The one-sentence version
An AI Agent's capabilities increasingly come from "installed" components: MCP servers, plugins, skill packs, prompt templates, and custom instruction files. Much like browser extensions and npm packages, these belong to the software supply chain, and they are even more dangerous: they can not only execute code but also directly influence model decisions through natural language. The pitfalls encountered by the browser extension and software package ecosystems (impersonation, malicious behavior after acquisition, malicious updates, dependency confusion) are being repeated one by one in the AI Agent ecosystem. The countermeasures are the same: source auditing, version locking, least privilege, sandbox execution, and change review.
This article has three layers:
- Layer 1: The Intuition: Someone has mixed stranger's items into an intern's toolbox.
- Layer 2: Real-World Use: Learning from the history of npm and browser extensions to understand the Agent ecosystem.
- Layer 3: Component types, their respective risks, and auditing checklists.
Layer 1: The Intuition
1.1 Someone has mixed stranger's items into an intern's toolbox
You provide an intern (the Agent) with a toolbox, and the tools inside come from many places: official sources, the open-source community, recommendations from friends, or random downloads from the internet.
The problem is:
- Each tool not only "does work" but also comes with a user manual, and the intern will follow the manual strictly;
- The author of a tool can update the tool and the manual at any time;
- Some tools have names identical to well-known tools but are actually counterfeits.
1.2 Differences from traditional software supply chains
| Traditional Software Packages | Agent Components (MCP, Plugins, Skills) | |
|---|---|---|
| Capability | Executes code | Executes code + influences model decisions via natural language |
| Auditing Method | Reading code, static analysis | Reading code + reading descriptions and prompts (easily overlooked by humans) |
| Ecosystem Maturity | Has signatures, lockfiles, vulnerability databases | Still under construction |
Layer 2: Real-World Use
Learning from history:
| Historical Event | Lessons for the Agent Ecosystem |
|---|---|
| event-stream (2018): The maintainer of a popular npm package handed over maintenance rights to a stranger, who then added code specifically to steal a certain Bitcoin wallet (see "Dependency Poisoning") | Changes in maintenance rights are a high-risk signal |
| Malicious behavior after browser extension acquisition: Multiple popular extensions were sold to new owners who then pushed updates to inject ads or steal data | "It used to be good" does not mean "It is good now" |
| typosquatting: A large number of malicious packages on PyPI and npm that differ from famous packages by only one letter | MCP servers and skill packs are equally susceptible to impersonation |
| Ledger Connect Kit (2023): The frontend automatically loaded the "latest version" of a dependency, which immediately applied a malicious version once released (see "CSP and SRI") | Lock your versions; do not automatically update to the latest |
The current state of the Agent ecosystem: MCP servers and various AI tool plugin/skill markets are growing rapidly. A large portion is released by individual developers, and auditing mechanisms are inconsistent. Cases have already emerged involving MCP servers impersonating well-known services and tools hiding instructions within their descriptions (see "MCP and Tool Poisoning").
Layer 3: Principles and Engineering
3.1 Component Types and Risks
| Component | Capability | Primary Risk |
|---|---|---|
| Local MCP Server | Runs arbitrary code on your computer under your identity | Same as installing any software: reading files, accessing the network, leaving backdoors |
| Remote MCP Server | Runs on someone else's server and receives data sent by the Agent | All data you send to it is in someone else's hands; descriptions can be changed at any time |
| Plugins / Skill Packs | Prompts + potentially accompanying scripts | Prompt injection, script execution |
| Custom Instruction Files (e.g., Agent config files in a repo) | Automatically loaded at the start of every session, directly affecting model behavior | Cloning a strange repository means loading instructions written by a stranger |
| Prompt Templates, System Prompt Marketplaces | Determines the behavioral tone of the Agent | Hidden instructions |
The last two categories are often overlooked: a single Markdown file can also be a vector for a supply chain attack.
3.2 Auditing Checklist
| Check | Description |
|---|---|
| Source | Is it an official release or a third party? Who is the author and what is their history? Download counts and stars can be faked and cannot be used as the sole basis |
| Code | Is it open source? What network requests does the local server make, and which files does it read? |
| Description | Read the tool description and prompts in full to look for phrases like "do not tell the user" or "read ... before calling" |
| Permissions | What permissions does it request? Do they match its functionality? (see "Agent Permission Design") |
| Version | Lock to a specific version or hash; do not auto-update |
| Changes | Review the contents of updates, especially changes in descriptions; be especially vigilant regarding changes in maintainers |
| Runtime Environment | Third-party components should run in a sandbox and must not be able to access the home directory or credentials (see "Why AI Agents Need a Sandbox") |
3.3 Requirements for Platform Providers
- Signatures and Provenance: Components are signed upon release; clients verify them;
- Permission Declaration: Components declare required permissions in a manifest; clients display and enforce these during installation;
- Description Change Alerts: Re-request user approval whenever a description changes (see "MCP and Tool Poisoning");
- Instruction Files in Unknown Repositories: Prompt the user when loading an instruction file from a repository for the first time, or do not load them automatically in "untrusted" mode;
- Centralized Revocation: Ability to remotely mark and disable malicious components when discovered.
3.4 A Simple Principle
When installing an Agent component, audit it by the standard of "installing software that can read and write everything on your computer." In many cases, that is exactly what it is.
Summary
| Layer | Key points |
|---|---|
| Characteristics | Components can both execute code and influence models via natural language |
| Historical Lessons | Transfer of maintenance rights, malicious behavior after acquisition, impersonation, auto-updating to malicious versions |
| Easily Overlooked | Remote servers getting your data; instruction files in repositories are also part of the supply chain |
| Countermeasures | Source auditing, reading descriptions in full, version locking, least privilege, sandbox execution, change review |