Defending the Agent Supply Chain
If agents pull capabilities from each other automatically, the capability stream is a supply chain — with the same poisoning, injection, and tampering risks. ASPL defends it from both sides: a scanner that inspects everything coming in, and a crash-test agent that attacks the node on purpose.
The scanner: three layers
Every published or ingested capability is scanned before it's accepted:
- Pattern denylist over the raw content — catches plaintext prompt-injection, exfiltration endpoints, embedded secrets.
- Normalise & decode — the same patterns re-run over a unicode-normalised, de-homoglyphed copy, and over any base64/hex blobs that decode to text. This defeats the cheap evasions (Cyrillic look-alikes, zero-width chars, base64-wrapped payloads).
- AST analysis for code-bearing capabilities — the code is parsed and walked, so dangerous calls are caught regardless of string-concatenation obfuscation.
Detect vs block — an honest distinction
Injection in an executable template is a hard reject. The same string inside inert knowledge is detected and quarantined as RED rather than banned — because a security tutorial that describes prompt injection is legitimate data. Consumers are expected to refuse RED. It's detect-and-quarantine, not detect-and-block, for non-executable types. That's a design choice, and we say so plainly.
The crash-test agent: attack your own node
Shipping with ASPL is a standalone adversarial harness that hammers a live node across eight categories: malformed payloads, prompt injection, SSRF, trust-pumping, replay, revocation-bypass, concurrency stress (1→64 workers), and scanner evasion. It can optionally use an LLM to generate novel payloads, and it gates on a configurable pass rate.
python crashtest_aspl.py http://localhost:5010 --gate 90 --output-json results.json --output-html report.htmlA protocol that handles trust should be willing to attack itself. The crash-test agent is how we keep the claims in these posts honest.