pentest-supply-chain

Purpose Supply chain attacks (SolarWinds, Log4Shell, xz-utils) are the fastest-growing threat category. Shannon explicitly excludes "vulnerable third-party libraries." MITRE ATT&CK T1195 has zero coverage in any existing skill.

| Dependency Scanning | Snyk, npm audit, pip-audit | Known CVE detection | | Container Scanning | Trivy, Grype | Image vulnerability analysis | | Dependency Risk | socket.dev, Semgrep | Behavioral risk analysis | | CI/CD Review | custom scripts, actionlint | Pipeline security audit | | SBOM | syft, cyclonedx-cli | Bill of materials generation |

軟體供應鏈安全 - 依賴性混淆、CI/CD 管道攻擊、鎖定檔案完整性和建置工件驗證。 來源：jd-opensource/joysafeter。

開啟你的終端機或命令列工具（如 Terminal、iTerm、Windows Terminal 等） 複製並執行以下指令：npx skills add https://github.com/jd-opensource/joysafeter --skill pentest-supply-chain 安裝完成後，技能將自動設定到你的 AI 程式設計環境中，可以在 Claude Code、Cursor 或 OpenClaw 中使用