Agent Supply Chain

Generates SHA-256 integrity manifests for agent plugins and MCP servers, then verifies nothing got modified or injected after review. You hash all files in a plugin directory, save INTEGRITY.json, and later check if current files match. It catches tampered code, untracked files that appeared post-audit, and unpinned dependency versions. The promotion gate pattern is smart: block prod deploys if verification fails or required files are missing. This is basically npm provenance or container signing but for the agent ecosystem, which has none of that infrastructure yet. If you're building a plugin marketplace or running CI on third-party tools, this closes a real gap.

skills.sh installs: 1.1K
GitHub stars: 41K
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add github/awesome-copilot --skill agent-supply-chain --agent claude-code

Installs into .claude/skills of the current project.

Files

Agent Supply Chain Integrity

Generate and verify integrity manifests for AI agent plugins and tools. Detect tampering, enforce version pinning, and establish supply chain provenance.

Overview

Agent plugins and MCP servers have the same supply chain risks as npm packages or container images — except the ecosystem has no equivalent of npm provenance, Sigstore, or SLSA. This skill fills that gap.

Plugin Directory → Hash All Files (SHA-256) → Generate INTEGRITY.json
                                                    ↓
Later: Plugin Directory → Re-Hash Files → Compare Against INTEGRITY.json
                                                    ↓
                                          Match? VERIFIED : TAMPERED