Agent Skill Supply Chain

Why this page exists. MCP controls what tools an agent can call. Skills, rules files, hooks, and extensions control how the agent behaves before those calls. This pack governs that behavior layer as a software supply chain.

Rechecked August 23, 2026: skills are the portable agentskills.io shape used by Claude Code, Codex, Cursor, Hermes, and others — not a Claude-only package. OWASP MCP Top 10 remains beta / v0.1 (Phase 3 pilot testing; next planned release October 2026). OWASP Agentic Skills Top 10 remains a public-review v1 draft. Do not claim v1.0 is final. kill_session_on_malicious_skill_signal is a host-session kill switch, not Mcp-Session-Id. MCP 2026-07-28 is still current and stateless.

The product bet

SecurityRecipes is positioned as the secure context layer for agentic AI. That layer is incomplete if it only validates prompts, context, and MCP tools. Enterprise agent hosts now load reusable behavior packages: Claude skills, Cursor and Codex rules, VS Code extensions, Devin knowledge, Hermes skills, OpenClaw workspace files, hooks, local helper scripts, and marketplace tool bundles.

Those packages can quietly combine three dangerous ingredients:

  • access to private data or repository secrets;
  • untrusted context that the model may treat as instructions;
  • external network egress, shell, memory, or MCP authority.

The Agent Skill Supply Chain Pack makes those risks explicit. It turns skills into governed inventory with owner, publisher, registry, permissions, package hash, version pinning, signature status, sandbox requirements, runtime approval requirements, and deterministic decisions.

Workflow at a glance

Agent Skill Supply Chain workflow

Verify a skill's provenance, code, dependencies, permissions, package hash, and runtime controls before installation or execution.

agent-runtime

  1. Signal

    Discover the skill

    Capture source, publisher, version, package, digest, manifest, entrypoints, dependencies, permissions, and update channel.

  2. Scope

    Inspect the supply chain

    Verify provenance/signatures, scan code and dependencies, resolve redirects, and compare package contents with declarations.

  3. Decision

    Score capability risk

    Classify file, network, shell, browser, secret, identity, deployment, and irreversible-action permissions.

  4. Action

    Choose a trust mode

    Allow pinned read-only use, sandbox a pilot, require approval, quarantine, deny, or disable a changed skill.

  5. Proof

    Register and monitor

    Record hash, trust tier, owner, scope, controls, expiry, SBOM, runtime receipts, and drift triggers.

Decision gate

Is the skill authentic, pinned, scanned, minimally privileged, owned, and controlled for its highest-impact capability?

Proceed

Register it for the approved sandbox, scope, and trust tier.

Hold or stop

Quarantine or deny unverified, changed, overprivileged, malicious, or high-consequence skills without approval.

Evidence to retain

  • skill manifest/package hash
  • provenance and scan results
  • capability-risk decision

Expected outputs

  • trusted skill record
  • sandbox pilot plan
  • quarantine report

What was added

  • data/assurance/agent-skill-supply-chain-model.json - the source model for skill provenance, permission, risk, and control credits.
  • data/evidence/agent-skill-supply-chain-pack.json - the generated evidence pack.
  • scripts/evaluate_agent_skill_supply_chain_decision.py - the deterministic install, enable, update, and runtime decision point.

Run it locally from the repo root:

python3 scripts/generate_agent_skill_supply_chain_pack.py
python3 scripts/generate_agent_skill_supply_chain_pack.py --check

Evaluate a pinned read-only context skill before the agent loads it:

python3 scripts/evaluate_agent_skill_supply_chain_decision.py \
  --skill-id sr-secure-context-retrieval-skill \
  --operation run \
  --workflow-id vulnerable-dependency-remediation \
  --platform codex \
  --expect-decision allow_pinned_readonly_skill

The MCP server exposes the pack through recipes_agent_skill_supply_chain_pack. Runtime allow, hold, deny, or kill-session decisions stay with scripts/evaluate_agent_skill_supply_chain_decision.py.

Decision model

Decision Meaning
allow_pinned_readonly_skill Registered low-risk skill may run with read-only or context-only authority.
allow_guarded_skill Registered skill may run with sandbox, egress, approval, and evidence controls.
hold_for_skill_security_review Security-owner review is required before install, update, enable, or run.
deny_untrusted_skill Provenance, permission, version, scan, or isolation controls are insufficient.
deny_unregistered_skill Default-deny result for anything not in the supply-chain register.
kill_session_on_malicious_skill_signal Private-data-plus-egress, prohibited capability, or runtime kill signal disables the agent session.

Why this matters now

The 2026 agent security market is shifting from “prompt injection” to “behavior package supply chain.” A mature reviewer will ask:

  • Which skills are installed across agent hosts?
  • Which publisher and registry does each skill come from?
  • Are versions pinned and package hashes recorded?
  • Which skills can write memory, identity files, hooks, or rules?
  • Which skills have shell, network, or approval-required MCP access?
  • What happens when a skill update changes the hash or permission set?

This pack answers those questions in a form an MCP gateway or agent host can enforce.

Industry alignment

This feature follows current primary guidance:

Runtime examples

Plan a pinned, read-only context skill before running:

recipes_playbook_plan(
  playbook_id="agent-skill-supply-chain",
  finding="Pinned read-only context skill requested for a dependency-remediation workflow."
)

Plan a high-consequence quarantine skill with approval:

recipes_playbook_plan(
  playbook_id="agent-skill-supply-chain",
  finding="High-consequence artifact quarantine skill requested with human approval."
)

An unregistered marketplace skill, a changed package hash, a wildcard egress request, or a private-data-plus-egress pattern fails closed.

CI contract

The generator fails if:

  • the model misses current standards references;
  • the decision contract does not default-deny unregistered skills;
  • a skill references an unknown workflow;
  • mapped AST or MCP risk IDs are invalid;
  • required source packs are missing or have failures;
  • an allowed skill has no package hash;
  • the checked-in pack is stale in --check mode.

That is the enterprise bar for agentic behavior packages: inventory them, pin them, hash them, scan them, sandbox them, and deny them by default until the controls are present.

See also