# How skill-supply-chain.md Gate Controls External MCP Tool Installation in Reverse-Skill

> Discover how skill-supply-chain.md controls external MCP tool installation by enforcing security gates, checklists, user confirmation, and manifest validation. Secure your reverse-skill repository.

- Repository: [ZhaoXu/reverse-skill](https://github.com/zhaoxuya520/reverse-skill)
- Tags: how-to-guide
- Published: 2026-08-28

---

**The skill-supply-chain.md document acts as a mandatory security gate that blocks unauthorized external MCP tools through mandatory checklists, explicit user confirmation, bootstrap manifest validation, and scope-contract enforcement.**

The zhaoxuya520/reverse-skill repository implements a defense-in-depth strategy aligned with OWASP Agentic Skills Top 10 (AST10) guidance to prevent malicious code packages from compromising the development workflow. The [`skills/ops/skill-supply-chain.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/ops/skill-supply-chain.md) file serves as the central enforcement mechanism that audits and approves every external tool before it enters the system.

## skill-supply-chain.md Mandatory Review Requirements

Every external skill, MCP, or bootstrap script must pass the **"安装外部 skill 的 MUST 清单"** (External Skill Installation MUST Checklist) defined in [`skill-supply-chain.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skill-supply-chain.md) (lines 33-42). This checklist forces a manual audit of the source code, full [`SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/SKILL.md) documentation, associated scripts, and package dependencies before any merge can proceed.

```powershell

# Scan newly added script files for dangerous patterns

Get-ChildItem -Recurse -Include *.ps1,*.sh,*.py,*.js |
    Select-String -Pattern 'Invoke-WebRequest|curl|wget|~/.ssh|exfil' |
    ForEach-Object {
        Write-Warning "Potentially dangerous command found in $($_.Path): $($_.Line)"
    }

```

## Registration and Confirmation Workflow

### Tool-Index Validation

The gate prohibits registration of any MCP URL that is not pre-approved in the **tool-index**. According to line 49 of the supply chain document, the system loads `$env:REVERSE_SKILL_ROOT/tools/tool-index.json` and verifies the requested endpoint exists in the `mcpList` array before proceeding.

### Explicit User Confirmation

Even when an MCP appears in the tool-index, the gate requires **explicit user confirmation** and triggers a tool-index refresh to lock the entry (line 49). This prevents automated scripts from silently adding MCP configurations that could point to untrusted URLs.

```powershell

# Load the tool‑index (JSON) and verify the MCP URL is approved

$toolIndex = Get-Content -Raw "$env:REVERSE_SKILL_ROOT/tools/tool-index.json" | ConvertFrom-Json
$requestedMcp = "https://example.com/mcp"

if ($toolIndex.mcpList -contains $requestedMcp) {
    # Prompt the user for explicit confirmation

    $answer = Read-Host "MCP $requestedMcp is in the index. Confirm registration? (y/N)"
    if ($answer -eq 'y') {
        # Refresh the index to lock the entry

        ./skills/scripts/refresh-tool-index.sh
        Write-Host "MCP registered."
    } else {
        Write-Error "User denied MCP registration."
    }
} else {
    Write-Error "MCP URL not in tool‑index – registration blocked."
}

```

## Bootstrap Manifest Limitations

The gate enforces a strict whitelist for bootstrap capabilities. The `bootstrap-reverse.ps1` command may only execute capabilities explicitly listed in [`skills/bootstrap-manifest.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/bootstrap-manifest.json) (line 48). Any capability name not present in this manifest is automatically rejected, ensuring only vetted scripts execute during environment setup.

```bash
#!/usr/bin/env bash
MANIFEST="skills/bootstrap-manifest.json"
CAPABILITY=$1

if jq -e ".capabilities[] | select(. == \"$CAPABILITY\")" "$MANIFEST" >/dev/null; then
    echo "Capability $CAPABILITY approved – proceeding."
    # …run the bootstrap script…

else
    echo "Error: Capability $CAPABILITY not listed in $MANIFEST" >&2
    exit 1
fi

```

## Network and Scope Enforcement

### Scope Contract Boundaries

The **scope contract** defined in [`skills/ops/scope-contract.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/ops/scope-contract.md) establishes allowed network profiles and scanning boundaries (line 25). MCPs that attempt to exceed these authorized `in_scope` boundaries are blocked before execution begins.

### Port Probing Verification

Before final registration, the gate performs **port probing** to confirm the MCP service is legitimate and reachable (line 28). Unregistered or unverified endpoints that fail this network validation are denied installation.

## Anti-Tampering Safeguards

### No-Silent-Write Policy

The gate enforces an automatic **"no-silent-write"** policy (lines 28-29). Any attempt to modify global MCP configuration files or environment variables (such as `.env` changes) without explicit audit triggers an immediate block.

### Scope Drift Detection

Skills that would expand scanning scopes beyond authorized boundaries trigger the **scope drift guard** (line 30). This prevents MCPs from gradually escalating privileges or access rights after initial approval.

## Summary

- The **skill-supply-chain.md** gate in `zhaoxuya520/reverse-skill` mandates a seven-layer defense strategy for external MCP tools.
- Every installation requires validation against the **MUST checklist** (lines 33-42), **tool-index** registration, and **explicit user confirmation**.
- **Bootstrap capabilities** are restricted to whitelisted entries in [`bootstrap-manifest.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/bootstrap-manifest.json) (line 48).
- **Network profiles** and **scope contracts** ([`scope-contract.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/scope-contract.md)) block MCPs that exceed authorized boundaries (line 25).
- **Port probing** and **no-silent-write** policies prevent covert configuration changes (lines 28-29).
- **Scope drift detection** ensures approved tools cannot escalate privileges beyond initial authorization (line 30).

## Frequently Asked Questions

### What is the skill-supply-chain.md gate?

The skill-supply-chain.md gate is a centralized security control document in the reverse-skill repository that regulates all external MCP (Malicious-Code-Package) tool installations. Located at [`skills/ops/skill-supply-chain.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/ops/skill-supply-chain.md), it defines mandatory checklists, validation procedures, and enforcement mechanisms that block unauthorized or unaudited tools from entering the development environment.

### How does the gate prevent silent MCP installation?

The gate implements a **no-silent-write** policy (lines 28-29) that prohibits automated modifications to global MCP configurations or environment variables. Additionally, it requires **explicit user confirmation** (line 49) and performs **port probing** (line 28) to verify endpoints before registration, ensuring no tool enters the system without human oversight and technical validation.

### What files enforce the bootstrap manifest restrictions?

The **bootstrap manifest** restrictions are enforced through [`skills/bootstrap-manifest.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/bootstrap-manifest.json), which lists all approved capabilities. The gate references this file at line 48 to validate that `bootstrap-reverse.ps1` only executes whitelisted operations. Any capability name not present in this JSON manifest is automatically rejected, preventing execution of unvetted bootstrap scripts.

### How does the gate handle network profile violations?

The gate cross-references the **scope contract** defined in [`skills/ops/scope-contract.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/ops/scope-contract.md) (line 25) to enforce network-profile boundaries. MCPs that attempt to operate outside the authorized `in_scope` boundaries or exceed defined network profiles are blocked during the validation phase. This ensures external tools cannot access unauthorized network segments or expand their operational scope beyond contractual limits.