RepoAI
Browse MCPs

Agentic Supply Chain Detection

100TrustedPre-approves tools

Identification of security risks from malicious plugins, dependencies, and external models.

What it does

Agentic Supply Chain Detection shifts how an assistant evaluates incoming instructions or external resources. Instead of blindly accepting new tools or library updates, it applies a vetting process to determine if a requested resource originates from a verified, trustworthy source. It focuses on maintaining the integrity of the agent environment by identifying attempts to inject unauthorized code through dynamic loading or unpinned dependencies.

This skill acts as a guardrail during the operational phase of an assistant. It monitors interaction patterns involving remote manifests, configuration files, and package registries to ensure that no third-party artifact enters the system without meeting established trust criteria. The output provides a structured report for any identified security violation, allowing developers to address potential entry points for malicious activity.

When it earns its place

Reach for it when…

Use this when your agent architecture relies on dynamic tool installation, pulls configurations from remote endpoints, or depends on external third-party software packages that could be updated or intercepted.

Look elsewhere when…

This skill is unnecessary for static agents that run from a frozen codebase without any ability to load external plugins, install new packages, or fetch remote instructions during runtime.

What to say to use it

You never invoke a skill directly — the assistant picks it up when your request matches what it covers. These are the kinds of things that do that.

  • Check my current agent configuration for unauthorized dependencies.
  • Can you scan these tool manifests for potential supply chain risks?
  • Validate the security of this remote plugin link before I install it.
  • Identify any vulnerabilities in how the system handles dynamic model updates.

Install it

Install for all your projects

Copy the skill directory into your personal skills folder. Claude picks it up on its own the next time your request matches what it does — there is nothing to enable.

bash
git clone --depth 1 --branch main https://github.com/Tencent/AI-Infra-Guard.git /tmp/AI-Infra-Guard
mkdir -p ~/.claude/skills
cp -r /tmp/AI-Infra-Guard/agent-scan/agent_scan/prompt/skills/agentic-supply-chain-detection ~/.claude/skills/agentic-supply-chain-detection

Install for one project only

Put it in the project's own skills folder instead, so it can be committed and shared with everyone working on that repository.

bash
cp -r /tmp/AI-Infra-Guard/agent-scan/agent_scan/prompt/skills/agentic-supply-chain-detection .claude/skills/agentic-supply-chain-detection

If a skill of the same name exists in both places, the personal one wins.

Installing on Claude.ai or through the API instead? The full guide covers every surface.

Pair it with an MCP server

Agentic Supply Chain Detection changes how the work is done. These servers change what Claude can reach while doing it.

How skills and MCP servers differ →