How Supply Chain Security Gates Prevent Malicious Skill Injection in reverse-skill

Supply chain security gates prevent malicious skill injection through three layered controls: mandatory human documentation review, SHA-256 bootstrap manifest pinning, and explicit MCP endpoint approval—all enforced before any skill executes.

The reverse-skill project by zhaoxuya520 implements a defense-in-depth supply chain security model that blocks compromised or malicious skills at the point of import rather than runtime. These gates protect against typosquatting attacks, dependency confusion, and unauthorized MCP server registration that could exfiltrate data or deliver secondary payloads.

---

The Three Core Security Gates

The supply chain protection system operates through three sequential gates defined in ops/skill-supply-chain.md. Each gate addresses a distinct attack vector in the skill acquisition pipeline.

Documentation Gate: Human Review Before Merge

The documentation gate mandates complete human review of all skill artifacts before acceptance into the ecosystem.

This gate requires examiners to inspect:

• The full SKILL.md descriptor
• All executable scripts (PowerShell, shell, Python, JavaScript)
• Declared external dependencies

By forcing manual scrutiny, the gate prevents hidden commands or malicious payloads embedded in comments, documentation, or non-source files from slipping through automated checks.

Pre-merge verification commands from the gate specification:

# Enumerate all executable files in the skill directory

Get-ChildItem -Recurse -Include *.ps1,*.sh,*.py,*.js | Select-Object FullName

# Scan for dangerous patterns requiring human judgment

Select-String -Pattern 'Invoke-WebRequest|curl .\||wget .\||~/.ssh|exfil' -Path <skill-dir>

The gate explicitly flags patterns like remote code execution helpers, credential access paths, and exfiltration keywords for mandatory reviewer attention.

Bootstrap-Manifest Pinning Gate: Immutable Dependency Verification

The bootstrap-manifest pinning gate enforces reproducible builds by requiring fixed version hashes for every external download.

In scripts/bootstrap-reverse.ps1 and scripts/verify-routing-coherence.ps1, the system asserts that all pip, npm, and binary dependencies include SHA-256 digests:

# verify-routing-coherence.ps1 – aborts if pinning requirements violate protocol

Assert-Fields (Join-Path $skillsRoot 'ops/skill-supply-chain.md') @('AST10','MCP','bootstrap','MUST')

The @('AST10','MCP','bootstrap','MUST') validation array checks that bootstrap dependencies, MCP modules, and AST10-signed artifacts all carry mandatory hash pins. Missing or altered digests trigger immediate pipeline termination.

Required manifest format in bootstrap-manifest.json:

{
  "pip": {
    "package": "requests",
    "version": "2.31.0",
    "sha256": "e9b2a6f4c2d1e7f... (pinned digest)"
  }
}

This pin-gate blocks dependency confusion attacks and package substitution—an attacker cannot swap a legitimate package for a malicious variant without invalidating the hash, which would fail verification before any code executes.

MCP Registration Gate: Explicit Endpoint Approval

The MCP registration gate prevents silent MCP server hijacking by disabling automatic endpoint registration.

According to the gate specification in ops/skill-supply-chain.md, the system explicitly prohibits "静默写入全局 MCP 指向未知 URL" (silent writes of global MCP pointing to unknown URLs). Instead, new MCP endpoints must:

1. Be explicitly approved by the user
2. Be recorded in the tool-index with provenance metadata
3. Pass the same documentation and pinning gates as skills

This blocks malicious MCP servers that could:

• Deliver secondary payloads when the agent initializes
• Exfiltrate conversation context or credentials
• Persist across sessions through global configuration writes

---

Enforcement Architecture: Pre-Execution Blocking

All three gates execute before any skill runs, creating a hard failure boundary rather than a runtime detection mechanism.

Route Selection in MASTER-ROUTING.md

The primary routing matrix at skills/MASTER-ROUTING.md always routes skill acquisition through the supply-chain gate as a mandatory step. No external skill bypasses this path:

• All skill imports reference the primary skill matrix
• The matrix embeds ops/skill-supply-chain.md as a required checkpoint
• Routing coherence is verified automatically

Automated Verification Pipeline

The gate conditions are continuously validated by test-suite scripts:

Script	Verification target	Failure action
scripts/verify-routing-coherence.ps1	Pin presence, routing validity, checklist completion	Abort with non-zero exit
scripts/test-bootstrap-supply-chain.ps1	Manifest hash integrity, dependency resolution	Fail CI pipeline

These scripts execute during bootstrap and CI, ensuring that compromised artifacts never reach execution context.

---

Key Files and Their Roles

The supply chain security system spans five critical files in the zhaoxuya520/reverse-skill repository:

• skills/ops/skill-supply-chain.md — Central gate definition specifying documentation, bootstrap, and MCP requirements
• skills/scripts/verify-routing-coherence.ps1 — Automated compliance verification with Assert-Fields validation
• skills/scripts/bootstrap-reverse.ps1 — Runtime enforcement of manifest pinning during environment initialization
• skills/MASTER-ROUTING.md — Routing logic that mandates supply-chain gate traversal for all skill imports
• skills/supply-chain-security/SKILL.md — SBOM and software composition analysis context referenced by downstream gates

---

Summary

Supply chain security gates in reverse-skill prevent malicious injection through:

• Mandatory human review of all skill artifacts via the documentation gate
• Immutable SHA-256 pins for every external dependency, enforced by verify-routing-coherence.ps1
• Explicit user approval for MCP endpoint registration, blocking silent server substitution
• Pre-execution enforcement through MASTER-ROUTING.md routing and automated verification scripts
• Defense-in-depth architecture that fails closed rather than detecting attacks at runtime

---

Frequently Asked Questions

What happens if a skill passes the documentation gate but fails pinning verification?

The pipeline aborts immediately. In verify-routing-coherence.ps1, the Assert-Fields function validates that all AST10, MCP, bootstrap, and MUST tagged dependencies carry SHA-256 pins. A missing pin triggers a non-zero exit before any package installation occurs, preventing the unpinned dependency from executing.

Can a compromised MCP server bypass these gates through social engineering?

No. The MCP registration gate in ops/skill-supply-chain.md explicitly disables automatic MCP registration ("静默写入"). Even with user credentials, an MCP endpoint must pass documentation review and manifest pinning before the system records it in the tool-index. The gate requires active user approval for each new endpoint.

How does bootstrap-manifest pinning prevent dependency confusion attacks?

Each declared dependency includes a fixed SHA-256 digest in bootstrap-manifest.json. An attacker deploying a higher-version malicious package in a public registry cannot substitute the legitimate package—the hash mismatch fails verification in bootstrap-reverse.ps1. Updating dependencies requires manifest modification, which undergoes the same documentation gate review.

Where does the routing gate enforce execution order?

skills/MASTER-ROUTING.md implements the execution order. All skill acquisition flows route through the primary skill matrix, which embeds ops/skill-supply-chain.md as a mandatory prerequisite. The routing coherence script validates this structure, ensuring no alternative import path bypasses the security gates.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}