skills.rest
uphiago
uphiagoCOMMUNITY
Explore all skills by this author →
Website𝕏@uphiagoGitHub

supply-chain-attack-recon

Identify external software supply chain attack surfaces across public GitHub organizations, container registries, and package repositories.

1.1k|191|Updated Jun 24, 2026
Search Tags:#supply-chain-security#dependency-confusion#github-actions-security#container-registry-recon#sbom-mining#typosquat-detection#ci-cd-injection
One-click install
npx skills add https://github.com/uphiago/recon-skills --skill supply-chain-attack-recon-uphiago
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: supply-chain-attack-recon
Source: https://github.com/uphiago/recon-skills/tree/main/redteam/supply-chain-attack-recon
Command: npx skills add https://github.com/uphiago/recon-skills --skill supply-chain-attack-recon-uphiago

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Standard external reconnaissance often misses critical software supply chain vulnerabilities that attackers exploit to compromise entire software ecosystems, leading to widespread breaches with massive blast radius that are difficult to contain.

Core Features & Use Cases

  • Internal Package Name Discovery: Extracts internal-looking package names from public JS bundles, GitHub repository package files, and build artifacts to identify dependency confusion and typosquat candidates.
  • CI/CD Pipeline Security Scanning: Analyzes public GitHub Actions workflows for injection vulnerabilities, unpinned third-party actions, and secret exposure risks.
  • Artifact & Registry Mining: Inspects public container registries, SBOMs, and release assets for leaked secrets and vulnerable dependency versions for known CVE chaining.
  • Use Case: For a target with a public GitHub organization and public Docker Hub images, this skill can identify unclaimed internal package names that enable dependency confusion attacks, plus critical workflow injection flaws that could leak organization-wide CI secrets.

Quick Start

Use the supply-chain-attack-recon skill to perform external supply chain reconnaissance on the target organization that has a public GitHub presence and public container images.

Frequently Asked Questions about supply-chain-attack-recon

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I detect dependency confusion vulnerabilities in public GitHub organizations?▼

Detect dependency confusion by extracting internal-looking package names from public JS bundles and repository package files. The skill identifies unclaimed internal package names that enable attackers to publish malicious packages to public registries, compromising the target's build process.

What is CI/CD injection and how do I find it in GitHub Actions workflows?▼

CI/CD injection occurs when unpinned third-party actions or vulnerable workflow configurations allow code execution. This skill analyzes public GitHub Actions workflows to identify injection vulnerabilities, unpinned actions, and secret exposure risks that could leak organization-wide CI secrets.

Can I scan public container registries for leaked secrets and vulnerable dependencies?▼

Yes, you can scan public container registries by inspecting SBOMs and release assets. The skill mines public artifacts to detect leaked secrets and identifies vulnerable dependency versions, enabling known CVE chaining assessments against target build configurations.

How do I find typosquat candidates in software supply chains?▼

Find typosquat candidates by extracting internal-looking package names from public JS bundles and build artifacts. The skill validates finding exploitability against target build configurations to confirm which unclaimed package names pose genuine typosquatting risks.

Is external supply chain reconnaissance safe to perform without authorization?▼

External supply chain reconnaissance is calibrated to avoid unauthorized offensive actions. The skill performs external-only assessment against public infrastructure, validating exploitability without executing attacks, ensuring assessments remain within authorized boundaries.

What external attack surfaces exist in software supply chains with public development infrastructure?▼

External software supply chain attack surfaces include public GitHub organizations, container registries, and package repositories. The skill uncovers dependency confusion, typosquat, CI/CD injection, and secret exposure risks that attackers exploit to compromise entire software ecosystems.

Related Skills

Explore More Software Engineering Skills→
EntroVyxEntroVyx
3

supply-chain-attack-recon

Identify package-namespace squatting and dependency-confusion vulnerabilities in public GitHub organizations.

Community
Advanced
pluginagentmarketplacepluginagentmarketplace
3

code-injection

Detect code-injection vulnerabilities in AI systems with controlled payloads.

Community
Advanced
statick88statick88
1

vulnerability-scanning

Automate vulnerability detection across code, dependencies, containers, and infrastructure.

Community
Advanced
elementalsoulselementalsouls
3.3k

supply-chain-attack-recon

Identifies and maps external supply-chain attack surfaces from public GitHub, registries, and SBOMs.

Community
Advanced