agent-supply-chainlisted

# Agent Supply Chain Integrity Generate and verify integrity manifests for AI agent tools, plugins, MCP servers, skills, prompts, and custom agents. Detect unexpected file changes, enforce dependency pinning, and capture provenance evidence before promotion. ## Overview Agent assets often combine executable code, prompts, policy files, and tool configuration. Treat them as deployable software: pin dependencies, record what was reviewed, verify the reviewed files before release, and fail closed when integrity evidence is missing. ``` Agent Asset Folder -> Hash Reviewable Files -> Generate INTEGRITY.json Later CI -> Re-hash Files -> Compare Hashes + Manifest Hash Result -> verified | modified | missing | untracked | invalid ``` This skill provides lightweight integrity controls. It does not replace signed releases, SLSA provenance, SBOM tooling, vulnerability scanning, or organisation-specific release policy. ## Use This Skill When - Promoting an agent tool, plugin, MCP server, skill, prompt, or custom agent to a shared or production environment - Reviewing a pull request that adds or changes agent-executable code, tool configuration, or bundled instructions - Adding a CI gate to verify that reviewed files still match the integrity manifest - Auditing third-party agent assets before adoption - Checking dependency pinning, lockfiles, provenance notes, and release evidence for agentic components ## Do Not Use This Skill For - Formal compliance claims with