agent-supply-chain
Verify supply chain integrity for AI agent plugins, tools, and dependencies. Use this skill when: - Generating SHA-256 integrity manifests for agent plugins or tool packages - Verifying that installed plugins match their published manifests - Detecting tampered, modified, or untracked files in agent tool directories - Auditing dependency pinning and version policies for agent components - Building provenance chains for agent plugin promotion (dev → staging → production) - Any request like "verify plugin integrity", "generate manifest", "check supply chain", or "sign this plugin"
Target: Target not categorized. Automatically collected · unverified.
Excerpt from the author’s documentation
Extracted from a fixed version of SKILL.md in its original language. This is the author’s documentation; installation, compatibility and runtime results have not been verified by this site.
Read the original English text
Topics in the source
- Agent Supply Chain Integrity
- Overview
- When to Use
- Pattern 1: Generate Integrity Manifest
- Pattern 2: Verify Integrity
- Pattern 3: Dependency Version Audit
- Pattern 4: Promotion Gate
- CI Integration
Generate and verify integrity manifests for AI agent plugins and tools. Detect tampering, enforce version pinning, and establish supply chain provenance. Agent plugins and MCP servers have the same supply chain risks as npm packages or container images — except the ecosystem has no equivalent of npm provenance, Sigstore, or SLSA. This skill fills that gap. Before promoting a plugin from development to production During code review of plugin PRs As a CI step to verify no files were modified after review When auditing third-party agent tools or MCP servers Building a plugin marketplace with integrity requirements -- Create a deterministic INTEGRITY.json with SHA-256 hashes of all plugin files. Output (INTEGRITY.json): -- Check that current files match the manifest. Output on tampered plugin: -- Check that agent dependencies use pinned versions. -- Use integrity verification as a gate before promoting plugins. -- Add to your GitHub Actions workflow: -- | Practice | Rationale | |----------|-----------| | Generate manifest after code review | Ensures reviewed code matches production code | | Include manifest in the PR | Reviewers can verify what was hashed | | Verify in CI before deploy
This is an excerpt. Refer to the complete source and its current requirements.
- Source repository
- OKHP3/skillz
- Source file
- community/agent-supply-chain/SKILL.md
- Fixed revision
- 7b187777d42ab7bc7bab1e5f2c940cd3139ecebf
Sources and evidence
This record was collected automatically. Its documentation, suitability and runtime behavior have not been manually verified.
Author: OKHP3/skillz · original repository metadata. Documentation review: Not reviewed. Last source check: 2026-11-10T10:00:53.976Z.
Categories are inferred from names, descriptions and paths. They do not establish compatibility.
License and attribution
MIT. Third-party content and copyright remain with their authors. Refer to the original license and terms.
Original license ↗Synchronization, copying and user-reported success do not mark a resource as runtime-tested.
Limitations and notes
- Collecting metadata does not mean this site has installed, adapted, runtime-tested or security-reviewed the resource.