Skip to content
Get packs

Offensive Supply Chain Attacks

Guides an agent through red-team supply chain attack techniques like dependency confusion and typosquatting

Source Download skill
Repository
SnailSploit/Claude-Red
Stars
10,230
Licence
MIT
Files
1 file

What it does

This skill gives an AI agent a detailed playbook for simulating software supply chain attacks, where an attacker sneaks malicious code in through trusted package registries, build scripts, CI/CD pipelines, code signing, or container images. Once installed, the agent can walk a security tester through recon of internal package names, dependency confusion and typosquatting proof-of-concepts, and detection advice for defenders. It is written for authorized red team engagements and includes sample code that calls back to a canary server to prove execution without destructive payloads.

Great for

  • Authorized red team or penetration testers assessing an organization's package and build pipeline
  • Security engineers who want to understand dependency confusion and typosquatting so they can write detections
  • Appsec teams auditing private registry configuration (npm, PyPI, NuGet)

Skip it if

  • Anyone without written authorization to test the target: the techniques include registering public package names and planting install hooks, which can cause real harm and may be illegal
  • Beginners looking for a general software security overview: the content assumes working knowledge of registries, lock files and CI/CD
  • Defensive-only use cases that do not need attack reproduction: the offensive detail is more than a defender needs

Try asking

  • “Check my package-lock.json for internal package names that are unclaimed on the public npm registry”
  • “Build a safe dependency confusion proof-of-concept with a DNS canary callback for our authorized engagement”
  • “Scan our requirements.txt and nuget.config for dependency confusion risk using confused”
  • “Explain how to detect typosquatting attempts against the packages our team depends on”
Step-by-step guide: how to use Offensive Supply Chain AttacksInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 1 original files, the MIT licence and an attribution note.

    offensive-supply-chain.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip offensive-supply-chain.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip offensive-supply-chain.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Only use it with written scope and a rules-of-engagement document; ask the agent to confirm authorization before generating any PoC
  • Prefer the detection and remediation sections for defensive work and ask for exclusive registry configuration fixes
  • Review any generated package before publishing it to a public registry, since public registration is itself the risky step

What's inside

  • SKILL.md

Redistributed unmodified from SnailSploit/Claude-Red under the MIT licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.