jd-opensource/pentest-supply-chain
skills/pentest-supply-chain/SKILL.md
Software supply chain security — dependency confusion, CI/CD pipeline attacks, lockfile integrity, and build artifact verification.
$ install --global
skillsauthnpx skillsauth add jd-opensource/joysafeter pentest-supply-chainInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Apr 6, 2026, 2:18 AM4.1s3 files scanned
SKILL.md
- name:
- pentest-supply-chain
- description:
- Software supply chain security — dependency confusion, CI/CD pipeline attacks, lockfile integrity, and build artifact verification.
Pentest Supply Chain
Purpose
Supply chain attacks (SolarWinds, Log4Shell, xz-utils) are the fastest-growing threat category. Shannon explicitly excludes "vulnerable third-party libraries." MITRE ATT&CK T1195 has zero coverage in any existing skill.
Prerequisites
Authorization Requirements
- Written authorization with supply chain testing scope
- Repository access for dependency and CI/CD analysis
- Registry awareness — confirm which private registries are in use
- Build system access for pipeline review (if white-box)
Environment Setup
- Snyk CLI for dependency vulnerability scanning
- npm audit / pip-audit for ecosystem-specific checks
- Trivy for container and filesystem scanning
- socket.dev for dependency risk analysis
Core Workflow
- Dependency Audit: Analyze package.json/requirements.txt/go.mod for known vulnerable versions, unmaintained packages, suspicious dependencies.
- Dependency Confusion: Check if internal package names can be claimed on public registries (npm, PyPI). Test namespace squatting.
- CI/CD Pipeline Security: Review GitHub Actions/GitLab CI for injection via PR titles/branch names, secrets in logs, unpinned action versions, runner escape.
- Build Artifact Integrity: Verify signatures on containers/packages, check for unsigned artifacts, test image tag mutability.
- Lockfile Integrity: Detect lockfile injection (manipulated resolved URLs), verify lockfile-to-manifest consistency.
- Install Script Abuse: Identify packages with install hooks executing arbitrary code, test typosquatting candidates.
- SBOM Generation: Generate Software Bill of Materials and map transitive dependency risk with CVE correlation.
Tool Categories
| Category | Tools | Purpose | |----------|-------|---------| | Dependency Scanning | Snyk, npm audit, pip-audit | Known CVE detection | | Container Scanning | Trivy, Grype | Image vulnerability analysis | | Dependency Risk | socket.dev, Semgrep | Behavioral risk analysis | | CI/CD Review | custom scripts, actionlint | Pipeline security audit | | SBOM | syft, cyclonedx-cli | Bill of materials generation |
References
references/tools.md- Tool function signatures and parametersreferences/workflows.md- Attack pattern definitions and test vectors
Related Skills
jd-opensource/xlsx
development
VerifiedTrustedCommunity
Comprehensive spreadsheet creation, editing, and analysis with support for formulas, formatting, data analysis, and visualization. When Claude needs to work with spreadsheets (.xlsx, .xlsm, .csv, .tsv, etc) for: (1) Creating new spreadsheets with formulas and formatting, (2) Reading or analyzing data, (3) Modify existing spreadsheets while preserving formulas, (4) Data analysis and visualization in spreadsheets, or (5) Recalculating formulas
238SKILL.mdUpdated Apr 6, 2026
jd-opensource/writing-plans
development
VerifiedTrustedCommunity
Use when you have a spec or requirements for a multi-step task, before touching code
238SKILL.mdUpdated Apr 6, 2026
jd-opensource/skill-security-auditor
testing
VerifiedTrustedCommunity
OpenClaw Skills 全方位安全审计工具，检测供应链投毒、Prompt注入、恶意代码模式、权限越权和依赖风险
238SKILL.mdUpdated Apr 6, 2026
jd-opensource/skill-creator
tools
VerifiedTrustedCommunity
Guide for creating effective skills. This skill should be used when users want to create a new skill (or update an existing skill) that extends an agent's capabilities with specialized knowledge, workflows, or tool integrations.
238SKILL.mdUpdated Apr 6, 2026