Skill Supply Chain

The ecosystem of external task bundles, plugins, scripts, and dependencies that extend an agent’s capability. Because these artifacts can carry hidden instructions or vulnerable code, they must be reviewed as executable supply chain inputs rather than harmless configuration.

Expanded Definition

Skill supply chain refers to the external capability layer an agent consumes to perform work: task bundles, plugins, scripts, model extensions, and transitive dependencies that can execute code or shape agent behaviour. In NHI security, the term is useful because these inputs are not passive configuration. They can introduce secrets exposure, hidden instructions, or privilege expansion, which makes them closer to software supply chain artifacts than to ordinary prompt text.

Definitions vary across vendors, but the security boundary is consistent: if an artifact can run, call tools, or influence an agent’s decision path, it belongs in the trust model. That is why guidance from the OWASP Non-Human Identity Top 10 and NHI-focused research from NHI Management Group treat external extensions as identity-bearing inputs that require review, provenance checks, and revocation paths. The most common misapplication is treating a third-party plugin or script as harmless enrichment, which occurs when teams approve capability without examining what the artifact can read, change, or exfiltrate.

Examples and Use Cases

Implementing skill supply chain controls rigorously often adds review latency and compatibility friction, requiring organisations to weigh faster agent delivery against the cost of inspecting every executable dependency.

• A coding agent installs a community task bundle that appears to format code but also reads environment variables and forwards them to an external endpoint.
• A workflow plugin retrieved through an internal catalog pulls transitive dependencies that include a malicious post-install hook, similar to patterns seen in the Mastra npm Supply Chain Attack — Sapphire Sleet.
• An agent runtime accepts a script from a marketplace and executes it with the same token scope used for production API calls, turning capability expansion into credential exposure.
• A security team reviews a package mirror against the Reviewdog GitHub Action supply chain attack to understand how trusted automation can become a secret exfiltration path.
• Operational guidance from the OWASP Non-Human Identity Top 10 is used to decide whether a tool should receive its own scoped identity or inherit the agent’s broader permissions.

Why It Matters in NHI Security

Skill supply chain risk matters because agents often execute with standing access, and a single untrusted extension can convert that access into lateral movement, secret theft, or unauthorized actions. NHI Management Group research shows how quickly this becomes real: in The State of Secrets Sprawl 2026, 24,008 unique secrets were exposed in MCP configuration files in 2025 alone, showing how rapidly extensibility layers can become credential leakage points. That risk compounds when teams assume private or internal assets are inherently safe.

The security consequence is not just malware detection. It is governance failure across provenance, scope, and revocation. If a plugin ships with hidden instructions or a dependency chain pulls in a compromised package, the agent can inherit those behaviors immediately. NHI-specific guidance in the 52 NHI Breaches Report shows how identity misuse and trust-chain weaknesses repeatedly turn routine integrations into incident paths. Organisations typically encounter the operational cost only after an agent has already accessed data, executed an unsafe action, or leaked a secret, at which point skill supply chain controls become operationally unavoidable to address.

Related resources from NHI Mgmt Group

• What is supply chain amplification in Agentic AI security?
• How do attackers turn a supply-chain incident into wider NHI compromise?
• When should organisations rotate credentials after a supply chain incident?
• How should security teams reduce the risk of secret theft from npm supply chain attacks?