“supply-chain”的搜索结果

Assess the security of LLM applications and AI agents by tracing inputs, retrieved content, tool calls, and outputs. Covers prompt injection, where content carries unwanted instructions, along with permission misuse, memory poisoning, and supply-chain risks.

中文简介正在准备中。当前显示英语简介。

• Testing chatbot resistance to prompt injection
• Auditing agent tool permissions and approval steps
• Checking retrieval access controls and memory poisoning

Check training data and machine learning models for malicious changes, including backdoors that cause unexpected behavior on specific inputs. Combine data quality checks, model analysis, and file integrity verification, then document findings and retest after remediation.

中文简介正在准备中。当前显示英语简介。

• Screening third-party data before training
• Checking downloaded model weights before deployment
• Investigating unexpected behavior on specific inputs

Audit npm, PyPI, and Go dependencies for version-specific advisories, inactive upstream projects, concentrated npm publishing rights, and installation scripts. Produce a report backed by collected data, with assessment coverage, action priorities, and upgrade or replacement guidance.

中文简介正在准备中。当前显示英语简介。

• Reviewing dependency risks before an engagement
• Checking advisories across a lockfile dependency tree
• Finding abandoned or archived dependencies

Detect known malicious npm package versions and install-time supply-chain indicators in repositories, lockfiles, and node_modules. Use when a user mentions an npm compromise, Shai-Hulud, the Keyv/cacheable incident, suspicious preinstall scripts, credential-stealing packages, or asks whether a JavaScript project was exposed to a package supply-chain attack. Do not use as a general CVE or license audit.

中文简介正在准备中。当前显示原文说明。

"Net-zero transition playbook: GHG inventory (ISO 14064-1, GHG Protocol Scope 1/2/3), science-based targets (SBTi), TCFD and ISSB S1/S2 climate disclosure, Taiwan carbon fee, decarbonization roadmap, internal carbon pricing, supply-chain carbon, product carbon footprint, green electricity and T-REC. Use for corporate decarbonization roadmap, carbon inventory, carbon-fee response, TCFD/ISSB reporting, supply-chain decarbonization, or responding to international customers (Apple, RE100). Triggers: 『碳盤查』『SBTi』『碳費』『TCFD』『淨零路徑』『範疇 3』『綠電』『CBAM』『ISO 14064』『ISSB』『T-REC』. For Taiwan EMBA ESG/sustainability/operations/strategy/finance cases. Focuses on Taiwan listed-company and supply-chain practice; sustainability strategy theory: use Asgard `grad-sustainability`; ERM 框架整合氣候風險: use `biz-erm`; 董事會 ESG 委員會結構設計: use `biz-corporate-governance`; 併購 ESG 盡職調查: use `fin-m-and-a`.".

中文简介正在准备中。当前显示原文说明。

Assess software dependencies, build pipelines, and container images for security risks. Create a software component inventory, check vulnerabilities and license conflicts, verify artifact signatures, and prioritize fixes based on whether vulnerable code can actually be reached.

中文简介正在准备中。当前显示英语简介。

• Creating and auditing a software component inventory
• Prioritizing dependency vulnerabilities by actual exposure
• Auditing CI/CD pipelines and secret handling

Audit GitHub Actions workflows and CI/CD configurations for supply chain risks. Use Python and YAML parsing to identify unpinned actions, unsafe event expressions, excessive permissions, dependency confusion, and potential exposure of secrets in build pipelines.

中文简介正在准备中。当前显示英语简介。

• Reviewing GitHub Actions workflow security
• Checking action version pinning
• Finding unsafe event expressions in scripts

Inspect npm packages and dependency files for malicious installation scripts, credential theft, and self-spreading behavior. Use GuardDog scanning, source inspection, known-malicious version checks, and isolated execution to produce an evidence-based assessment.

中文简介正在准备中。当前显示英语简介。

• Vetting a new npm dependency before adoption
• Reviewing dependency files during code review
• Checking lockfiles against known-malicious versions

Find dependency confusion risks, where a public package can replace an internal package with the same name. Review dependency files, identify exposed names, and guide registry restrictions and recurring CI checks to prevent substitution.

中文简介正在准备中。当前显示英语简介。

• Auditing projects that mix private and public package registries
• Checking exposure after internal package names have leaked
• Restricting package sources to approved private registries

Analyze a software bill of materials, an inventory of software components, against known vulnerability records. Trace indirect dependencies, assess risk, and produce reports that help teams prioritize fixes and review supplier software.

中文简介正在准备中。当前显示英语简介。

• Assessing vulnerabilities in vendor-provided software inventories
• Checking whether a newly disclosed CVE affects deployed software
• Adding SBOM vulnerability checks to CI/CD

Investigate malicious software delivered through trusted updates or dependencies. Compare suspect files with legitimate versions, examine signing anomalies and injected code, and organize evidence to assess the infection path and downstream impact.

中文简介正在准备中。当前显示英语简介。

• Comparing suspicious updates with legitimate versions
• Investigating software signatures and injected code
• Tracing infection through build artifacts

Audit npm dependencies before updating them with Bun. Check maintainers, release age, signatures, published file changes, and release notes, then update packages that pass review and record deferred updates for later follow-up.

中文简介正在准备中。当前显示英语简介。

• Auditing dependency updates before installation
• Checking maintainer changes and suspicious package contents
• Updating packages that pass integrity checks

Tests whether an AI agent accepts unverified plugins, tools, models, or updates. It checks risks introduced through external dependencies, including unsafe installation sources and missing version controls, and reports confirmed findings with conversation evidence.

中文简介正在准备中。当前显示英语简介。

• Checking acceptance of plugins and tools from unknown sources
• Reviewing dependency version pinning and integrity checks
• Testing validation of user-supplied tool manifests

External recon for software supply-chain attack surface — package-namespace squatting candidates, dependency-confusion vulnerabilities, GitHub Actions injection openings, container image registry exposure, SBOM mining, internal-package-name leakage, and CI/CD configuration exposure. Reconnaissance and identification ONLY — actual package publishing / typosquat attacks are EXTERNAL-OFFENSIVE and require explicit written sign-off because they can affect the entire npm/PyPI ecosystem. Use when the target has a public GitHub org, when their build artifacts/SBOMs are reachable, when their docker images are on Docker Hub/GHCR, or when you find internal package names in their JS bundles.

中文简介正在准备中。当前显示原文说明。

Rigorous, defensible email-spoofability verdict and SPF supply-chain risk analysis computed from published DNS alone. Deepens the record-level SPF/DMARC/DKIM/BIMI/MTA-STS/DNSSEC fetch recipes in the offensive-osint arsenal (§16.14) with the reasoning that section doesn't do: a priority-ordered composite verdict for whether an attacker can actually land header-From-spoofed mail in an inbox, and by which vector (exact-domain vs subdomain) — grounded in the single most-misunderstood distinction in email security: the envelope MAIL FROM that SPF authenticates vs the visible header From: that only DMARC governs. Explains precisely why SPF -all/~all alone is NOT spoof-proof without DMARC enforcement, and why SPF +all bypasses DMARC even under p=reject pct=100. Covers RFC 7208 §4.6.4's 10-DNS-lookup / 2-void-lookup PermError fail-open condition with a runnable stdlib-only lookup-counter script, plus the SPF-include-takeover supply-chain vector (an attacker re-registering a dead include inherits SPF-pass authority over the victim domain) with strict transient-vs-NXDOMAIN discrimination discipline so a temporary SERVFAIL is never mistaken for a takeover lead. Fully passive: DNS TXT reads only, no mail sent, no RCPT TO probe, no API keys. Use when auditing a domain's real spoofing resistance (not just its published records), explaining to a client why 'we have SPF -all' does not mean they're covered, investigating an SPF PermError or an unusually long include chain, evaluating a dead SPF include as a takeover lead, or writing a defensible spoofability finding for a deliverable.

中文简介正在准备中。当前显示原文说明。

Organization-grade cloud and supply-chain attack-surface discovery: S3/GCS/Azure Blob bucket discovery via observed-name mining (CNAME/cert-SAN/Wayback) and bounded two-class permutation (6 prefixes x 15 suffixes on trusted tokens, bounded target-bound expansion on subdomain stems), existence (HEAD/GET) vs public-listing confirmation, object-key triage into 9 value tiers (database dumps, credentials, IaC state, kubeconfig, VCS dirs, config, archives, PII, logs), dangling-CNAME bucket-takeover detection, and the ownership-gated severity model that stops an unattributable public bucket from becoming a false CRITICAL; the fully offline AWS-account-ID recovery from a leaked AKIA/ASIA/AROA access key (base32 decode, runnable stdlib Python, canonical test vector, AWS-documentation-example-ID screening); dependency-confusion confirmation for npm/PyPI (internal-signal classifier -- private-registry binding vs org-namespace match -- paired with a read-only public-registry 404 check and the npm scope-claimability nuance the public search API misses); and passive cloud-native/container/Kubernetes/CI control-plane fingerprinting (Lambda URLs, API Gateway, Cloud Run, App Service, kubelet/etcd/K8s API/dashboard, Jenkins/GitLab/Argo CD) as an org-attribution and exposure surface. Passive/discovery only -- no exploitation, no credential submission, no active control-plane confirmation (a stage-6 validate_cloud active tier is described but out of scope). Use when enumerating a target's cloud storage footprint, recovering an AWS account ID from a leaked key, confirming a supply-chain dependency-confusion vector, or fingerprinting cloud-native/K8s/CI infrastructure for an authorized external recon engagement.

中文简介正在准备中。当前显示原文说明。

Supply-chain testing via package-manager dependency confusion: when internal package names resolve to attacker-controlled public registries, leading to malicious install and script execution. Use for npm/pip/gem/Maven/Composer/Docker manifest review and authorized red-team supply-chain exercises.

中文简介正在准备中。当前显示原文说明。

Audits legal AI skills, prompts, workflows, MCP/tool instructions, and agent packages for prompt injection, malicious instructions, unsafe scripts, suspicious metadata, credential exposure, exfiltration paths, persistence mechanisms, and supply-chain risk. Use before installing, importing, publishing, promoting, modifying, or trusting third-party or generated AI skills and legal workflows. Do not use as a generic code review unless skill trust, workflow safety, prompt injection, or supply-chain hygiene is in scope.

中文简介正在准备中。当前显示原文说明。

Use for software supply-chain security assessment covering SBOM, SCA, CI/CD pipelines, container images, build integrity, dependency provenance, and vulnerability reachability.

中文简介正在准备中。当前显示原文说明。

Software supply chain security — SBOM generation and analysis, dependency confusion and typosquatting detection, malicious package indicators, CI/CD pipeline hardening, and artifact provenance/signing (SLSA, Sigstore)

中文简介正在准备中。当前显示原文说明。

Install-time cooldowns for npm/bun plus a sandboxed pre-install scan for bypasses. Use for supply-chain attacks or npm security.

中文简介正在准备中。当前显示原文说明。

Audits dependency supply chains for bad versions, lockfile drift, and artifact integrity. Use when adding deps, handling incidents, or releasing a plugin.

中文简介正在准备中。当前显示原文说明。

Apply @aleabitoreddit ("Serenity")'s distilled stock-analysis method to ANY ticker, sector, or situation — critical-chokepoint / supply-chain-OSINT idea discovery, first-principles value-chain decomposition, a Buffett-style quality gate (moat / profitability / customer-replacement risk, all default unverified), and narrative-vs-fundamentals hygiene. Produces a beginner-friendly Chinese analysis (她的观点 / 小白解释 / 第一性原理 / Buffett 直接判断 / 当前结论) that classifies an idea as 研究地图 vs 可投资结论. Trigger on "analyze like Serenity / 用 aleabito 的方法分析 / 用 Serenity 框架 / critical chokepoint 分析 / 第一性原理 + Buffett 判断这只股 / supply-chain bottleneck thesis". Never emits buy/sell calls.

中文简介正在准备中。当前显示原文说明。

Use when the user asks about supply-chain attacks, third-party / vendor compromise (SolarWinds, Kaseya, 3CX, MOVEit, XZ-utils-style), software-bill-of-materials risks, or library / dependency-injection attacks. Self-updating knowledge cell.

中文简介正在准备中。当前显示原文说明。