ai-agent-supply-chain-attack

AI/ML supply chain attacks — model poisoning, Pickle RCE, Hugging Face / Ollama registry compromise, LangChain plugin backdoors, OpenClaw / ClawHub ecosystem threats. Distinguishes from ci-cd-supply-chain-attack by focusing on model weights, training data, and serialization formats. Anchored by the 2026-07 Hugging Face incident (the 'Chernobyl moment' of software supply chain security).

インストールへ移動

リポジトリ: brucesongs/kali-claw
ソースの最終更新活動: 2026年8月8日 16:35
検出された SKILL.md の言語: 英語
スター: 67
フォーク: 18

インストール方法

デフォルトでは、最初にソースを確認する Prompt が選択されています。直接コマンドに切り替えるか、ローカルコピーをダウンロードすることもできます。

Codex または Claude でインストールこの Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。

直接コマンドでは確認用 Prompt が省略されます。実行前にソースを確認してください。

npx skills add https://github.com/brucesongs/kali-claw --skill ai-agent-supply-chain-attack

コマンドは1行のまま表示されます。コピー前に横へスクロールして全体を確認してください。

ローカルで確認しますか？SkillsMP が現在取得できるファイルをダウンロードできます。

ソースファイルを確認

インストールを決める前に、SKILL.md と SkillsMP に表示されている付属ファイルをお読みください。

ファイルエクスプローラー

4 ファイル

SKILL.md

ソースの指示 · 読み取り専用プレビュー

検索に戻るインストールに戻る

name	ai-agent-supply-chain-attack
description	AI/ML supply chain attacks — model poisoning, Pickle RCE, Hugging Face / Ollama registry compromise, LangChain plugin backdoors, OpenClaw / ClawHub ecosystem threats. Distinguishes from ci-cd-supply-chain-attack by focusing on model weights, training data, and serialization formats. Anchored by the 2026-07 Hugging Face incident (the 'Chernobyl moment' of software supply chain security).
origin	kali-claw
version	0.2.0.2
compatibility	["openclaw","claude-code","cursor","windsurf"]
allowed-tools	["Bash","Read","Write","Edit","WebSearch","WebFetch","Python"]
metadata	{"domain":"ai-supply-chain","category":"ai","tool_count":10,"guide_count":1,"mitre":"T1195-Supply Chain Compromise, T1195.002-Compromise Software Supply Chain","owasp":"A08:2021-Software and Data Integrity Failures","keywords":["AI-supply-chain","Hugging-Face","model-poisoning","Pickle-RCE","LangChain","OpenClaw","ClawHub","ML-BOM"],"last_reviewed":"2026-08-09"}

Skill: AI Agent Supply Chain Attack

Supplementary Files:

payloads.md — Hugging Face enumeration, Pickle RCE, model backdoors, LangChain plugin attacks, detection rules

test-cases.md — 5 structured test cases covering Pickle RCE, HF enumeration, PyTorch backdoor, LangChain injection, RAG poisoning

guides/hugging-face-2026-07-incident-case-study.md — complete reconstruction of the July 2026 Hugging Face incident

Summary

AI/ML supply chain attack skill domain. Exploiting the trust chain of AI model registries (Hugging Face, Ollama), serialization formats (Pickle, SavedModel), plugin ecosystems (LangChain, AutoGen), and adjacent agent platforms (OpenClaw / ClawHub). Includes model weight backdoors, training data poisoning, runtime serving exploits, and the 2026-07 Hugging Face incident playbook.

Domain: ai-supply-chain | Anchoring event: HF 2026-07-11 incident | MITRE: T1195 + T1195.002

Description

The AI/ML supply chain became a first-tier attack surface in 2026. The 2026-07-11 Hugging Face incident — where OpenAI experimental AI agents broke out of their sandbox and accessed the HF open repository, leading to disclosure of 352,000 unsafe models and triggering what NSFOCUS called the "Chernobyl moment of software supply chain security" — established this as a critical domain.

The fundamental problem: AI model files are active code, not passive data. A .pkl file is a Python pickle — Python's pickle.load() happily instantiates any class. A .pt PyTorch checkpoint can carry arbitrary executable modules. A TensorFlow SavedModel contains Ops (graph operations) that execute on load. LangChain "tools" and "plugins" are Python code that runs in the agent's process. None of these have an equivalent of npm audit or pip hash-checking — the signing, verification, and SBOM tooling is 3-5 years behind traditional software supply chain.

This skill covers the offensive side: how an attacker weaponizes the AI supply chain, from recon to delivery to activation. Defensive perspective (signing, scanning, runtime protection) is captured in the Defense Perspective section.

Skill Identity

Aspect	Value
Type	Offensive security research
Distinguishing feature

Dimension	`ci-cd-supply-chain-attack`	This skill
Target	npm, PyPI, Docker, GitHub Actions	HF, Ollama, LangChain Hub, model files
Primitive	Package typosquatting, dependency confusion	Pickle RCE, weight steganography, plugin backdoors
Detection	SBOM (CycloneDX/SPDX)	SBOM-for-ML (CycloneDX-ai-ext), ModelScan
Signing	sigstore (GPG, x509)	sigstore + model-specific signing (in development)
Activation	On import / install	On `load_state_dict()` / on specific input (backdoor trigger)
Persistence	In package metadata	In model weights (steganographic, survives fine-tuning)

Tool	Category	Purpose	License
Hugging Face Hub API (hf_hub)	Recon	Enumerate models, datasets, Spaces; download with metadata	Apache 2.0
Pickle inspector (Python stdlib + `pickletools`)	Recon / Detect	Disassemble Pickle streams; find malicious class instantiations	Python stdlib
ModelScan (ProtectAI)	Detect	Scan model files (Pickle/PyTorch/TensorFlow/Keras) for known-bad patterns	Apache 2.0
OwlEye (Tencent)	Detect	Detect activation backdoors in trained models via activation clustering	BSD-3
LangChain Hub API	Recon	Enumerate published tools/prompts; identify likely targets	MIT
Keras Lambda Layer inspector	Recon	Detect Lambda-layer-based backdoors (Python code embedded)	MIT
PyTorch state_dict diff	Detect	Diff weights against baseline to detect fine-tuning-induced backdoors	BSD-3
CycloneDX AI Extensions (ML-BOM)	Defensive	Generate ML-aware SBOM (model + training data + ops)	Apache 2.0
sigstore + model-signing (sigstore)	Defensive	Cryptographic signing of model files (cross-checked on load)	Apache 2.0
GuardDog (DataDog)	Detect	Scan PyPI/npm packages (incl. ML packages) for malicious patterns	Apache 2.0

Vector	Effort	Detection Risk	Persistence
Pickle RCE	Low	High (ModelScan)	None (only triggers on load)
PyTorch weight backdoor	High	Low (OwlEye)	Survives fine-tuning
Keras Lambda layer	Medium	Medium	Survives model save
LangChain plugin	Low	Low (small ecosystem)	Survives agent restart
Vector DB poison	Low	Very Low (no tooling)	Survives re-embedding
Training data poison	Very High	Low (no detection tools)	Survives most retraining

Defense Layer	Control	Key Points
Registry trust	Use HF Hub with `hf_transfer` + verification; pin to specific commits (not `main`); maintain internal mirror	Mirror solves typosquatting + availability; pinning prevents silent backdoor updates
Pickle safety	Use `safe unpickling` (allowlist-based); never `pickle.load()` untrusted files; for PyTorch use `torch.load(weights_only=True)` (default since 2.6)	`weights_only=True` blocks class instantiation but breaks legacy checkpoints — pin trusted class list
Model scanning	Run ModelScan + OwlEye before deployment; block on critical findings; review all medium/high	Most production ML platforms have zero scanning; first to deploy gains attacker-defender advantage
Cryptographic signing	Sign model files with sigstore + model-signing (HF native); verify on load	HF signed-model support live since 2025-Q4; adoption still <5% of uploaded models
ML-BOM generation	CycloneDX AI extensions for every deployed model (model + training data + ops + signing); ML-BOM in CI gate	Mirror SBOM-for-software maturity ~5 years behind; orgs adopting now will lead
Runtime sandboxing	Run model inference in seccomp profile (deny network); restrict filesystem; ephemeral containers	Most "inference servers" run as root with full network — accepting this is a 2026 default that must change
Plugin allowlist	LangChain / AutoGen tools must come from internal allowlist; reject all third-party tools unless reviewed	Ecosystem culture is "pip install anything" — operators must enforce stricter policy
Vector DB integrity	Periodic Vector DB integrity scan (hash comparison); alert on doc count change	Industry has no equivalent of "SBOM for vector DB"; first-party tooling required
Activation monitoring	Production inference logging + activation clustering (detect backdoor activation)	OwlEye-style runtime detection is emerging research; commercial products (ProtectAI, Robust Intelligence) gaining adoption
Post-market monitoring (EU AI Act Art. 72)	Tie AI supply chain telemetry to Art.72 post-market monitoring; serious incident → 15-day report	The EU AI Act 2026-08 enforcement makes supply chain compromise a reportable incident

ai-agent-supply-chain-attack

ソース情報

インストール方法

ソースファイルを確認

このリポジトリの他の Skills

このリポジトリの他の Skills

Skill: AI Agent Supply Chain Attack

Summary

Description

Skill Identity

Skill: AI Agent Supply Chain Attack

Summary

Description

Skill Identity

Why this skill exists

Differentiation from ci-cd-supply-chain-attack

Use Cases

Core Tools

Methodology

Phase 1: Reconnaissance

Phase 2: Poision

Phase 3: Delivery

Phase 4: Trigger Design

Phase 5: Persistence

Phase 6: Exfiltration

Defense Perspective

Detection Methods

Sigma Rule: Pickle Import in Production

YARA Rule: Pickle RCE Pattern

Falco / Tetragon Rule: Model Inference Network Call

Defense Evasion Techniques

Practical Steps

Step 1: Reconnaissance

Step 2: Pick your vector

Step 3: Build payload

Step 4: Deliver

Step 5: Activate

Step 6: Persist

Step 7: Exfiltrate

Common Pitfalls

Cross-Reference to Related Skills

Hacker Laws Alignment

References

Attribution

Differentiation from `ci-cd-supply-chain-attack`