Skip to content
Get packs

Agent Supply Chain Integrity

Hash plugin files, verify they match a saved manifest, and flag tampering or dependency pinning issues.

Source Download skill
Repository
github/awesome-copilot
Stars
40,703
Licence
MIT
Files
1 file

What it does

This skill teaches an AI agent to create an INTEGRITY.json file that records a SHA-256 fingerprint of every file in an agent plugin or tool folder. Later, the agent can re-check the folder and report any files that were changed, removed, or added since the manifest was made. It can also scan dependency files for loosely pinned versions. The skill is aimed at people who publish or review plugins, MCP servers, or other agent tools and want evidence the files were not altered.

Great for

  • Developers who publish agent plugins and want to prove later that files were not changed
  • Reviewers checking third-party agent tools before installing or promoting them
  • Teams that run a CI step to confirm reviewed plugin files have not been modified

Skip it if

  • People who only want to use a plugin: the manifest proves files are unchanged, not that the code is safe or free of bugs
  • Projects that already rely on npm provenance, Sigstore or SLSA signing, since this is a simpler custom hash check and does not sign anything

Try asking

  • “Generate an INTEGRITY.json manifest for my plugin folder”
  • “Verify that my installed plugin still matches its manifest and list any modified or untracked files”
  • “Audit my package.json and requirements.txt for unpinned or loosely pinned dependencies”
  • “Check whether this plugin is ready to be promoted from staging to production”
Step-by-step guide: how to use Agent Supply Chain IntegrityInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 1 original files, the MIT licence and an attribution note.

    agent-supply-chain.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip agent-supply-chain.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip agent-supply-chain.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Generate the manifest from a reviewed, clean copy of the plugin, then store INTEGRITY.json outside the plugin folder or in version control so it cannot be silently replaced
  • Run the verification step in CI on every pull request so added or changed files are caught early
  • Note that the manifest excludes INTEGRITY.json itself and common junk folders like .git and node_modules, so those are not checked

What's inside

  • SKILL.md

Redistributed unmodified from github/awesome-copilot under the MIT licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.