From 1aee9e38f23e34fa1c1f5a3df0de2626ba7feaa1 Mon Sep 17 00:00:00 2001 From: Alex Schapiro Date: Wed, 12 Aug 2026 12:54:39 +0000 Subject: [PATCH] npx_confusion: drop tooling identifier from registry control lookup --- strix/skills/custom/npx_confusion.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/strix/skills/custom/npx_confusion.md b/strix/skills/custom/npx_confusion.md index 3dd1ca32..d2b55ec7 100644 --- a/strix/skills/custom/npx_confusion.md +++ b/strix/skills/custom/npx_confusion.md @@ -162,7 +162,7 @@ Before trusting any of those states, check whether the target's lookup path can # Public npm example; use a known package from the actual registry when different. task_registry="$(npm config get registry)" npm view --registry="$task_registry" lodash name --json -npm view --registry="$task_registry" "strix-control-$(openssl rand -hex 12)" name --json +npm view --registry="$task_registry" "$(openssl rand -hex 12)" name --json ``` Run the pair through the same `.npmrc`, scope routing, authentication, proxy, and egress path as the candidate. Direct `curl` requests to the public registry are a separate observation unless the target runner uses that exact route. A successful pair establishes coarse positive/negative discrimination, not authenticity of every candidate response; verify that returned documents name the requested package and contain plausible registry metadata.