Agent Supply-Chain Audit — Skills, Plugins, Hooks, MCP Servers, Instruction Files

Coding agents now load third-party code and third-party instructions with the developer's full privileges: a skill is prose the model obeys, a hook is a shell command that runs on every prompt, an MCP server is a process launched from whatever npx resolves today. NVIDIA's SkillSpector write-up cites Liu et al. (2026): of 31,132 public skills analysed, 26.1% had a vulnerability and 5.2% looked malicious. Nobody reviews these the way they review a dependency.

This skill inventories everything the user's agents load, reads it for concealed or hostile behaviour, checks what runs automatically and how it's pinned, and returns a per-item verdict. It never executes, installs, edits, or removes the items it audits.

Cross-references: prompt-injection for the same hidden-instruction and tool-poisoning checks applied to the user's application (RAG corpora, system prompts, the MCP servers the app exposes); secrets-audit for tokens sitting in MCP env blocks, agent settings, and session transcripts; dependency-audit for the npm / PyPI packages behind MCP servers and bundled scripts; ai-risk-management for where agent tooling sits in the org's AI inventory; incident-triage when a malicious item has already run; personal-opsec for the operator's own machine and accounts around the agent (C7 checks cached browser versions); patch-sweep for the fleet response when a Chrome CVE lands; cicd-security for agents that run inside CI workflows (claude-code-action and similar).