# agent-supply-chain

> Claude/Codex skill by [@github](https://omgskills.com/library/github/index.md) · 37k stars · Updated 2026-08-01

Verify supply chain integrity for AI agent plugins, tools, and dependencies. Use this skill when: - Generating SHA-256 integrity manifests for agent plugins or tool packages - Verifying that installed plugins match their published manifests - Detecting tampered, modified, or untracked files in agent tool directories - Auditing dependency pinning and version policies for agent components - Building provenance chains for agent plugin promotion (dev → staging → production) - Any request like "verify plugin integrity", "generate manifest", "check supply chain", or "sign this plugin"

Tags: agent-skills, agents, ai, awesome, custom-agents, github-copilot, hacktoberfest, prompt-engineering

## Install

```sh
git clone https://github.com/github/awesome-copilot /tmp/awesome-copilot && ln -s /tmp/awesome-copilot/skills/agent-supply-chain ~/.claude/skills/agent-supply-chain
```

## From README

Agent Supply Chain Integrity Generate and verify integrity manifests for AI agent plugins and tools. Detect tampering, enforce version pinning, and establish supply chain provenance. Overview Agent plugins and MCP servers have the same supply chain risks as npm packages or container images — except the ecosystem has no equivalent of npm provenance, Sigstore, or SLSA. This skill fills that gap. When to Use Before promoting a plugin from development to production During code review of plugin PRs As a CI step to verify no files were modified after review When auditing third-party agent tools or MCP servers Building a plugin marketplace with integrity requirements --- Pattern 1: Generate Integrity Manifest Create a deterministic INTEGRITY.json with SHA-256 hashes of all plugin files. Output (INTEGRITY.json): --- Pattern 2: Verify Integrity Check that current files match the manifest.

## Links

- HTML page: https://omgskills.com/library/github/awesome-copilot/agent-supply-chain/
- GitHub: https://github.com/github/awesome-copilot
- Author: [@github](https://omgskills.com/library/github/index.md)

## More from this repo

- [ai-ready](https://omgskills.com/library/github/awesome-copilot/ai-ready/index.md) — Make any repo AI-ready — analyzes your codebase and generates AGENTS.md, copilot-instructions.md, CI workflows, issue...
   - [@github](https://omgskills.com/library/github/index.md) · 41k stars
- [acquire-codebase-knowledge](https://omgskills.com/library/github/awesome-copilot/acquire-codebase-knowledge/index.md) — Used when the user explicitly asks to map, document, or onboard into an existing codebase.
   - [@github](https://omgskills.com/library/github/index.md) · 41k stars
- [apple-appstore-reviewer](https://omgskills.com/library/github/awesome-copilot/apple-appstore-reviewer/index.md) — Serves as a reviewer of the codebase with instructions on looking for Apple App Store optimizations or rejection...
   - [@github](https://omgskills.com/library/github/index.md) · 41k stars