Detecting Dependency Confusion

What it does

When your agent uses it

• Onboarding a repo to a supply-chain security program
• Auditing lockfiles/manifests for confusable dependencies
• After an incident that may have leaked internal package names

Example prompts

• “/detecting-dependency-confusion”

Requirements

• Python 3
• Node.js
• Docker
• A credential in NPM_TOKEN

Workflow steps

10 steps, taken from the step headings in SKILL.md.

1. 1Inventory manifests across the codebase
2. 2Scan npm manifests with confused
3. 3Scan PyPI, Maven, Composer, and RubyGems manifests
4. 4Cross-check with OWASP dep-scan private-namespace mode
5. 5Triage candidates and confirm claimability
6. 6Remediate npm with scope-to-registry pinning
7. 7Remediate PyPI and Maven
8. 8Defensively register placeholder packages
9. 9Wire detection into CI
10. 10Run the bundled helper for batch triage

What it can do on your machine

Read from SKILL.md and the folder at commit 54a7988. It shows what the files ask for, not the result of running them.

• Tool permissions

  Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

  From allowed-tools in the SKILL.md frontmatter.

• Runs code

  Ships 1 file in scripts/ (Python), which the agent can run.

  Shell commands in SKILL.md call:

  • npm
  • curl
  • go
  • pip
  • python

  From the folder's file list and the shell code blocks in SKILL.md.

• Network

  Hosts in commands or code, which the agent is likely to contact:

  • registry.npmjs.org
  • pypi.org

  Also links to:

  • github.com
  • owasp.org
  • medium.com
  • docs.npmjs.com

  From URLs in SKILL.md, links to its own repository left out.

• Credentials

  Names these keys or tokens, usually read from environment variables:

  • NPM_TOKEN

  From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Detecting Dependency Confusion loads about 2.9k tokens when it runs, and up to ~3.9k if it reads all its reference files. Until then it costs about 132 tokens; SKILL.md has 935 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it

~132

When it runs · the whole SKILL.md, loaded when a task matches

~2.9k

With references · SKILL.md plus every file in references/, read only if the agent opens them

~3.9k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

• WarningMentions a credentials file (SSH keys, cloud or package-manager tokens)SKILL.md:3

  then enforcing source restrictions via `.npmrc`, `pip.conf`/`pyproject.toml`, and Maven `settings.xml`. Use when onboard

• WarningMentions a credentials file (SSH keys, cloud or package-manager tokens)SKILL.md:31

  , and enforcing source restrictions in `.npmrc`, `pip.conf`/`pyproject.toml`, and Maven `settings.xml`. Internal package

• WarningMentions a credentials file (SSH keys, cloud or package-manager tokens)SKILL.md:53

  - Node.js + npm (for `.npmrc` and `npm config` remediation) and access to your private registry (Artifactory, Nexus, Azu

• WarningMentions a credentials file (SSH keys, cloud or package-manager tokens)SKILL.md:135

  # .npmrc (project root, committed)

• WarningMentions a credentials file (SSH keys, cloud or package-manager tokens)SKILL.md:220

  opes pinned to the private registry in `.npmrc` / `pip` config / Maven mirror.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); the scripts in this folder are not scanned.

SKILL.md

The full file from mukul975/Anthropic-Cybersecurity-Skills at commit 54a7988, republished under its Apache-2.0 licence (© mukul975). 935 words, ~2,945 tokens.

name

detecting-dependency-confusion

description

Detect and prevent dependency confusion (public-over-private package name resolution) in npm, PyPI, and Maven by enumerating claimable internal package names with tools like `confused` and OWASP `dep-scan`, then enforcing source restrictions via `.npmrc`, `pip.conf`/`pyproject.toml`, and Maven `settings.xml`. Use when onboarding a repo to a supply-chain security program, auditing lockfiles/manifests for confusable dependencies, or after an incident that may have leaked internal package names.

domain

cybersecurity

subdomain

supply-chain-security

tags

supply-chain-security, dependency-confusion, npm, pypi, maven, package-management, devsecops, namespace-hijacking

version

1.0

author

mahipal

license

Apache-2.0

nist_csf

ID.RA-09

mitre_attack

T1195.001

# Find all supported manifests in a monorepo
find . -type f \( \
  -name package.json -o \
  -name requirements.txt -o \
  -name pom.xml -o \
  -name composer.json -o \
  -name Gemfile.lock \
\) -not -path '*/node_modules/*' -print

# npm (default language is npm)
confused -l npm package.json

# Treat your known-good scopes as secure to suppress false positives (supports wildcards)
confused -l npm -s '@acme/*,@acme-internal/*' package.json

# Verbose, to see each lookup
confused -l npm -v package.json

confused -l pip requirements.txt          # PyPI  -> requirements.txt
confused -l mvn pom.xml                    # Maven -> pom.xml
confused -l composer composer.json        # PHP   -> composer.json
confused -l rubygems Gemfile.lock         # Ruby  -> Gemfile.lock

# Flag private namespaces accidentally claimable on public registries
depscan --src $PWD --reports-dir ./reports \
  --private-ns acme,acme_internal,@acme

# Enable deep package risk audit (npm + pypi): typosquats, takeover risk, etc.
depscan --src $PWD --reports-dir ./reports --risk-audit

# npm: a 404 status means the name is unregistered on the public registry
curl -s -o /dev/null -w "%{http_code}\n" https://registry.npmjs.org/@acme%2finternal-utils

# PyPI: 404 from the JSON API means the project name is free
curl -s -o /dev/null -w "%{http_code}\n" https://pypi.org/pypi/acme-billing-sdk/json

# .npmrc (project root, committed)
@acme:registry=https://artifactory.example.com/api/npm/npm-internal/
//artifactory.example.com/api/npm/npm-internal/:_authToken=${NPM_TOKEN}

# Force the default registry to a single proxy that does NOT merge public + private
registry=https://artifactory.example.com/api/npm/npm-virtual/

npm config get @acme:registry
npm install --dry-run   # confirm @acme/* resolves from the private host

# pyproject.toml (PEP 621 / pip >= 23): explicit index pinning
[tool.pip]
index-url = "https://artifactory.example.com/api/pypi/pypi-internal/simple/"
# Do NOT use extra-index-url for internal packages — pip merges and picks highest version.

<!-- ~/.m2/settings.xml: mirror everything through a single virtual repo -->
<mirrors>
  <mirror>
    <id>internal-virtual</id>
    <mirrorOf>*</mirrorOf>
    <url>https://artifactory.example.com/artifactory/maven-virtual</url>
  </mirror>
</mirrors>

# npm placeholder claim (scoped, public)
mkdir acme-internal-utils && cd acme-internal-utils
npm init -y
npm pkg set version=0.0.1-placeholder description="Reserved internal name. Do not use."
npm publish --access public

# .github/workflows/depconfusion.yml
name: dependency-confusion
on: [push, pull_request]
jobs:
  confused:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-go@v5
        with: { go-version: '1.22' }
      - run: go install github.com/visma-prodsec/confused@latest
      - name: Scan npm manifest
        run: $(go env GOPATH)/bin/confused -l npm -s '@acme/*' package.json

python scripts/agent.py --path . --ecosystem npm \
  --secure-namespaces '@acme/*,@acme-internal/*' \
  --output report.json

© mukul975, Apache-2.0. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

SKILL.md and 4 other files (scripts, references) in skills/detecting-dependency-confusion of mukul975/Anthropic-Cybersecurity-Skills.

• SKILL.md
• LICENSE
• references/api-reference.md
• references/standards.md
• scripts/agent.py

Open the folder on GitHubat commit 54a7988