The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill provides functional code snippets that use package manager lifecycle hooks to execute arbitrary code. Examples include:
An npm preinstall script executing a node -e command.
A pip setup.py hook that overrides the install class to execute Python code during the installation process.
[DATA_EXFILTRATION]: The exploitation patterns demonstrate exfiltrating information to an external 'callback host'.
The preinstall snippet specifically exfiltrates the process.env.npm_package_name environment variable to a remote URL via an HTTPS request.
Other patterns use curl and Python's urllib.request to signal successful installation to an external server.
[EXTERNAL_DOWNLOADS]: The skill references several external tools and repositories for testing and exploitation:
A specific third-party exploit repository: https://github.com/0xsapra/dependency-confusion-exploit.
Well-known security tools: visma-prodsec/confused and synacktiv/DepFuzzer.
[COMMAND_EXECUTION]: The skill includes instructions for running various reconnaissance commands to query public registries (npm, PyPI, RubyGems, Maven) for package metadata and availability.

dependency-confusion