Guide · Agent skill
How to use the Offensive Supply Chain Attacks agent skill
Updated · written with AI from the project's own documentation and checked against our catalogue data
The offensive-supply-chain skill is a playbook that gives an AI agent a structured methodology for simulating software supply chain attacks, covering dependency confusion, typosquatting, build hook abuse, CI/CD tampering, code signing abuse and container image attacks. It is written for authorized red team and penetration testing work, and for security engineers who need to understand these attacks well enough to write detections. This guide explains what an agent skill is, how to install this one, how to trigger it, and what to check before you use it.
Offensive Supply Chain AttacksSnailSploit/Claude-Red · MIT Download the skill Quick start
- 1Confirm authorization. Get written permission that names the registries, packages and pipelines in scope before you begin any testing.
- 2Download and unzip the skill. Download the ZIP from this page and unzip it so that offensive-supply-chain/SKILL.md sits inside ~/.claude/skills/ or a project's .claude/skills/ folder.
- 3Or upload it in the Claude apps. If you use the Claude apps, go to Settings, then Capabilities, then Skills, and upload the skill there.
- 4Install the tools you need. Set up Python and pip, Node.js and npm, jq, curl, and the Go toolchain if you plan to use the confused scanner.
- 5Make a natural request. Describe the ecosystem, the artifact you are working from and your authorized scope in plain language.
- 6Review proposed steps. Read each command and proof-of-concept the agent suggests and adapt it to your own canary domain and environment.
- 7Document and clean up. Record the attack path, callbacks, affected systems and remediation, then remove any test artifacts.
What is an agent skill and what does this one do?
An agent skill is a folder containing a SKILL.md file with instructions that an AI agent loads when a request matches the skill's description. The agent then follows that methodology instead of working from general knowledge alone.
This skill's SKILL.md describes the offensive lifecycle: recon of internal package names from artifacts such as lock files and source maps, identifying the package ecosystem and registry configuration, choosing an attack vector, preparing a proof-of-concept with a DNS or HTTP canary callback and no destructive payload, monitoring for the callback, and documenting the attack path with remediation guidance.
- Dependency confusion across npm, PyPI and NuGet, including registry override scenarios
- Typosquatting patterns for popular package names
- Compromised package injection via maintainer account takeover or social engineering
- Build system attacks such as Makefile injection, setup.py install hooks and npm postinstall scripts
- CI/CD artifact tampering, code signing abuse, upstream repository compromise and container image supply chain attacks
- Detection guidance for defenders and engagement-safe execution notes
- Mapping to MITRE ATT&CK T1195.001 and T1195.002
How do you install the offensive supply chain skill?
You can install the skill in either of two ways. Download the ZIP file from this page and unzip it into your personal skills folder at ~/.claude/skills/, or into a project's .claude/skills/ folder if you want the skill available only in that project. Each skill sits in its own folder, so after unzipping you should see the offensive-supply-chain folder containing SKILL.md.
Alternatively, if you use the Claude apps, you can upload the skill under Settings, then Capabilities, then Skills.
- Option A: place the unzipped folder in ~/.claude/skills/ for all your projects
- Option B: place it in a project's .claude/skills/ folder for that project only
- Option C: upload the ZIP through Settings → Capabilities → Skills in the Claude apps
~/.claude/skills/offensive-supply-chain/SKILL.mdHow do you trigger the skill with a natural request?
You do not need a special command. Describe the task in plain language that matches the skill's subject, and the agent should load it when relevant. Be specific about the ecosystem, the target type and your authorization, because the skill's guidance is scoped to authorized engagements.
Good requests name the attack family and the artifact you are working from, for example a package-lock.json, a requirements.txt or a nuget.config. Ask for detection guidance alongside the offensive steps if you need to write alerts.
- Ask how dependency confusion applies to a project's private npm packages
- Ask for a review of a requirements.txt against public PyPI name availability
- Ask what a typosquatting test would look like for a given dependency, with detection notes
- Ask how to check whether a CI pipeline could let build outputs be replaced in transit
What examples does the skill cover in practice?
The skill's examples follow the same pattern for each technique: a short recon step, a proof-of-concept pattern, a detection note and an execution note for authorized work. Dependency confusion examples cover npm, PyPI and NuGet feed priority. Typosquatting examples show how candidate name variants are generated for a popular package. Build system examples cover install-time hooks in Python and npm packages.
The skill also points to the confused scanner for dependency confusion checks and dependency-check for known vulnerable components. Use these outputs to prioritise what a human tester should examine, rather than treating the agent's output as a finished assessment.
- Dependency confusion: npm, PyPI and NuGet
- Typosquatting candidates for popular packages
- Build hooks: Makefile, setup.py and npm postinstall
- Scanner integration: confused and dependency-check
What do you need before you run it?
The skill itself does not run scripts, but the techniques it describes rely on tools that you install and use yourself. Plan for these before starting an engagement.
You also need a canary or callback domain. The sample code in the skill uses oastify.com as its example callback domain, and you should replace it with a domain you control or are authorised to use for the engagement.
- Python and pip, for the sample setup.py proof-of-concept
- Node.js and npm, for package.json examples
- jq and curl, for the recon scripts
- Go toolchain, to install the confused scanner
- A canary or callback domain you are authorised to use
- Network access, since the skill's techniques involve network calls
What safety rules should you follow?
Treat this skill as a tool for authorized testing only. The skill's own description warns that its techniques include registering public package names and planting install hooks, which can cause real harm and may be illegal without written authorization. Get written scope from the organisation before any test, and confirm exactly which package names, registries and pipelines are in scope.
Keep proofs of concept to a benign callback that confirms execution. The skill's approach is to avoid destructive payloads, and you should keep that standard. Never publish a package to a public registry under a name you have not been authorised to test, and remember that a public registration may be visible to real users and tools.
- Do not start without written authorization that names the targets
- Use a canary you control, and record every callback
- Avoid destructive payloads and data collection beyond proving execution
- Stop and report if you find real third-party exposure
- Remove any test packages and staged artifacts after the engagement
Tips for getting useful results
Give the agent real artifacts to work from, such as lock files and registry configuration, because the skill's recon steps depend on exact package names and sources. Ask for each finding to end with detection guidance and remediation, since the defender output is often the most valuable part for an appsec team.
Check outputs against the actual tools and your own registry configuration. The agent's suggestions are a starting point for a human tester, and any command it proposes should be read and understood before it is run.
- Provide lock files, requirements.txt or nuget.config for specific recon
- Ask for both the attack path and the detection and remediation steps
- Verify every proposed command against your environment before running it
- Keep a log of what you ran and when, for the engagement report
What people use it for
- An authorized red team checks whether a company's private npm packages could be shadowed by public names.
- An appsec team reviews nuget.config and private feed priority to confirm the private feed is the exclusive source.
- A security engineer uses the typosquatting and build hook sections to write detections for suspicious install-time scripts.
- A penetration tester reviews a CI/CD pipeline for artifact tampering risks and drafts remediation steps.
Frequently asked questions
Is the offensive supply chain agent skill free?
The skill is published under the MIT licence, as stated on this page. Check the licence file in the source repository for the full terms before you use or redistribute it.
How do I install an agent skill like this one?
Download the ZIP from this page and unzip it into ~/.claude/skills/ for all projects, or into a project's .claude/skills/ folder for one project. In the Claude apps you can instead upload it under Settings, then Capabilities, then Skills.
What do I need to run the offensive supply chain skill?
You need Python and pip for the sample setup.py proof-of-concept, Node.js and npm for package.json examples, jq and curl for recon scripts, the Go toolchain to install the confused scanner, and a canary or callback domain. The skill does not run scripts itself, but it does use the network.
Is this skill safe to use?
It is intended only for authorized red team and penetration testing work. Its techniques can cause real harm if misused, such as registering public package names or planting install hooks, so you need written authorization and should keep proofs of concept to a benign callback.
What is the difference between dependency confusion and typosquatting?
Dependency confusion relies on a package manager preferring a higher-versioned public package over a private one when both registries are configured. Typosquatting relies on developers mistyping a popular package name during installation.
Who should not use this skill?
Beginners looking for a general overview of software security may find it too advanced, since it assumes knowledge of registries, lock files and CI/CD. Defenders who do not need attack reproduction may also find the offensive detail more than they require.
New agent skills, repos and AI tools — every week
The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.
Our verdict
This skill suits authorized red team operators, penetration testers and appsec engineers who already understand registries, lock files and CI/CD and need a structured playbook with detection guidance. It is a poor fit for anyone without written authorization, for beginners wanting a general security overview, or for defenders who only need detections and not attack reproduction.
Download the skill