Overview
agent-supply-chain is an open-source integrations skill for Claude Code and compatible agents, published by github. Its author describes it as: “Verify supply chain integrity for AI agent plugins, tools, and dependencies. Use this skill when: - Generating SHA-256 integrity manifests for agent plugins or tool packages - Verifying that installed plugins match th…”. The project has 38k stars on GitHub and is available under the MIT license. Add it to your setup with `git clone https://github.com/github/awesome-copilot ~/.claude/skills/agent-supply-chain`.
What agent-supply-chain does
Generate and verify integrity manifests for AI agent plugins and tools. Detect tampering, enforce version pinning, and establish supply chain provenance.
What’s inside
The SKILL.md for agent-supply-chain is organised into these sections:
- Overview
- When to Use
- Pattern 1: Generate Integrity Manifest
- Pattern 2: Verify Integrity
- Pattern 3: Dependency Version Audit
- Pattern 4: Promotion Gate
- CI Integration
- Best Practices
- Related Resources
Installation
Add agent-supply-chain to your agent with:
git clone https://github.com/github/awesome-copilot ~/.claude/skills/agent-supply-chainReview a skill’s source before installing it — skills can instruct your agent to run commands. This command comes from the skill’s public repository, which is the source of truth for setup steps. New to skills? Read how to install Claude Code skills.
Supported agents
- GitHub Copilot — declared in the repository topics
License
agent-supply-chain is published under the MIT license.
Strengths
- Clear MIT license — safe to read and adapt within its terms
- Ships in github/awesome-copilot, an established project with 37,982 GitHub stars
- Works with GitHub Copilot
- Actively maintained — repository updated in the last 90 days
Author
Topics
Frequently asked questions
- What does agent-supply-chain do?
- Verify supply chain integrity for AI agent plugins, tools, and dependencies. Use this skill when: - Generating SHA-256 integrity manifests for agent plugins or tool packages - Verifying that installed plugins match their published manifests - Detecting tampered, modified, or untracked files in agent tool directories - Auditing dependency pinning and version policies for agent components - Building provenance chains for agent plugin promotion (dev → staging → production) - Any request like "verify plugin integrity", "generate manifest", "check supply chain", or "sign this plugin"
- How do I install agent-supply-chain?
- Run git clone https://github.com/github/awesome-copilot ~/.claude/skills/agent-supply-chain in your agent, then reload your skills. Review the source at https://github.com/github/awesome-copilot before installing.
- Is agent-supply-chain free to use?
- Yes. agent-supply-chain is free and open source under the MIT license, so you can read, run, and adapt it within that license's terms.
- Which agents does agent-supply-chain work with?
- agent-supply-chain lists GitHub Copilot — named in its SKILL.md, its plugin marketplace or its repository topics. Skills use the portable SKILL.md format, so other agents that read that format may load it too.
- Where does agent-supply-chain come from?
- agent-supply-chain ships inside github/awesome-copilot, a repository that contains 41 catalogued skills in total. The repository's 37,982 GitHub stars apply to that whole collection, not to this skill on its own.