Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →Adversaries may manipulate products or product delivery mechanisms prior to receipt by a final consumer for the purpose of data or system compromise.
.claude/skills/cyberstrikeus-t1474-supply-chain-compromise/SKILL.md| Test case | Without → With | Effect | Δ tokens | Δ turns |
|---|---|---|---|---|
| case-06 | ✗→✓ | ▲ Improved | -62% | 0% |
| case-07 | ✗→✓ | ▲ Improved | -24% | 0% |
| case-08 | ✗→✓ | ▲ Improved | -14% | 0% |
| case-10 | ✗→✓ | ▲ Improved | -35% | 0% |
| case-11 | ✗→✓ | ▲ Improved | -42% | 0% |
Adversaries may manipulate products or product delivery mechanisms prior to receipt by a final consumer for the purpose of data or system compromise.
Supply chain compromise can take place at any stage of the supply chain including:
While supply chain compromise can impact any component of hardware or software, attackers looking to gain execution have often focused on malicious additions to legitimate software in software distribution or update channels. Targeting may be specific to a desired victim set or malicious software may be distributed to a broad set of consumers but only move on to additional tactics on specific victims. Popular open source projects that are used as dependencies in many applications may also be targeted as a means to add malicious code to users of the dependency, specifically with the widespread usage of third-party advertising libraries.
Platforms: Android, iOS
Determine if the target mobile environment is susceptible to Supply Chain Compromise by examining the target platforms (Android, iOS).
Review whether mitigations for T1474 are in place. If defenses are absent or misconfigured, this technique may be exploitable.
Security updates may contain patches for devices that were compromised at the supply chain level.
Application developers should be cautious when selecting third-party libraries to integrate into their application.
| Finding | Severity | Impact | | -------------------------------------------- | -------- | -------------- | | Supply Chain Compromise technique applicable | Low | Initial Access |
| CWE ID | Title | | ------ | ------------------------- | | CWE-20 | Improper Input Validation |
| Case | Status | Duration (ms) | Turns | Tokens | Tool calls | ||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Without | With | Δ | Without | With | Δ | Without | With | Δ | Without | With | Δ | ||
case-01 | fail→fail | 31,392 | 32,136 | +2% | 1 | 1 | 0% | 4,107 | 4,823 | +17% | 0 | 0 | — |
case-02 | fail→fail | 28,299 | 31,995 | +13% | 1 | 1 | 0% | 3,809 | 5,749 | +51% | 0 | 0 | — |
case-03 | fail→fail | 30,248 | 23,352 | -23% | 1 | 1 | 0% | 4,364 | 4,056 | -7% | 0 | 0 | — |
case-04 | pass→pass | 16,541 | 8,410 | -49% | 1 | 1 | 0% | 2,028 | 1,645 | -19% | 0 | 0 | — |
case-05 | pass→pass | 11,485 | 4,019 | -65% | 1 | 1 | 0% | 1,510 | 1,358 | -10% | 0 | 0 | — |
case-06 | fail→pass | 29,118 | 8,296 | -72% | 1 | 1 | 0% | 3,959 | 1,497 | -62% | 0 | 0 | — |
case-07 | fail→pass | 19,901 | 10,325 | -48% | 1 | 1 | 0% | 2,661 | 2,017 | -24% | 0 | 0 | — |
case-08 | fail→pass | 17,191 | 7,804 | -55% | 1 | 1 | 0% | 1,881 | 1,627 | -14% | 0 | 0 | — |
case-09 | pass→pass | 19,394 | 7,452 | -62% | 1 | 1 | 0% | 2,745 | 1,572 | -43% | 0 | 0 | — |
case-10 | fail→pass | 20,219 | 6,923 | -66% | 1 | 1 | 0% | 2,085 | 1,354 | -35% | 0 | 0 | — |
case-11 | fail→pass | 18,118 | 7,745 | -57% | 1 | 1 | 0% | 2,630 | 1,531 | -42% | 0 | 0 | — |
case-12 | fail→pass | 17,424 | 8,038 | -54% | 1 | 1 | 0% | 2,352 | 1,557 | -34% | 0 | 0 | — |
case-13 | fail→pass | 32,920 | 3,583 | -89% | 1 | 1 | 0% | 2,400 | 1,481 | -38% | 0 | 0 | — |
case-14 | fail→pass | 14,486 | 10,515 | -27% | 1 | 1 | 0% | 1,417 | 1,450 | +2% | 0 | 0 | — |
case-15 | pass→pass | 14,274 | 7,834 | -45% | 1 | 1 | 0% | 1,755 | 1,617 | -8% | 0 | 0 | — |
case-16 | pass→pass | 21,512 | 17,671 | -18% | 1 | 1 | 0% | 2,148 | 3,024 | +41% | 0 | 0 | — |
case-17 | fail→pass | 25,521 | 11,141 | -56% | 1 | 1 | 0% | 3,134 | 2,545 | -19% | 0 | 0 | — |
case-18 | pass→pass | 22,191 | 4,307 | -81% | 1 | 1 | 0% | 2,715 | 1,835 | -32% | 0 | 0 | — |
case-19 | fail→pass | 14,128 | 7,623 | -46% | 1 | 1 | 0% | 1,715 | 1,528 | -11% | 0 | 0 | — |
case-20 | pass→pass | 26,771 | 24,923 | -7% | 1 | 1 | 0% | 3,686 | 5,308 | +44% | 0 | 0 | — |
case-21 | pass→pass | 26,029 | 24,473 | -6% | 1 | 1 | 0% | 3,916 | 3,751 | -4% | 0 | 0 | — |
case-22 | pass→pass | 25,924 | 22,555 | -13% | 1 | 1 | 0% | 2,984 | 3,841 | +29% | 0 | 0 | — |
case-23 | fail→pass | 37,153 | 18,221 | -51% | 1 | 1 | 0% | 1,973 | 1,772 | -10% | 0 | 0 | — |
DecimalAI ran this skill against gemini-3.6-flash twice over the same eval suite — once with the skill loaded and once without — and compared the two runs case by case. 23 cases were attempted. The headline lift of +48 percentage points is the difference between those two pass rates over the 23 comparable cases.
Without the skill loaded, the model failed this case. With it loaded, the same prompt on the same model passed. This is one improved case from the latest verified run; every case, including any that regressed, is in the table above.
Other measured skills in the registry, with their headline benchmark lift.