typosquat-check

# Vulnetix Typosquat Check Skill ## Use when - Onboarding: scan all installed deps for typosquat/malware matches. - Vetting a single package that looks suspicious (`react-utill`, `lodash-utility`, etc.). - CI gate: block any installed dep flagged BLOCK. - Post-incident: cross-reference your installed deps against newly-discovered malware families. - Investigating a single package after a vendor advisory mentions name-similarity attacks. ## Don't use for - CVE-based vulnerability scanning — use `/vulnetix:sca-scan`. - Generic package risk before adding — use `/vulnetix:dep-add-guard`. - Detecting compromised packages via runtime behaviour — Pix is static-only. ## Conventions This skill follows [`_lib/contract.md`](../_lib/contract.md): the Vulnetix CLI is auto-installed by hooks, `.vulnetix/capabilities.yaml` is always present, every `vulnetix vdb` call is piped through a verified `jq` filter from [`_lib/jq/`](../_lib/jq/), independent calls run in parallel as concurrent Bash tool calls, and trailing follow-ups are limited to one line. See the contract for output style, memory write rules, and cooldowns. ## Step 1: Decide mode - Single-package: `$ARGUMENTS` is a name → check just that. - `--installed`: read lockfile (per `derived.primary_package_manager`), check every direct dep. ## Step 2: Run gated scan + AI-malware lookup ```bash vulnetix scan --block-malware -o json vulnetix vdb ai-malware list -o json | jq -f "${CLAUDE_PLUGIN_ROOT}/skills/_lib/jq/ai-list.jq" vul...