How skill-supply-chain.md Gate Controls External MCP Tool Installation in Reverse-Skill

The skill-supply-chain.md document acts as a mandatory security gate that blocks unauthorized external MCP tools through mandatory checklists, explicit user confirmation, bootstrap manifest validation, and scope-contract enforcement.

The zhaoxuya520/reverse-skill repository implements a defense-in-depth strategy aligned with OWASP Agentic Skills Top 10 (AST10) guidance to prevent malicious code packages from compromising the development workflow. The skills/ops/skill-supply-chain.md file serves as the central enforcement mechanism that audits and approves every external tool before it enters the system.

skill-supply-chain.md Mandatory Review Requirements

Every external skill, MCP, or bootstrap script must pass the "安装外部 skill 的 MUST 清单" (External Skill Installation MUST Checklist) defined in skill-supply-chain.md (lines 33-42). This checklist forces a manual audit of the source code, full SKILL.md documentation, associated scripts, and package dependencies before any merge can proceed.

# Scan newly added script files for dangerous patterns

Get-ChildItem -Recurse -Include *.ps1,*.sh,*.py,*.js |
    Select-String -Pattern 'Invoke-WebRequest|curl|wget|~/.ssh|exfil' |
    ForEach-Object {
        Write-Warning "Potentially dangerous command found in $($_.Path): $($_.Line)"
    }

Registration and Confirmation Workflow

Tool-Index Validation

The gate prohibits registration of any MCP URL that is not pre-approved in the tool-index. According to line 49 of the supply chain document, the system loads $env:REVERSE_SKILL_ROOT/tools/tool-index.json and verifies the requested endpoint exists in the mcpList array before proceeding.

Explicit User Confirmation

Even when an MCP appears in the tool-index, the gate requires explicit user confirmation and triggers a tool-index refresh to lock the entry (line 49). This prevents automated scripts from silently adding MCP configurations that could point to untrusted URLs.

# Load the tool‑index (JSON) and verify the MCP URL is approved

$toolIndex = Get-Content -Raw "$env:REVERSE_SKILL_ROOT/tools/tool-index.json" | ConvertFrom-Json
$requestedMcp = "https://example.com/mcp"

if ($toolIndex.mcpList -contains $requestedMcp) {
    # Prompt the user for explicit confirmation

    $answer = Read-Host "MCP $requestedMcp is in the index. Confirm registration? (y/N)"
    if ($answer -eq 'y') {
        # Refresh the index to lock the entry

        ./skills/scripts/refresh-tool-index.sh
        Write-Host "MCP registered."
    } else {
        Write-Error "User denied MCP registration."
    }
} else {
    Write-Error "MCP URL not in tool‑index – registration blocked."
}

Bootstrap Manifest Limitations

The gate enforces a strict whitelist for bootstrap capabilities. The bootstrap-reverse.ps1 command may only execute capabilities explicitly listed in skills/bootstrap-manifest.json (line 48). Any capability name not present in this manifest is automatically rejected, ensuring only vetted scripts execute during environment setup.

#!/usr/bin/env bash
MANIFEST="skills/bootstrap-manifest.json"
CAPABILITY=$1

if jq -e ".capabilities[] | select(. == \"$CAPABILITY\")" "$MANIFEST" >/dev/null; then
    echo "Capability $CAPABILITY approved – proceeding."
    # …run the bootstrap script…

else
    echo "Error: Capability $CAPABILITY not listed in $MANIFEST" >&2
    exit 1
fi

Network and Scope Enforcement

Scope Contract Boundaries

The scope contract defined in skills/ops/scope-contract.md establishes allowed network profiles and scanning boundaries (line 25). MCPs that attempt to exceed these authorized in_scope boundaries are blocked before execution begins.

Port Probing Verification

Before final registration, the gate performs port probing to confirm the MCP service is legitimate and reachable (line 28). Unregistered or unverified endpoints that fail this network validation are denied installation.

Anti-Tampering Safeguards

No-Silent-Write Policy

The gate enforces an automatic "no-silent-write" policy (lines 28-29). Any attempt to modify global MCP configuration files or environment variables (such as .env changes) without explicit audit triggers an immediate block.

Scope Drift Detection

Skills that would expand scanning scopes beyond authorized boundaries trigger the scope drift guard (line 30). This prevents MCPs from gradually escalating privileges or access rights after initial approval.

Summary

• The skill-supply-chain.md gate in zhaoxuya520/reverse-skill mandates a seven-layer defense strategy for external MCP tools.
• Every installation requires validation against the MUST checklist (lines 33-42), tool-index registration, and explicit user confirmation.
• Bootstrap capabilities are restricted to whitelisted entries in bootstrap-manifest.json (line 48).
• Network profiles and scope contracts (scope-contract.md) block MCPs that exceed authorized boundaries (line 25).
• Port probing and no-silent-write policies prevent covert configuration changes (lines 28-29).
• Scope drift detection ensures approved tools cannot escalate privileges beyond initial authorization (line 30).

Frequently Asked Questions

What is the skill-supply-chain.md gate?

The skill-supply-chain.md gate is a centralized security control document in the reverse-skill repository that regulates all external MCP (Malicious-Code-Package) tool installations. Located at skills/ops/skill-supply-chain.md, it defines mandatory checklists, validation procedures, and enforcement mechanisms that block unauthorized or unaudited tools from entering the development environment.

How does the gate prevent silent MCP installation?

The gate implements a no-silent-write policy (lines 28-29) that prohibits automated modifications to global MCP configurations or environment variables. Additionally, it requires explicit user confirmation (line 49) and performs port probing (line 28) to verify endpoints before registration, ensuring no tool enters the system without human oversight and technical validation.

What files enforce the bootstrap manifest restrictions?

The bootstrap manifest restrictions are enforced through skills/bootstrap-manifest.json, which lists all approved capabilities. The gate references this file at line 48 to validate that bootstrap-reverse.ps1 only executes whitelisted operations. Any capability name not present in this JSON manifest is automatically rejected, preventing execution of unvetted bootstrap scripts.

How does the gate handle network profile violations?

The gate cross-references the scope contract defined in skills/ops/scope-contract.md (line 25) to enforce network-profile boundaries. MCPs that attempt to operate outside the authorized in_scope boundaries or exceed defined network profiles are blocked during the validation phase. This ensures external tools cannot access unauthorized network segments or expand their operational scope beyond contractual limits.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}