Agent supply chain attacks exploit the same patterns as classic software supply chain attacks (think SolarWinds, the npm event-stream incident, the PyPI colorama typosquats) but operate one layer up the stack. Where classic attacks target the executable or library, agent attacks target the prompt template, the tool description, the fine-tuned model weights, or the published skill package.
Five common vectors. Typosquatting: register panguard-cli next to panguard to trick users into installing the wrong one. Dependency confusion: publish a malicious package with the same name as an internal package, exploiting npm/PyPI resolution order. Postinstall hijack: a skill's package runs code at install time, before any audit. Author takeover: compromise the publisher account of a popular skill, ship a malicious update. Prompt-template poisoning: a community-contributed prompt template in a marketplace contains injection patterns that activate when the template runs.
PanGuard's Wild Scan (2026-04) measured the actual footprint. 122 of 67,799 scanned skills had postinstall scripts that ran before any review. 249 had the triple-threat permission combination (shell + network + filesystem). 1,096 were confirmed malicious. The data is published; the methodology is reproducible; the raw dataset is downloadable for independent verification.
Defense requires checks at three points. (1) Pre-install via Skill Auditor (catches typosquats, postinstall scripts, triple-threat, manifest-behavior mismatch). (2) At-rest via signed evidence packs and SBOM tracking (catches author-takeover by detecting unsigned updates). (3) Runtime via PanGuard Guard (catches activated payloads regardless of how they got installed). The skill-compromise category in ATR contains 40 rules targeting these patterns.