Agent Supply Chain Integrity

Generate and verify integrity manifests for AI agent tools, plugins, MCP servers, skills, prompts, and custom agents. Detect unexpected file changes, enforce dependency pinning, and capture provenance evidence before promotion.

Overview

Agent assets often combine executable code, prompts, policy files, and tool configuration. Treat them as deployable software: pin dependencies, record what was reviewed, verify the reviewed files before release, and fail closed when integrity evidence is missing.

Agent Asset Folder -> Hash Reviewable Files -> Generate INTEGRITY.json
        Later CI -> Re-hash Files -> Compare Hashes + Manifest Hash
        Result -> verified | modified | missing | untracked | invalid

This skill provides lightweight integrity controls. It does not replace signed releases, SLSA provenance, SBOM tooling, vulnerability scanning, or organisation-specific release policy.

Use This Skill When