💡 Agent Skill Supply Chain Vetting & Integrity Verification Standard

[github-actions[bot]]

Summary

Establish an org-wide standard for vetting, allowlisting, and integrity-verifying all agent skills (SKILL.md files and skill directories) consumed by CI workflows and developer tooling. A CI-time scanning gate blocks unapproved or tampered skills from entering agent context — extending the same SHA-based supply chain rigor this org already applies to GitHub Actions to the emerging agent skill ecosystem.

Market Signal

Snyk's February 2026 ToxicSkills audit of 3,984 skills from the ClawHub registry found 36.82% contain at least one security flaw, 13.4% carry critical-severity issues, and 76 skills contained confirmed malicious payloads. The PhantomSkill paper (arXiv:2606.19191) demonstrated malicious code injection via clean-looking SKILL.md files that poison agent context through fetched content. CSA published a CISO Briefing specifically on SKILL.md context poisoning as a new AI supply chain attack surface. Two CVEs in Claude Code (CVE-2025-59536 CVSS 8.7, CVE-2026-21852 CVSS 5.3) showed repository-controlled config files triggering arbitrary command execution. The first coordinated malware campaign targeting Claude Code and OpenClaw skills was documented in February 2026 (30+ malicious skills via ClawHub). GitHub's Copilot Code Review Agent Skills & MCP went GA on July 29, 2026, increasing skill adoption velocity and therefore attack surface.

User Signal

This org uses SKILL.md files and has existing agent-shield CI infrastructure. Discussion #954 covers Copilot skill governance but does not address the supply chain vetting gap — the difference between "how do we govern skills we author" and "how do we verify skills we consume are not malicious." The org's AGENTS.md already mandates action pinning (SHA-based) but has no equivalent for agent skill files. Multiple open issues relate to agent security hardening (#974 trust boundaries, #975 prompt injection).

Technical Opportunity

The existing agent-shield workflow and compliance-audit.sh provide natural integration points. An approved-skills registry file (e.g., standards/approved-skills.json) plus a CI check that SHA-256 hashes approved skills and verifies at workflow time would extend the existing compliance infrastructure. The org's canary-ring promotion system can gate skill updates through soak periods. The POISE research (arXiv:2606.07943) on position-aware undetectable skill injection provides specific patterns to scan for.

Assessment

Dimension	Score	Rationale
Feasibility	high	Extends existing compliance-audit.sh and agent-shield patterns; no new infrastructure required
Impact	high	Closes a quantified 36.82% supply chain vulnerability rate affecting agent context integrity
Urgency	high	Active exploitation in the wild (Feb 2026 ClawHub malware campaign); Copilot skills GA accelerates adoption

Adversarial Review

Strongest objection: An allowlist process could slow down skill adoption and create friction for developers who want to experiment with new capabilities quickly.

Rebuttal: The allowlist process can be lightweight — a PR adding a skill hash to the approved list, auto-merged after a basic security scan. The alternative (no vetting) is demonstrably dangerous at a 36.82% flaw rate. The org already applies similar rigor to action pinning (SHA-based) and this extends the same principle. Experimentation can happen in non-production contexts without the gate.

Suggested Next Step

Draft standards/agent-skill-vetting.md with: (1) approved skills registry format (standards/approved-skills.json), (2) SHA-256 integrity check CI step for agent-shield, (3) known-malicious pattern blocklist based on Snyk's ToxicSkills indicators, (4) integration points with compliance-audit.sh.