates and internal registry URL leakage?▼

The best way to discover typosquat candidates and internal registry URL leakage is by analyzing SBOM and artifact metadata. This Skill enumerates public repository artifacts to extract and analyze leaked internal registry URLs.

Related Skills

rickyanandarickyananda
1

github-auth

Configure GitHub authentication for HTTPS tokens, SSH keys, and gh CLI.

Community
Advanced
bpnrockstarbpnrockstar

supply-chain-attack-recon

Identify software supply-chain vulnerabilities in public GitHub repositories, Docker images, and SBOMs.

Community
Advanced
zerAdazerAda

supply_chain_security

Sign Docker images with Cosign and generate SBOMs for supply chain security.

Community
Advanced
jbaranskijbaranski

jeff-skill-install-dependabot

Create or update .github/dependabot.yml with npm dependency entries from package.json files.

Community
Intermediate