skills.rest
matt-riley
matt-rileyCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

agent-supply-chain

Generate and validate deterministic SHA-256 manifests for agent plugins and tools.

1|1|Updated May 3, 2026
Search Tags:#verification#integrity#plugins#manifests#supply-chain#promotion#ci
One-click install
npx skills add https://github.com/matt-riley/agent-skills --skill agent-supply-chain-matt-riley
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: agent-supply-chain
Source: https://github.com/matt-riley/agent-skills/tree/main/skills/agent-supply-chain
Command: npx skills add https://github.com/matt-riley/agent-skills --skill agent-supply-chain-matt-riley

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This skill ensures tamper-evident integrity and provenance for agent plugins and tools by generating and validating deterministic SHA-256 manifests across the supply chain.

Core Features & Use Cases

  • Generate INTEGRITY.json manifests for plugins and tool packages.
  • Verify installed plugins match their published manifests and detect tampering.
  • Audit dependency pinning and version policies to prevent unbounded updates.
  • Build provenance chains for agent plugin promotion (dev → staging → production) and gate releases with CI.

Quick Start

Generate an INTEGRITY.json manifest for your plugin directory and commit it for audit.

Frequently Asked Questions about agent-supply-chain

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I verify plugin integrity and detect tampering in a CI pipeline?▼

Verify plugin integrity by generating and validating deterministic SHA-256 manifests within your CI pipeline. This detects tampering by ensuring installed plugins match published manifests before production promotion.

What is a deterministic SHA-256 manifest for supply chain security?▼

A deterministic SHA-256 manifest is an INTEGRITY.json file containing cryptographic hashes for plugin and tool packages. It provides tamper-evident provenance by allowing systems to validate that artifacts remain unchanged across development, staging, and production environments.

How do I generate an INTEGRITY.json file for my agent plugins?▼

Generate an INTEGRITY.json manifest by applying the skill to your plugin directory to create a deterministic SHA-256 hash record. Commit this file to your repository to establish an auditable baseline for future verification steps.

Can I gate production promotions using dependency pinning and provenance chaining?▼

Yes, you can gate production promotions by auditing dependency pinning and building provenance chains across environments. This prevents unverified artifacts from promoting by enforcing CI checks that validate deterministic hashes against published manifests.

Does this approach work for preventing unbounded dependency updates in agent tools?▼

Yes, this approach prevents unbounded dependency updates by auditing dependency pinning and version policies. It ensures that agent tools and plugins remain constrained to verified versions, stopping unauthorized or unbounded updates from entering the supply chain.

Related Skills

Explore More Software Engineering Skills→
selfagencyselfagency

agent-supply-chain

Generate and verify SHA-256 integrity manifests for AI agent plugin directories.

Community
Advanced
agulliagulli
482

deploy-checklist

Enforce deployment guardrails and standardized checklists in CI/CD pipelines.

Community
Advanced
nist0nist0

supply-chain

Automate software supply chain hardening with dependency pinning, SBOM generation, and artifact signing.

Community
Advanced
xjtu-wangxjtu-wang
4

competition-supply-chain

Trace artifact provenance from source checkout to runtime consumption.

Community
Advanced