skills.rest
selfagency
selfagencyCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

agent-supply-chain

Generate and verify SHA-256 integrity manifests for AI agent plugin directories.

Updated Mar 11, 2026
Search Tags:#supply chain#plugin audit#dependency pinning#sha-256#integrity verification#ci security
One-click install
npx skills add https://github.com/selfagency/agentsy --skill agent-supply-chain
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: agent-supply-chain
Source: https://github.com/selfagency/agentsy/tree/main/.agents/skills/agent-supply-chain
Command: npx skills add https://github.com/selfagency/agentsy --skill agent-supply-chain

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Protect agent plugins, tools, and MCP servers from tampering by making their file contents verifiable over time, so you can detect modified, missing, or unexpected files before promotion.

Core Features & Use Cases

  • Generate SHA-256 integrity manifests: Create a deterministic INTEGRITY.json that records per-file hashes and an overall manifest hash for a plugin/tool directory.
  • Verify against published manifests: Re-hash the current directory contents and compare them to the recorded manifest to flag tampering, missing files, and new untracked files.
  • Audit dependency pinning and promotion readiness: Enforce that dependencies and promotion prerequisites are consistent across environments, including checks for required plugin metadata and unpinned @latest-style arguments in MCP configs.

Quick Start

Ask the AI to verify that the plugin directory ./my-plugin matches its INTEGRITY.json manifest and report any modified, missing, or untracked files.

Frequently Asked Questions about agent-supply-chain

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I verify AI agent plugin integrity and detect unauthorized file modifications?▼

AI agent plugin integrity is verified by generating a deterministic SHA-256 manifest that records per-file hashes and an overall chain hash. Re-hashing the directory and comparing it against the INTEGRITY.json manifest flags tampered, missing, or untracked files.

What is a SHA-256 integrity manifest and when do I need one for MCP server security?▼

A SHA-256 integrity manifest is a deterministic INTEGRITY.json file recording per-file and overall chain hashes for a plugin directory. You need one during CI checks and promotion gates to prove plugin contents remain unchanged between review and production deployment.

How do I audit dependency pinning and promotion readiness for MCP configs?▼

You audit dependency pinning by checking MCP configs for unpinned @latest-style arguments and validating required plugin metadata. This enforces consistency across environments and confirms prerequisites are met before production promotion.

Can I use integrity verification to track missing and untracked files in a plugin directory?▼

Integrity verification tracks missing and untracked files by recursively re-hashing the current directory contents and comparing them to the recorded INTEGRITY.json manifest. The manifest comparison explicitly reports any modified, missing, or new untracked files.

Does CI security supply chain verification work with custom file excludes?▼

CI security supply chain verification supports custom file excludes during the recursive hashing process. Explicit excludes ensure generated manifests remain deterministic and accurately reflect only the relevant plugin and tool files.

What are the limitations of using SHA-256 manifests for plugin tamper detection?▼

SHA-256 manifests detect file content changes but do not prevent tampering in real-time. Verification only occurs when explicitly run during CI checks or audits, meaning unauthorized modifications between checks go undetected until the next manifest comparison.

Related Skills

Explore More Legal & Compliance Skills→
kitfunsokitfunso

content-hash-cache

Cache file-processing results using SHA-256 content hashes.

Community
Intermediate
JhabbigJhabbig

deployment-pipeline-design

Design multi-stage CI/CD pipelines with approval gates and progressive delivery.

Community
Advanced
MesteriisMesteriis

supply-chain-review

Review build supply chains for security and integrity risks.

Community
Advanced
SunrisesIllNeverSeeSunrisesIllNeverSee

audit-trail

Log governed actions into a SHA-256 tamper-evident hash chain.

Community
Intermediate