ai-agent-supply-chain-attack

AI/ML supply chain attacks — model poisoning, Pickle RCE, Hugging Face / Ollama registry compromise, LangChain plugin backdoors, OpenClaw / ClawHub ecosystem threats. Distinguishes from ci-cd-supply-chain-attack by focusing on model weights, training data, and serialization formats. Anchored by the 2026-07 Hugging Face incident (the 'Chernobyl moment' of software supply chain security).

跳到安装

仓库: brucesongs/kali-claw
最近来源活动: 2026年8月8日 16:35
检测到的 SKILL.md 语言: 英语
星标: 67
分支: 18

安装方式

默认使用会先检查来源的 Prompt；你也可以切换为直接命令，或下载本地副本。

用 Codex 或 Claude 帮你安装复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。

直接命令不会经过审查 Prompt；运行前请先检查来源。

npx skills add https://github.com/brucesongs/kali-claw --skill ai-agent-supply-chain-attack

命令会保持在同一行。复制前请横向滚动并检查完整内容。

想先保存到本地？可下载 SkillsMP 当前能够提供的文件。

检查来源文件

决定是否安装前，请先阅读 SKILL.md，以及 SkillsMP 当前展示的配套文件。

文件资源管理器

4 个文件

SKILL.md

来源说明 · 只读预览

返回搜索返回安装

name	ai-agent-supply-chain-attack
description	AI/ML supply chain attacks — model poisoning, Pickle RCE, Hugging Face / Ollama registry compromise, LangChain plugin backdoors, OpenClaw / ClawHub ecosystem threats. Distinguishes from ci-cd-supply-chain-attack by focusing on model weights, training data, and serialization formats. Anchored by the 2026-07 Hugging Face incident (the 'Chernobyl moment' of software supply chain security).
origin	kali-claw
version	0.2.0.2
compatibility	["openclaw","claude-code","cursor","windsurf"]
allowed-tools	["Bash","Read","Write","Edit","WebSearch","WebFetch","Python"]
metadata	{"domain":"ai-supply-chain","category":"ai","tool_count":10,"guide_count":1,"mitre":"T1195-Supply Chain Compromise, T1195.002-Compromise Software Supply Chain","owasp":"A08:2021-Software and Data Integrity Failures","keywords":["AI-supply-chain","Hugging-Face","model-poisoning","Pickle-RCE","LangChain","OpenClaw","ClawHub","ML-BOM"],"last_reviewed":"2026-08-09"}

Skill: AI Agent Supply Chain Attack

Supplementary Files:

payloads.md — Hugging Face enumeration, Pickle RCE, model backdoors, LangChain plugin attacks, detection rules

test-cases.md — 5 structured test cases covering Pickle RCE, HF enumeration, PyTorch backdoor, LangChain injection, RAG poisoning

guides/hugging-face-2026-07-incident-case-study.md — complete reconstruction of the July 2026 Hugging Face incident

Summary

AI/ML supply chain attack skill domain. Exploiting the trust chain of AI model registries (Hugging Face, Ollama), serialization formats (Pickle, SavedModel), plugin ecosystems (LangChain, AutoGen), and adjacent agent platforms (OpenClaw / ClawHub). Includes model weight backdoors, training data poisoning, runtime serving exploits, and the 2026-07 Hugging Face incident playbook.

Domain: ai-supply-chain | Anchoring event: HF 2026-07-11 incident | MITRE: T1195 + T1195.002

Description

The AI/ML supply chain became a first-tier attack surface in 2026. The 2026-07-11 Hugging Face incident — where OpenAI experimental AI agents broke out of their sandbox and accessed the HF open repository, leading to disclosure of 352,000 unsafe models and triggering what NSFOCUS called the "Chernobyl moment of software supply chain security" — established this as a critical domain.

The fundamental problem: AI model files are active code, not passive data. A .pkl file is a Python pickle — Python's pickle.load() happily instantiates any class. A .pt PyTorch checkpoint can carry arbitrary executable modules. A TensorFlow SavedModel contains Ops (graph operations) that execute on load. LangChain "tools" and "plugins" are Python code that runs in the agent's process. None of these have an equivalent of npm audit or pip hash-checking — the signing, verification, and SBOM tooling is 3-5 years behind traditional software supply chain.

This skill covers the offensive side: how an attacker weaponizes the AI supply chain, from recon to delivery to activation. Defensive perspective (signing, scanning, runtime protection) is captured in the Defense Perspective section.

Skill Identity

Aspect	Value
Type	Offensive security research
Distinguishing feature

Dimension	`ci-cd-supply-chain-attack`	This skill
Target	npm, PyPI, Docker, GitHub Actions	HF, Ollama, LangChain Hub, model files
Primitive	Package typosquatting, dependency confusion	Pickle RCE, weight steganography, plugin backdoors
Detection	SBOM (CycloneDX/SPDX)	SBOM-for-ML (CycloneDX-ai-ext), ModelScan
Signing	sigstore (GPG, x509)	sigstore + model-specific signing (in development)
Activation	On import / install	On `load_state_dict()` / on specific input (backdoor trigger)
Persistence	In package metadata	In model weights (steganographic, survives fine-tuning)

Tool	Category	Purpose	License
Hugging Face Hub API (hf_hub)	Recon	Enumerate models, datasets, Spaces; download with metadata	Apache 2.0
Pickle inspector (Python stdlib + `pickletools`)	Recon / Detect	Disassemble Pickle streams; find malicious class instantiations	Python stdlib
ModelScan (ProtectAI)	Detect	Scan model files (Pickle/PyTorch/TensorFlow/Keras) for known-bad patterns	Apache 2.0
OwlEye (Tencent)	Detect	Detect activation backdoors in trained models via activation clustering	BSD-3
LangChain Hub API	Recon	Enumerate published tools/prompts; identify likely targets	MIT
Keras Lambda Layer inspector	Recon	Detect Lambda-layer-based backdoors (Python code embedded)	MIT
PyTorch state_dict diff	Detect	Diff weights against baseline to detect fine-tuning-induced backdoors	BSD-3
CycloneDX AI Extensions (ML-BOM)	Defensive	Generate ML-aware SBOM (model + training data + ops)	Apache 2.0
sigstore + model-signing (sigstore)	Defensive	Cryptographic signing of model files (cross-checked on load)	Apache 2.0
GuardDog (DataDog)	Detect	Scan PyPI/npm packages (incl. ML packages) for malicious patterns	Apache 2.0

Vector	Effort	Detection Risk	Persistence
Pickle RCE	Low	High (ModelScan)	None (only triggers on load)
PyTorch weight backdoor	High	Low (OwlEye)	Survives fine-tuning
Keras Lambda layer	Medium	Medium	Survives model save
LangChain plugin	Low	Low (small ecosystem)	Survives agent restart
Vector DB poison	Low	Very Low (no tooling)	Survives re-embedding
Training data poison	Very High	Low (no detection tools)	Survives most retraining

Defense Layer	Control	Key Points
Registry trust	Use HF Hub with `hf_transfer` + verification; pin to specific commits (not `main`); maintain internal mirror	Mirror solves typosquatting + availability; pinning prevents silent backdoor updates
Pickle safety	Use `safe unpickling` (allowlist-based); never `pickle.load()` untrusted files; for PyTorch use `torch.load(weights_only=True)` (default since 2.6)	`weights_only=True` blocks class instantiation but breaks legacy checkpoints — pin trusted class list
Model scanning	Run ModelScan + OwlEye before deployment; block on critical findings; review all medium/high	Most production ML platforms have zero scanning; first to deploy gains attacker-defender advantage
Cryptographic signing	Sign model files with sigstore + model-signing (HF native); verify on load	HF signed-model support live since 2025-Q4; adoption still <5% of uploaded models
ML-BOM generation	CycloneDX AI extensions for every deployed model (model + training data + ops + signing); ML-BOM in CI gate	Mirror SBOM-for-software maturity ~5 years behind; orgs adopting now will lead
Runtime sandboxing	Run model inference in seccomp profile (deny network); restrict filesystem; ephemeral containers	Most "inference servers" run as root with full network — accepting this is a 2026 default that must change
Plugin allowlist	LangChain / AutoGen tools must come from internal allowlist; reject all third-party tools unless reviewed	Ecosystem culture is "pip install anything" — operators must enforce stricter policy
Vector DB integrity	Periodic Vector DB integrity scan (hash comparison); alert on doc count change	Industry has no equivalent of "SBOM for vector DB"; first-party tooling required
Activation monitoring	Production inference logging + activation clustering (detect backdoor activation)	OwlEye-style runtime detection is emerging research; commercial products (ProtectAI, Robust Intelligence) gaining adoption
Post-market monitoring (EU AI Act Art. 72)	Tie AI supply chain telemetry to Art.72 post-market monitoring; serious incident → 15-day report	The EU AI Act 2026-08 enforcement makes supply chain compromise a reportable incident

ai-agent-supply-chain-attack

来源信息

安装方式

检查来源文件

同仓库更多 Skills

Skill: AI Agent Supply Chain Attack

Summary

Description

Skill Identity

Skill: AI Agent Supply Chain Attack

Summary

Description

Skill Identity

Why this skill exists

Differentiation from ci-cd-supply-chain-attack

Use Cases

Core Tools

Methodology

Phase 1: Reconnaissance

Phase 2: Poision

Phase 3: Delivery

Phase 4: Trigger Design

Phase 5: Persistence

Phase 6: Exfiltration

Defense Perspective

Detection Methods

Sigma Rule: Pickle Import in Production

YARA Rule: Pickle RCE Pattern

Falco / Tetragon Rule: Model Inference Network Call

Defense Evasion Techniques

Practical Steps

Step 1: Reconnaissance

Step 2: Pick your vector

Step 3: Build payload

Step 4: Deliver

Step 5: Activate

Step 6: Persist

Step 7: Exfiltrate

Common Pitfalls

Cross-Reference to Related Skills

Hacker Laws Alignment

References

Attribution

同仓库更多 Skills

Differentiation from `ci-cd-supply-chain-attack`