---
id: owasp-asi04-agentic-supply-chain
track: coding
version: 0.0.3
label: advisory
keyword: advise
where: text
sha256: 635064ee4fed5520bbc3bd61b01ad04a236ba8627807490448bac7737305f67b
source: https://github.com/open-coder-ai/chock-catalog/tree/1e60d211c1bb767152c6ab0167932da06ab3a10f/agentic-security/owasp-asi04-agentic-supply-chain
catalog_ref: 1e60d211c1bb767152c6ab0167932da06ab3a10f
---

# OWASP ASI04 — Agentic Supply Chain Vulnerabilities

owasp-asi04-agentic-supply-chain · version 0.0.3

Advisory — Advisory only. It is skill text, and nothing stops a violation. Chock adds friction. It is not a security boundary. 

In a git repo: advisory (The agent reads the text, and nothing stops a violation.)



## What it does

Verify agent components before loading them, and keep verifying, because runtime tool discovery changes the supply chain after deployment. Use when adding an MCP server, agent framework, plugin, tool registry, or model artifact, and when reviewing what an agent may pull at runtime. Do NOT use for ordinary application dependencies already covered by \`verify-dependency-exists\`.

## Its label on each agent

- Claude Code (tested): Advisory — Advisory only. It is skill text, and nothing stops a violation. Builder: /coding/builder/#client=claude-code&p=owasp-asi04-agentic-supply-chain
- Cursor (tested): Advisory — Advisory only. It is skill text, and nothing stops a violation. Builder: /coding/builder/#client=cursor&p=owasp-asi04-agentic-supply-chain
- Codex (tested): Advisory — Advisory only. It is skill text, and nothing stops a violation. Builder: /coding/builder/#client=codex&p=owasp-asi04-agentic-supply-chain
- GitHub Copilot (tested): Advisory — Advisory only. It is skill text, and nothing stops a violation. Builder: /coding/builder/#client=copilot&p=owasp-asi04-agentic-supply-chain
- Devin (tested): Advisory — Advisory only. It is skill text, and nothing stops a violation. Builder: /coding/builder/#client=devin&p=owasp-asi04-agentic-supply-chain
- Grok (tested): Not graded yet for Grok. Builder: /coding/builder/#client=grok&p=owasp-asi04-agentic-supply-chain
- goose (tested): Not graded yet for goose. Builder: /coding/builder/#client=goose&p=owasp-asi04-agentic-supply-chain
- Antigravity (tested): Not graded yet for Antigravity. Builder: /coding/builder/#client=antigravity&p=owasp-asi04-agentic-supply-chain
- OpenHands (untested): Not graded yet for OpenHands. Builder: /coding/builder/#client=openhands&p=owasp-asi04-agentic-supply-chain
- Kimi Code (untested): Not graded yet for Kimi Code. Builder: /coding/builder/#client=kimi-code&p=owasp-asi04-agentic-supply-chain
- Factory Droid (untested): Not graded yet for Factory Droid. Builder: /coding/builder/#client=factory-droid&p=owasp-asi04-agentic-supply-chain

## What it misses

This policy does not state what it misses.

## Latest change

0.0.3 · 2026-09-29 — Point at the mechanised slice: the agentic-code-security gate's supply pack refuses MCP servers launched without an exact version or commit, plain-HTTP MCP URLs, trust_remote_code and unpinned prompt pulls, at commit and at tool use. Everything else here stays advisory, and no rule text or claim is raised; the pointer is a see() and a references section.

## Provenance

- Tested by 0 of 6 cases run automatically
- SHA-256: `635064ee4fed5520bbc3bd61b01ad04a236ba8627807490448bac7737305f67b`
- Catalog commit: https://github.com/open-coder-ai/chock-catalog/commit/1e60d211c1bb767152c6ab0167932da06ab3a10f
- Source: https://github.com/open-coder-ai/chock-catalog/tree/1e60d211c1bb767152c6ab0167932da06ab3a10f/agentic-security/owasp-asi04-agentic-supply-chain (catalog path `agentic-security/owasp-asi04-agentic-supply-chain`)
- Presets: OWASP agentic top 10
- JSON: `/api/coding/policies/owasp-asi04-agentic-supply-chain.json`
- Report a problem: https://chock.sh/report/?policy=owasp-asi04-agentic-supply-chain&version=0.0.3&page=%2Fcoding%2Fpolicies%2Fowasp-asi04-agentic-supply-chain%2F