Agent skill and MCP supply chain
Agent securityagent supply chain · MCP supply chain · skill supply chain
The set of third-party components an agent loads at runtime — skills, MCP servers, tools, instruction templates — and the chain of trust behind them. Installing a skill isn't installing a text file. It's handing someone else's code the permissions of the agent that loads it.
An agent is rarely one thing. It's a model plus a set of capabilities pulled in from outside: MCP servers exposing tools, skills carrying instructions and scripts, templates and config files. Each has an author, a version, a provenance and an update cycle. That's a supply chain, with all the uncomfortable properties of the software one: transitive dependencies, silent updates, inherited trust. Two things make it worse than a classic dependency. First, the component inherits the agent's effective permissions: files, credentials, memory, outbound channels. Second, much of its surface is natural language, so it can steer the agent's reasoning, not just run code. Product direction confirms the problem is real: the 2026 enterprise answer runs through MCP allowlists and protected canonical paths for agent definitions. That's how you govern a supply chain — you don't audit what already loaded, you restrict what can load.
How it differs from
- Prompt injection
- Injection is a one-off attack on an input; the supply chain is the channel that delivers that attack pre-installed and pre-authorised.
- Classic software dependencies
- A library runs code; a skill runs code and rewrites the agent's judgement on top.
Examples
- Maintaining an enterprise-wide allowlist of MCP servers
- Pinning skill versions in production instead of tracking latest
- Protecting the path where agent definitions live so they can't be edited without review
FAQ
- Where do you start?
- With the list: which MCP servers and which skills are allowed. A short, boring allowlist beats an elegant scanner pointed at an open catalogue.
- Is reviewing a skill once enough?
- No. Skills update. The risk isn't the version you reviewed, it's the one that loads tomorrow.