Find public-package risks in your private builds.
What it does
Assesses dependency-confusion risks in package manifests and guides authorized testing and defensive controls.
When to use it
Use for package-manifest reviews and authorized red-team supply-chain exercises.
How to use it
Give it a project's dependency manifests; it assesses dependency-confusion risks and guides proof-of-concept testing when authorized.
What you provide
- An existing project
Uses
What you need · 1
For tasks coming from supply-chain, repository-exposure, or CI-build reconnaissance, instructs the agent to use recon-for-sec first to enumerate internal package names and possible public-registry collisions.
Access · 5
This skill
public registry
Publishes test packages publicly
a controlled callback server
Sends execution-proof callbacks
npmjs
Checks public npm package versions