/agent-supply-chain-audit

name: agent-supply-chain-audit
description: "Audit the extensions AI coding agents load and trust (skills, plugins, marketplaces, hooks, settings, MCP servers, and instruction files like CLAUDE.md, AGENTS.md, GEMINI.md, .cursor/rules and copilot-instructions.md) across Claude Code, Cursor, Codex, Gemini CLI and GitHub Copilot. Read-only: inventories each item with its source and pin, greps for hidden instructions, exfiltration, credential reads, persistence, curl|bash and over-broad tool grants, reviews hooks and MCP pinning and tool poisoning, and gives each item a SAFE / CAUTION / DO-NOT-INSTALL verdict. Use when the user mentions 'audit my skills,' 'is this skill malicious,' 'is this skill safe,' 'is this MCP server safe,' 'review CLAUDE.md,' 'review AGENTS.md,' 'plugin security,' 'check my hooks,' 'audit my MCP servers,' 'agent supply chain,' 'SkillSpector,' 'tool poisoning,' 'rug pull,' or is about to install a skill, plugin, or MCP server."
allowed-tools: Read, Grep, Glob, Bash(skillspector scan --no-llm:*)

Agent Supply-Chain Audit — Skills, Plugins, Hooks, MCP Servers, Instruction Files

Coding agents now load third-party code and third-party *instructions* with the developer's full privileges: a skill is prose the model obeys, a hook is a shell command that runs on every prompt, an MCP server is a process launched from whatever `npx` resolves today. NVIDIA's SkillSpector write-up cites Liu et al. (2026): of 31,132 public skills analysed, 26.1% had a vulnerability and 5.2% looked malicious. Nobody reviews these the way they review a dependency.

This skill inventories everything the user's agents load, reads it for concealed or hostile behaviour, checks what runs automatically and how it's pinned, and returns a per-item verdict. It never executes, installs, edits, or removes the items it audits.

Cross-references: `prompt-injection` for the same hidden-instruction and tool-poisoning checks applied to the user's *application* (RAG corpora, system prompts, the MCP servers the app exposes); `secrets-audit` for tokens sitting in MCP `env` blocks, agent settings, and session transcripts; `dependency-audit` for the npm / PyPI packages behind MCP servers and bundled scripts; `ai-risk-management` for where agent tooling sits in the org's AI inventory; `incident-triage` when a malicious item has already run; `personal-opsec` for the operator's own machine and accounts around the agent; `cicd-security` for agents that run inside CI workflows (claude-code-action and similar).

Step 0 — Authorization and scope

• Audit the user's own machine, repos, and the items they're considering installing. User-level folders (`~/.claude`,

`~/.codex`, …) belong to the person at the keyboard; don't audit another user's home or a shared host without the owner's say-so.

• Agree the scope: **project** (this repo), **user** (home-directory config), **managed** (org policy files), or a

**candidate** (a skill / plugin / server the user hasn't installed yet — have them clone it to a scratch directory; don't install it to look at it).

• Read-only. Config files hold tokens: when a match contains a secret, report the file and key name, redact the value

to prefix + last 4, and hand it to `secrets-audit`. Don't paste secret values into the conversation.

• Never run an item to see what it does (no launching MCP servers, no running bundled scripts or hook commands). Where

dynamic evidence is needed, write the `validation_plan` for the user to run in a sandbox.

Step 1 — Inventory

List every instruction file, skill, command, subagent, plugin, marketplace, hook, settings file, and MCP server each agent loads, at every scope. The per-agent path tables and a one-shot discovery command are in [references/locations.md](references/locations.md). The headline locations:

| Agent | Instructions | Extensions | Executes code | |---|---|---|---| | Claude Code | `CLAUDE.md`, `CLAUDE.local.md`, `~/.claude/CLAUDE.md` | `.claude/skills`, `~/.claude/skills`, `.claude/commands`, `.claude/agents`, `~/.claude/plugins/`, `.claude-plugin/plugin.json` + `marketplace.json` | `.claude/settings*.json`, `~/.claude/settings.json`, `hooks/hooks.json`, `.mcp.json`, `~/.claude.json`, `claude_desktop_config.json`, managed settings | | Cross-agent | `AGENTS.md` | `.agents/skills` (where `npx skills` installs) | — | | Cursor | `.cursor/rules/*.mdc`, `.cursorrules` | `.cursor/commands` | `.cursor/mcp.json`, `~/.cursor/mcp.json`, `.cursor/hooks.json` | | Codex | `AGENTS.md`, `~/.codex/AGENTS.md` | `~/.codex/prompts`, `~/.codex/skills` | `~/.codex/config.toml` (`[mcp_servers.*]`, approval and sandbox policy) | | Gemini CLI | `GEMINI.md`, `~/.gemini/GEMINI.md` | `.gemini/commands`, `~/.gemini/extensions/*` | `.gemini/settings.json`, `~/.gemini/settings.json` (`mcpServers`) | | Copilot | `.github/copilot-instructions.md`, `.github/instructions/*.instructions.md` | `.github/prompts`, `.github/agents`, `.github/chatmodes` | `.vscode/mcp.json`, VS Code user settings |

For each item record: **type**, **agent**, **scope**, **source** (marketplace, git URL, npm/PyPI package, docker image, remote URL, hand-written), **pin** (commit SHA, exact version, digest — or "unpinned"), and **what it can run** (nothing / pre-approved tools / hooks / a server process). An item with no identifiable source is itself worth a note.

Step 2 — Content checks

Read every instruction-bearing file end to end: skill bodies and frontmatter, bundled `references/` and `scripts/`, commands, subagents, rules files, plugin manifests, and MCP tool descriptions. Then grep. One representative pattern per category is below; the full set, with portable `grep` / `perl` equivalents, is in [references/content-checks.md](references/content-checks.md). Set `T` to the inventoried paths first.

| Check | SkillSpector IDs | Representative grep | |---|---|---| | Invisible / bidi Unicode | P2, TP2 | `rg -n '[\x{200B}-\x{200F}\x{202A}-\x{202E}\x{2060}-\x{2064}\x{2066}-\x{206