AI Supply-Chain Security

An AI agent that installs a skill is executing someone else's instructions with your credentials, in your repository, on your machine. That makes the skill registry a supply chain in the same sense npm and PyPI are — and it inherits the same attack classes: typosquatting, dependency confusion, maintainer compromise, and payloads that stay dormant until a specific trigger.

It also adds a new one. Because the payload is natural-language instructions rather than executable code, it can target the agent's judgment instead of the runtime: text that reads as helpful documentation to a human reviewer but tells the model to exfiltrate an environment variable or silently widen a permission. The posts below document real incidents, break down the techniques, and cover the defenses — scanning before install, dual-side verification, and pinning what you depend on.