Verify supply chain integrity for AI agent plugins, tools, and dependencies. Use this skill when: - Generating SHA-256 integrity manifests for agent plugins or tool packages - Verifying that installed plugins match their published manifests - Detecting tampered, modified, or untracked files in agent

Agent Supply Chain Integrity Generate and verify integrity manifests for AI agent plugins and tools. Detect tampering, enforce version pinning, and establish supply chain provenance. Overview Agent plugins and MCP servers have the same supply chain risks as npm packages or container images — except the ecosystem has no equivalent of npm provenance, Sigstore, or SLSA. This skill fills that gap. When to Use Before promoting a plugin from development to production During code review of plugin PRs As a CI step to verify no files were modified after review When auditing third party agent tools or MCP servers Building a plugin marketplace with integrity requirements Pattern 1: Generate Integrity Manifest Create a deterministic INTEGRITY.json with SHA 256 hashes of all plugin files. Output ( INTEGRITY.json ): Pattern 2: Verify Integrity Check that current files match the manifest. Output on tampered plugin: Pattern 3: Dependency Version Audit Check that agent dependencies use pinned versions. Pattern 4: Promotion Gate Use integrity verification as a gate before promoting plugins. CI Integration Add to your GitHub Actions workflow: Best Practices Practice Rationale Generate manifest after code review Ensures reviewed code matches production code Include manifest in the PR Reviewers can verify what was hashed Verify in CI before deploy Catches post review modifications Chain hash for tamper evidence Single hash represents entire plugin state Exclude build artifacts Only hash source files — .git, pycache , node modules excluded Pin all dependency versions Unpinned deps = different code on every install Related Resources [OpenSSF SLSA](https://slsa.dev/) — Supply chain Levels for Software Artifacts [npm Provenance](https://docs.npmjs.com/generating provenance statements) — Sigstore based package provenance [Agent Governance Toolkit](https://github.com/microsoft/agent governance toolkit) — Includes integrity verification and plugin signing [OWASP ASI 09: Supply Chain Integrity](https://owasp.org/www project agentic ai threats/)

agent-supply-chain