offensive-dependency-confusion

利用依赖项混淆漏洞

Deep-dive offensive methodology for dependency confusion and namespace attacks across all major package ecosystems. Covers npm scope confusion exploiting the gap between public and private scoped packages and .npmrc misconfigurations where registry mappings fail to pin internal scopes exclusively. Addresses PyPI namespace attacks through --extra-index-url resolution ordering, NuGet feed priority exploitation when multiple package sources are configured without clear directives, Maven and Gradle repository ordering where artifact resolution traverses repositories sequentially, Go module proxy abuse through GOPROXY misconfiguration, Ruby gems namespace squatting, and Docker image tag confusion with unqualified image references. Provides complete proof-of-concept methodology using safe callbacks including DNS canary via interactsh or Burp Collaborator and HTTP beacon with no destructive payload. Covers reconnaissance techniques for discovering internal package names through GitHub repository analysis, error message harvesting, JavaScript source map extraction, lock file parsing, job postings mentioning internal tools, and package manifest inspection. Directly references and builds upo

请帮我安装这个 Agent Skill：https://github.com/SnailSploit/Claude-Red/tree/main/Skills/supply-chain/offensive-dependency-confusion

1. 先读取该目录下的 SKILL.md 和其他文件，检查是否有可疑内容（执行未知脚本、读取密钥、向外发送数据等），用中文告诉我它会做什么、需要哪些权限；
2. 等我确认后，再把整个目录安装到 ~/.claude/skills/offensive-dependency-confusion/（如果你不是 Claude Code，安装到你自己约定的 skills 目录）；
3. 安装后告诉我怎么触发它。

git clone --depth 1 --filter=blob:none --sparse https://github.com/SnailSploit/Claude-Red.git /tmp/offensive-dependency-confusion-src
cd /tmp/offensive-dependency-confusion-src && git sparse-checkout set "Skills/supply-chain/offensive-dependency-confusion"
mkdir -p ~/.claude/skills && cp -r "Skills/supply-chain/offensive-dependency-confusion" ~/.claude/skills/offensive-dependency-confusion

Skill 可以让智能体执行脚本。安装第三方 Skill 前务必看一遍内容，详见「安全」一课。