agent-supply-chain
有助于防止插件被篡改，适合多插件生态与部署场景。
会读取本地文件并计算哈希，可能需要对文件系统访问权限。
为 agent 插件和工具生成/验证完整性清单以检测篡改。
帮你为 agent 插件、工具和依赖生成并校验完整性清单（比如 SHA-256 manifest），用来检测被篡改或未备案的文件。适合在发布、审计或把插件从 dev 推到 production 前检查供应链安全与版本锁定时使用。特点是能比对已安装文件与公布的 manifest、发现未追踪或被修改的组件，并支持建立 provenance 链路。
▸ 展开 SKILL.md 英文原文
Verify supply chain integrity for AI agent plugins, tools, and dependencies. Use this skill when: - Generating SHA-256 integrity manifests for agent plugins or tool packages - Verifying that installed plugins match their published manifests - Detecting tampered, modified, or untracked files in agent tool directories - Auditing dependency pinning and version policies for agent components - Building provenance chains for agent plugin promotion (dev → staging → production) - Any request like "verify plugin integrity", "generate manifest", "check supply chain", or "sign this plugin"
帮我安装这个 skill：https://raw.githubusercontent.com/github/awesome-copilot/main/skills/agent-supply-chain/SKILL.mdcurl -fsSL "https://raw.githubusercontent.com/github/awesome-copilot/main/skills/agent-supply-chain/SKILL.md"# Agent Supply Chain Integrity
Generate and verify integrity manifests for AI agent plugins and tools. Detect tampering, enforce version pinning, and establish supply chain provenance.
## Overview
Agent plugins and MCP servers have the same supply chain risks as npm packages or container images — except the ecosystem has no equivalent of npm provenance, Sigstore, or SLSA. This skill fills that gap.
```
Plugin Directory → Hash All Files (SHA-256) → Generate INTEGRITY.json
↓
Later: Plugin Directory → Re-Hash Files → Compare Against INTEGRITY.json
↓