18 skills · sorted by relevance
Find npm and PyPI packages that imitate trusted package names to exploit typing mistakes. Compare spelling similarity, publication dates, downloads, and maintainer details, then rank suspicious candidates and produce reports or blocklists for further review.
Find lookalike domains with dnstwist and prioritize suspicious results using DNS records, registration age, and website similarity. The skill also covers monitoring for new findings and producing blocklists and reports to support domain takedown requests.
Detects typosquatting attacks in npm and PyPI package registries by analyzing package name similarity using Levenshtein distance and other string metrics, examining publish date heuristics to identify recently created packages mimicking established ones, and flagging download count anomalies where suspicious packages have disproportionately low usage compared to their legitimate targets. The analyst queries the PyPI JSON API and npm registry API to gather package metadata for automated comparison. Activates for requests involving package typosquatting detection, dependency confusion analysis, malicious package identification, or software supply chain threat hunting in package registries.
The English summary is being prepared. Showing the original description.
Detect typosquatting, homograph phishing, and brand impersonation domains using dnstwist to generate domain permutations and identify registered lookalike domains targeting your organization.
The English summary is being prepared. Showing the original description.
Detect typosquatting, homograph phishing, and brand impersonation domains using dnstwist to generate domain permutations and identify registered lookalike domains targeting your organization.
The English summary is being prepared. Showing the original description.
Detect typosquatting, homograph phishing, and brand impersonation domains using dnstwist to generate domain permutations and identify registered lookalike domains targeting your organization.
The English summary is being prepared. Showing the original description.
Screen dependency names on npm, PyPI, and crates.io before installation to find lookalikes of legitimate packages. This skill compares spelling patterns and registry metadata, helping review AI-generated lists, lockfile changes, and new dependencies in CI/CD.
Software supply chain security — SBOM generation and analysis, dependency confusion and typosquatting detection, malicious package indicators, CI/CD pipeline hardening, and artifact provenance/signing (SLSA, Sigstore)
The English summary is being prepared. Showing the original description.
Search public TLS certificate records through crt.sh and pycrtsh to investigate lookalike domains, unexpected certificate issuers, and untracked IT assets. Compare domain spellings and review certificate details to support phishing detection and certificate monitoring.
Assess weaknesses in the software supply chain, from dependency packages to build pipelines and distributed artifacts. Covers authorized proof-of-concept testing, package confusion, container image risks, signing abuse, and defensive checks for tampering.
Activate when reviewing or modifying dependency resolution, lockfile schema, package downloaders, signature/integrity checks, file integration cleanup, or anything that could expose APM to dependency confusion, typosquatting, malicious packages, or token leakage.
The English summary is being prepared. Showing the original description.
Typosquatting detection, install script analysis, dependency confusion prevention, and phantom dependency detection for npm/pip.
The English summary is being prepared. Showing the original description.
Managing third-party dependencies — version pinning, security auditing, license compliance, update workflows, lockfile management, supply chain security. Activate on "npm audit", "dependabot", "renovate", "pin versions", "dependency update", "supply chain", "license compliance", "lockfile", "security advisory", "typosquatting", "SBOM". NOT for internal monorepo package management (use monorepo-management) or publishing your own packages to npm/PyPI.
The English summary is being prepared. Showing the original description.
Queries Certificate Transparency logs via crt.sh and pycrtsh to detect phishing domains, unauthorized certificate issuance, and shadow IT. Monitors newly issued certificates for typosquatting and brand impersonation using Levenshtein distance. Use for proactive phishing domain detection and certificate monitoring.
The English summary is being prepared. Showing the original description.
Queries Certificate Transparency logs via crt.sh and pycrtsh to detect phishing domains, unauthorized certificate issuance, and shadow IT. Monitors newly issued certificates for typosquatting and brand impersonation using Levenshtein distance. Use for proactive phishing domain detection and certificate monitoring.
The English summary is being prepared. Showing the original description.
Managing third-party dependencies — version pinning, security auditing, license compliance, update workflows, lockfile management, supply chain security. Activate on "npm audit", "dependabot", "renovate", "pin versions", "dependency update", "supply chain", "license compliance", "lockfile", "security advisory", "typosquatting", "SBOM". NOT for internal monorepo package management (use monorepo-management) or publishing your own packages to npm/PyPI.
The English summary is being prepared. Showing the original description.
Queries Certificate Transparency logs via crt.sh and pycrtsh to detect phishing domains, unauthorized certificate issuance, and shadow IT. Monitors newly issued certificates for typosquatting and brand impersonation using Levenshtein distance. Use for proactive phishing domain detection and certificate monitoring.
The English summary is being prepared. Showing the original description.
Comprehensive offensive methodology for software supply chain attacks covering the full kill chain from reconnaissance through exploitation. Addresses dependency confusion across npm, PyPI, and NuGet ecosystems where internal registry override allows an attacker to inject malicious packages that shadow private dependencies. Covers typosquatting techniques for popular packages, compromised package injection via maintainer account takeover or social engineering, and build system attacks through Makefile injection, setup.py install hooks, and npm postinstall scripts. Extends into CI/CD artifact tampering where build outputs are replaced or modified in transit, code signing abuse through stolen or self-signed certificates, upstream repository compromise via commit injection or force-push to trusted repos, and container image supply chain attacks including base image trojaning and registry confusion. Maps to MITRE ATT&CK T1195.001 (Supply Chain Compromise: Compromise Software Dependencies and Development Tools...
The English summary is being prepared. Showing the original description.