Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cyberstrikeus/T1195.002_compromise-software-supply-chain
Adversaries may manipulate application software prior to receipt by a final consumer for the purpose of data or system compromise.
Passed 19 of 21 test cases with the skill, and 9 of 21 without it.
and 15 more in the full report
11 fixed9 passed either way2 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 10 test cases the skill fixed. Same model, same prompt, with and without the skill.
When executing the npm initialization and package installation simulation inside the test pod, in which temporary directory structure should the test project be initialized?
| Checked | Without skill | With skill |
|---|---|---|
| Specifies the directory path /tmp/test. | Missed | Passed |
The instructions your model reads when the skill loads.
Sub-technique of: T1195
Adversaries may manipulate application software prior to receipt by a final consumer for the purpose of data or system compromise. Supply chain compromise of software can take place in a number of ways, including manipulation of the application source code, manipulation of the update/distribution mechanism for that software, or replacing compiled releases with a modified version.
Targeting may be specific to a desired victim set or may be distributed to a broad set of consumers but only move on to additional tactics on specific victims.
Platforms: Linux, Windows, macOS
The following tests are from Atomic Red Team and provide actionable ways to test this technique:
Launches a short‑lived Kubernetes pod using the Node 18 image, initializes a minimal npm project in /tmp/test, and installs the specified npm package without audit/fund/package‑lock options, simulating potentially suspicious package retrieval (e.g., typosquatting/dependency confusion) from within a container. The pod is deleted after execution.
Supported Platforms: containers, linux
kubectl run #{pod_name} --image=#{image_name} --restart=Never --attach --rm -i -- bash -lc "mkdir -p /tmp/test && cd /tmp/test && npm init -y >/dev/null 2>&1 && echo '--- package.json before install ---' && cat package.json && npm install #{package_name} --no-audit --no-fund --no-package-lock && echo '--- package.json after install ---' && cat package.json"
test cases passed, vs 9 / 21 without
Published skills whose descriptions closely match this one, with their headline benchmark lift.
More skills from the same source and nearby in the registry, with their headline benchmark lift.