About pentest-supply-chain
A security-testing skill for assessing software supply-chain risks in dependencies, CI/CD pipelines, and build artifacts. It outlines an authorized review workflow and relevant scanning and analysis tools.
Key features
- 01Dependency and package risk review
- 02Public-registry dependency confusion checks
- 03CI/CD pipeline security review
- 04Artifact and lockfile integrity checks
- 05Install-hook and typosquatting analysis
- 06SBOM generation and CVE mapping
Use cases
- 01Audit dependencies before a release
- 02Review CI/CD workflows for injection and secret exposure
- 03Check package and container artifact integrity
Install
Copy the command and run it in a terminal.
$
npx skills add https:/After installing, type/pentest-supply-chainin Claude Code to confirm it loaded.
Bundled filesreferences/tools.mdreferences/workflows.md
Details
From the project READMEPentest Supply Chain
Purpose
Supply chain attacks (SolarWinds, Log4Shell, xz-utils) are the fastest-growing threat category. Shannon explicitly excludes "vulnerable third-party libraries." MITRE ATT&CK T1195 has zero coverage in any existing skill.
Prerequisites
Authorization Requirements
- Written authorization with supply chain testing scope
- Repository access for dependency and CI/CD analysis
- Registry awareness — confirm which private registries are in use
- Build system access for pipeline review (if white-box)
Environment Setup
- Snyk CLI for dependency vulnerability scanning
- npm audit / pip-audit for ecosystem-specific checks
- Trivy for container and filesystem scanning
- socket.dev for dependency risk analysis
Core Workflow
- Dependency Audit: Analyze package.json/requirements.txt/go.mod for known vulnerable versions, unmaintained packages, suspicious dependencies.
- Dependency Confusion: Check if internal package names can be claimed on public registries (npm, PyPI). Test namespace squatting.
- CI/CD Pipeline Security: Review GitHub Actions/GitLab CI for injection via PR titles/branch names, secrets in logs, unpinned action versions, runner escape.
- Build Artifact Integrity: Verify signatures on containers/packages, check for unsigned artifacts, test image tag mutability.
- Lockfile Integrity: Detect lockfile injection (manipulated resolved URLs), verify lockfile-to-manifest consistency.
- Install Script Abuse: Identify packages with install hooks executing arbitrary code, test typosquatting candidates.
- SBOM Generation: Generate Software Bill of Materials and map transitive dependency risk with CVE correlation.
Tool Categories
| Category | Tools | Purpose |
|---|---|---|
| Dependency Scanning | Snyk, npm audit, pip-audit | Known CVE detection |
| Container Scanning | Trivy, Grype | Image vulnerability analysis |
| Dependency Risk | socket.dev, Semgrep | Behavioral risk analysis |
| CI/CD Review | custom scripts, actionlint | Pipeline security audit |
| SBOM | syft, cyclonedx-cli | Bill of materials generation |
References
references/tools.md- Tool function signatures and parametersreferences/workflows.md- Attack pattern definitions and test vectors
Comments
Markdown supported