Topic starter
11/07/2026 2:00 pm
TL;DR: AI coding assistants can install dependencies, modify files, and persist plugin-driven behaviours across sessions, which means a benign-looking marketplace skill can redirect package installs to attacker-controlled sources and embed trojanized code, according to SentinelOne. That shifts the core question from prompt safety to supply chain trust, where unchecked automation becomes the attack surface.
Editorial analysis by NHI Mgmt Group, based on content published by SentinelOne: “When Your AI Coding Plugin Starts Picking Your Dependencies: Marketplace Skills and Dependency Hijack in Claude Code”.
Key questions
Q: What breaks when AI coding assistant plugins can install dependencies on behalf of developers?
A: The trust model breaks because the assistant becomes part of the software delivery path, not just a drafting aid.
Q: Why do AI agent skills create supply chain risk in enterprise environments?
A: AI agent skills create supply chain risk because they can look harmless in review while delivering malicious behavior only when executed.
Q: How can security teams reduce the risk of malicious dependency redirection?
A: Teams should limit which assistants can touch package sources, require provenance checks for assistant-driven installs, and log any change to mirrors, indexes, or dependency paths.
Practitioner guidance
- Govern assistant plugins as supply chain components Inventory every marketplace skill or plugin that can install code, modify files, or persist behaviour across sessions, then require approval for each one based on provenance and access scope.
- Restrict dependency source redirection Block assistants from changing package indexes, mirrors, or repository targets unless those sources are explicitly approved and logged under change control.
- Audit persistent plugin permissions Review which skills remain enabled between sessions and remove any that no longer have a documented business need or an owned approval record.
Bottom line: AI coding assistants can expand the software supply chain trust boundary by making dependency choices on behalf of developers.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/07/2026 2:10 pm
Plugin trust is now supply chain governance, not just tool selection. Once AI coding assistants can install packages and carry state across sessions, the trust boundary extends to every skill that can influence those actions. That means the control question is no longer whether the assistant is useful, but whether the organisation can prove provenance, constrain privilege, and revoke risky integrations quickly enough. Practitioners should treat marketplace skills as governed supply chain actors, not optional productivity extras.
A few things that frame the scale:
- Developers using GenAI tools like GitHub Copilot are reporting 35% productivity gains, according to IDC’s 2024 Generative AI Study.
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: Should organisations treat AI coding agents like privileged software identities?
A: Yes. If an AI agent can install code, access secrets, or modify repositories, it is functionally acting as a privileged non-human identity and should be governed that way. That means task-scoped access, explicit boundaries, and monitoring of its downstream actions, especially when it can touch build and release systems.
👉 Read our full editorial: AI coding assistants expand the software supply chain trust boundary