Detect dependency source redirection

CHANGELOG.md

@@ -2,6 +2,7 @@
 ### Features/Bug Fixes
 * Inspect hidden and nested ZIP-compatible artifacts under cumulative safety bounds.
 * Report HIGH SC9 findings for executables concealed in documents or hidden/disguised artifacts.
+* Report HIGH SC10 findings when package-manager configuration changes a dependency source trust boundary.
 ---
 ### 2.9.5 (Friday, August 14, 2026)
 ### Features/Bug Fixes

README.md

@@ -23,7 +23,7 @@ SkillSpector is part of the [NVIDIA Verified Skills pipeline](https://docs.nvidi
 ## Features
 
 - **Multi-format input**: Scan Git repos, URLs, zip files, directories, or single files
-- **70 vulnerability patterns** across 17 categories: prompt injection, data exfiltration, privilege escalation, supply chain, excessive agency, output handling, system prompt leakage, memory poisoning, tool misuse, rogue agent, anti-refusal, trigger abuse, dangerous code (AST), taint tracking, YARA signatures, MCP least privilege, and MCP tool poisoning
+- **71 vulnerability patterns** across 17 categories: prompt injection, data exfiltration, privilege escalation, supply chain, excessive agency, output handling, system prompt leakage, memory poisoning, tool misuse, rogue agent, anti-refusal, trigger abuse, dangerous code (AST), taint tracking, YARA signatures, MCP least privilege, and MCP tool poisoning
 - **Two-stage analysis**: Fast static analysis + optional LLM semantic evaluation
 - **Live vulnerability lookups**: SC4 queries [OSV.dev](https://osv.dev) for real-time CVE data with automatic offline fallback
 - **Multiple output formats**: Terminal, JSON, Markdown, and SARIF reports
@@ -353,7 +353,7 @@ claude mcp add skillspector -- skillspector mcp
 
 ## Vulnerability Patterns
 
-SkillSpector detects **70 vulnerability patterns** across 17 categories:
+SkillSpector detects **71 vulnerability patterns** across 17 categories:
 
 ### Prompt Injection (6 patterns)
 
@@ -391,7 +391,7 @@ SkillSpector detects **70 vulnerability patterns** across 17 categories:
 | PE2 | Sudo/Root Execution | MEDIUM | Invoking elevated system privileges |
 | PE3 | Credential Access | HIGH | Reading SSH keys, tokens, passwords |
 
-### Supply Chain (9+ patterns)
+### Supply Chain (10+ patterns)
 
 | ID | Pattern | Severity | Description |
 |----|---------|----------|-------------|
@@ -403,6 +403,7 @@ SkillSpector detects **70 vulnerability patterns** across 17 categories:
 | SC6 | Typosquatting | HIGH | Package names similar to popular packages |
 | SC8 | Shipped Python Bytecode | HIGH | `__pycache__` / `.pyc` present (discovery skips; malicious bytecode bypass) |
 | SC9 | Concealed Executable Artifact | HIGH | Executable nested in a document container or hidden/disguised artifact |
+| SC10 | Dependency Source Redirection | HIGH | Package-manager source added, replaced, or unresolved |
 
 ### Excessive Agency (4 patterns)
 

docs/DEPENDENCY_SOURCE_REDIRECTION.md

@@ -0,0 +1,41 @@
+# Dependency Source Redirection
+
+SkillSpector reports deterministic HIGH SC10 findings when skill content adds or replaces a
+package-manager source, or when the destination cannot be resolved from simple local assignments.
+This makes the dependency trust-boundary change explicit without making a reputation judgment
+about the destination.
+
+## Supported ecosystems and surfaces
+
+| Ecosystem | Direct configuration | Commands and environment | Generated configuration |
+|---|---|---|---|
+| npm | `.npmrc` registry and scoped registry | `npm config set`, `NPM_CONFIG_REGISTRY` | `.npmrc` heredoc |
+| Yarn | `.yarnrc`, `.yarnrc.yml` | `yarn config set` | Yarn config heredoc |
+| pip | `pip.conf`, `pip.ini` | index flags, `pip config set`, `PIP_INDEX_URL`, `PIP_EXTRA_INDEX_URL` | pip config heredoc |
+| Poetry | `pyproject.toml` sources | `poetry source add`, repository config | `pyproject.toml` heredoc |
+| Maven | `settings.xml`, `pom.xml` repositories and mirrors | Maven CLI repository override | Maven XML heredoc |
+| Cargo | `.cargo/config`, `.cargo/config.toml` sources and registries | Cargo registry-index environment variables | Cargo config heredoc |
+
+Commands in executable scripts and shell-language Markdown fences are actionable scan surfaces.
+Explanatory prose, comments, and non-shell fences do not create SC10 findings.
+
+## Evidence
+
+Each finding records the ecosystem, add/replace operation, configuration surface, scope,
+destination, and whether that destination was resolved. Simple literal variables defined in the
+same file are resolved without evaluating shell code. Dynamic destinations are reported as
+`unresolved` rather than ignored.
+
+Credentials and sensitive query values embedded in URLs are redacted from findings and every
+report format. The analyzer never logs credentials, executes configuration, or contacts the
+destination.
+
+## Trust model
+
+Canonical public defaults are built into the analyzer solely to avoid reporting an unchanged
+default as a redirection. Every other resolved destination is reported uniformly: SkillSpector
+does not maintain an organization allowlist, infer whether a host is public or private, perform
+DNS resolution, or make network/reputation calls.
+
+SC10 remains HIGH through optional LLM meta-analysis. An explicit, user-selected baseline retains
+its existing ability to suppress reviewed findings.