Skill UI

This skill detects malicious, misspelled, or brand-jacked package names (typosquatting) across major ecosystems (npm, PyPI, crates.io). It uses advanced techniques like edit-distance and keyboard-proximity analysis, powered by tools like typomania and OSSGadget, to flag potential supply chain attacks *before* a dependency is installed. It is essential for implementing robust CI/CD security gates and proactive dependency screening.

This skill guides the end-to-end process of supply chain security by generating standards-compliant Software Bills of Materials (SBOMs) in CycloneDX and SPDX formats. It details using Syft to create inventories, correlating them with vulnerability intelligence via Grype, enforcing CI/CD gates based on severity, and establishing verifiable provenance using Cosign signing. Essential for modern DevSecOps practices.