Intelligent agent supply chain security detection method and related device

Abstract

The application discloses an intelligent agent supply chain security detection method and related equipment, and relates to the technical field of data processing, which comprises the following steps: in response to a security detection instruction, a mixed structure plug-in containing a natural language instruction and executable code is acquired, content structurization extraction is performed on the mixed structure plug-in to obtain standardized detection data, multi-dimensional semantic threat judgment is performed on the standardized detection data based on a preset large model to generate a risk judgment result, and based on the risk judgment result, a trust security middleware pre-deployed between an intelligent agent and a large language model is used to perform security verification on the behavior of the intelligent agent. The application performs structurization extraction on the mixed structure plug-in to obtain standardized detection data, analyzes the standardized detection data from multiple dimensions based on a preset large model, and performs security verification on the behavior of the intelligent agent in combination with the trust security middleware, so that the security detection of the intelligent agent supply chain is realized.

Description

Technical Field

[0001] This application relates to the field of data processing technology, and in particular to intelligent agent supply chain security detection methods and related equipment. Background Technology

[0002] In related technologies, with the large-scale application of large-scale intelligent agents, the ecosystem based on Skills plugins and the MCP platform has become the core infrastructure for extending the capabilities of intelligent agents. Currently, mainstream Skills plugins adopt a novel structure that integrates natural language prompts and executable code blocks in Markdown format, and the number of plugins is growing exponentially. However, existing supply chain security detection technologies are mainly designed for traditional pure code assets, relying on regular expression matching, AST parsing, or static rule scanning. They can only identify malicious features at the code level and cannot perform semantic-level security auditing of natural language prompts. This results in extremely high false negative rates for new semantic attack methods such as prompt injection, role hijacking, and system instruction overwriting. Attackers can bypass detection through carefully crafted prompt instructions, inducing intelligent agents to perform unauthorized operations or leak sensitive data. The current lack of detection capabilities adapted to the "Prompt + code" hybrid structure has become a core technical bottleneck restricting the security protection of intelligent agent supply chains. Summary of the Invention

[0003] The main purpose of this application is to provide a method and related equipment for security detection of intelligent agent supply chains, aiming to solve the technical problem of how to conduct security detection of intelligent agent supply chains.

[0004] To achieve the above objectives, this application proposes a method for intelligent agent supply chain security detection, which includes: In response to security detection commands, obtain a hybrid plugin structure containing natural language commands and executable code; Content structure extraction is performed on the hybrid structure plugin to obtain standardized detection data, wherein the standardized detection data includes at least natural language instruction fragments and code fragments; Based on a pre-set large model, multi-dimensional semantic threat determination is performed on the standardized detection data to generate risk determination results; Based on the risk assessment results, a security verification is performed on the agent's behavior through a trust and security middleware pre-deployed between the agent and the large language model.

[0005] In one embodiment, prior to the step of obtaining the hybrid structure plugin containing natural language instructions and executable code, the method further includes: If the plugin ecosystem is the ClawHub ecosystem, a WebSocket long connection channel is built based on Convex Cloud cloud service to monitor incremental plugin updates in real time. If an incremental plugin update occurs, the plugin in compressed package format is downloaded through a dedicated application programming interface. The downloaded compressed package format plugin is then transferred to an isolated local sandbox for decompression. The isolated local sandbox adopts process isolation and file system read-only strategy. If the plugin ecosystem is the Smithery ecosystem, a standard HTTP polling mechanism is used to simulate CLI tool requests to quickly obtain plugin metadata. Based on the plugin metadata, the built-in repository address resolver dynamically converts the repository address into a raw file direct link URI. Based on the raw file direct link URI, the plugin's core markup language document is downloaded at high speed.

[0006] In one embodiment, the step of performing content structure extraction on the hybrid structure plugin further includes: The markup language document of the hybrid structure plugin is split to extract the natural language instruction fragments; Extract the code snippets written in different programming languages ​​from the markup language document, wherein the programming languages ​​include object-oriented languages, scripting languages, and command-line languages; Extract the dependency information declared in the markup language document; Extract the Uniform Resource Locator (URL) links contained in the markup language document.

[0007] In one embodiment, the step of performing multi-dimensional semantic threat determination on the standardized detection data further includes: The code snippet is subjected to risk semantic recognition of high-risk command execution and unauthorized operation in order to detect system-level high-risk function calls and sensitive path access behaviors; The code snippet is subjected to risk semantic recognition of supply chain poisoning to detect fileless attack instructions and unexpected third-party dependency installation behavior; The natural language command fragments are subjected to prompt word injection and jailbreak risk semantic recognition to detect malicious commands that hijack roles and bypass security restrictions; The system performs risk semantic recognition of data theft and covert communication on the Uniform Resource Locator (URL) links to detect the outgoing of sensitive data to untrusted network addresses.

[0008] In one embodiment, the step of performing security verification on the behavior of the agent through a trust-secure middleware pre-deployed between the agent and the large language model further includes: Based on the aforementioned trust security middleware, the execution control flow graph of the intelligent agent is dynamically constructed to verify the legitimacy of key behavioral nodes and intercept execution process hijacking. Based on the aforementioned trust security middleware, a data asset security level marking system is established to track the flow of sensitive data in real time and intercept illegal data leakage. Based on the aforementioned trust security middleware, deep semantic analysis is performed to compare the agent's execution behavior with the user's original intent and to intercept unauthorized operations. Based on the aforementioned trust security middleware, security analysis is performed in both asynchronous and synchronous modes to achieve real-time identification and mitigation of runtime risks.

[0009] In one embodiment, after the step of generating the risk assessment result, the method further includes: Extract the unique feature value of plugins with malicious or suspicious risks, and periodically match the unique feature value with the enterprise's internal asset database to identify internally introduced nodes; Based on precise counting operators, the number of times the malicious or suspicious plug-in is referenced in the enterprise's internal devices and business systems is calculated in real time to generate a quantitative report on the risk impact. If the risk assessment result is malicious and the number of references is greater than zero, an emergency response work order containing the threat type and risk details will be automatically generated. After converting the risk assessment results, the risk impact quantification report, and the emergency response work order into a unified standard Parquet format, they are stored in a distributed file system cluster to build a data warehouse.

[0010] Furthermore, to achieve the above objectives, this application also proposes an intelligent agent supply chain security detection device, which includes: The acquisition module is used to acquire a hybrid structure plugin containing natural language instructions and executable code in response to a security detection command. An extraction module is used to perform content structure extraction on the hybrid structure plugin to obtain standardized detection data, wherein the standardized detection data includes at least natural language instruction fragments and code fragments; The determination module is used to perform multi-dimensional semantic threat determination on the standardized detection data based on a preset large model, and generate a risk determination result. The verification module is used to perform security verification on the behavior of the agent based on the risk assessment result, through a trust and security middleware pre-deployed between the agent and the large language model.

[0011] In addition, to achieve the above objectives, this application also proposes an intelligent agent supply chain security detection device, the device comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor, the computer program being configured to implement the steps of the intelligent agent supply chain security detection method as described above.

[0012] In addition, to achieve the above objectives, this application also proposes a storage medium, which is a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, it implements the steps of the intelligent agent supply chain security detection method described above.

[0013] In addition, to achieve the above objectives, this application also provides a computer program product, which includes a computer program that, when executed by a processor, implements the steps of the intelligent agent supply chain security detection method described above.

[0014] One or more technical solutions proposed in this application have at least the following technical effects: This application discloses a method and related equipment for intelligent agent supply chain security detection, relating to the field of data processing technology. In contrast to existing supply chain security detection technologies, which are primarily designed for traditional pure code assets and rely on regular expression matching, AST parsing, or static rule scanning, these technologies can only identify malicious features at the code level and cannot perform semantic-level security auditing of natural language prompts. This results in a very high false negative rate for novel semantic attack methods such as prompt injection, role hijacking, and system instruction overwriting. Attackers can bypass detection through carefully crafted prompt instructions, inducing intelligent agents to perform unauthorized operations or leak sensitive data. In this application, firstly, in response to a security detection instruction, a hybrid structure plugin containing natural language instructions and executable code is obtained. Then, content structure extraction is performed on the hybrid structure plugin to obtain standardized detection data. The standardized detection data includes at least natural language instruction fragments and code fragments. Further, based on a preset large model, multi-dimensional semantic threat judgment is performed on the standardized detection data to generate risk judgment results. Finally, based on the risk judgment results, security verification is performed on the intelligent agent's behavior through a trust security middleware pre-deployed between the intelligent agent and the large language model.

[0015] Understandably, this application performs structured extraction of hybrid-structured plugins to obtain standardized detection data. Based on a pre-set large model, it analyzes the standardized detection data from multiple dimensions and combines it with a trusted security middleware to perform security verification on the intelligent agent's behavior, thereby achieving secure detection of the intelligent agent supply chain. Attached Figure Description

[0016] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0017] To more clearly illustrate the technical solutions in the embodiments of this application or related technologies, the accompanying drawings used in the description of the embodiments or related technologies will be briefly introduced below. Obviously, for those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0018] Figure 1 This is a flowchart illustrating an embodiment of the intelligent agent supply chain security detection method of this application. Figure 2 This is a flowchart illustrating Embodiment 2 of the intelligent agent supply chain security detection method of this application. Figure 3 This is a schematic diagram of the module structure of the intelligent agent supply chain security detection device according to an embodiment of this application; Figure 4 This is a schematic diagram of the device structure of the hardware operating environment involved in the intelligent agent supply chain security detection method in this application embodiment.

[0019] The purpose, features, and advantages of this application will be further explained in conjunction with the embodiments and with reference to the accompanying drawings. Detailed Implementation

[0020] It should be understood that the specific embodiments described herein are merely illustrative of the technical solutions of this application and are not intended to limit this application.

[0021] To better understand the technical solution of this application, a detailed description will be provided below in conjunction with the accompanying drawings and specific implementation methods.

[0022] The main solution in this application embodiment is: In this embodiment, for ease of description, the following description uses the intelligent agent supply chain security detection equipment as the execution subject.

[0023] Due to the limitations of existing technologies, current supply chain security detection technologies are primarily designed for traditional pure code assets, relying on regular expression matching, AST parsing, or static rule scanning. These technologies can only identify malicious features at the code level and cannot perform semantic-level security auditing of natural language prompts. This results in a very high false negative rate for new semantic attack methods such as prompt injection, role hijacking, and system instruction overwriting. Attackers can bypass detection through carefully crafted prompt instructions, inducing agents to perform unauthorized operations or leak sensitive data.

[0024] This application provides a solution in which: first, in response to a security detection command, a hybrid structure plugin containing natural language commands and executable code is obtained; then, content structure extraction is performed on the hybrid structure plugin to obtain standardized detection data, wherein the standardized detection data includes at least natural language command fragments and code fragments; further, based on a preset large model, multi-dimensional semantic threat determination is performed on the standardized detection data to generate a risk determination result; finally, based on the risk determination result, security verification is performed on the behavior of the intelligent agent through a trust security middleware pre-deployed between the intelligent agent and the large language model.

[0025] Understandably, this application performs structured extraction of hybrid-structured plugins to obtain standardized detection data. Based on a pre-set large model, it analyzes the standardized detection data from multiple dimensions and combines it with a trusted security middleware to perform security verification on the intelligent agent's behavior, thereby achieving secure detection of the intelligent agent supply chain.

[0026] It should be noted that the executing entity in this embodiment can be a computing service device with data processing, network communication, and program execution functions, such as a tablet computer, personal computer, or mobile phone, or an electronic device or intelligent agent supply chain security detection device capable of performing the above functions. The following description uses an intelligent agent supply chain security detection device as an example to illustrate this embodiment and the subsequent embodiments.

[0027] Based on this, embodiments of this application provide a method for intelligent agent supply chain security detection, referring to... Figure 1 , Figure 1 This is a flowchart illustrating the first embodiment of the intelligent agent supply chain security detection method of this application.

[0028] In this embodiment, the intelligent agent supply chain security detection method includes steps S10 to S40: Step S10: In response to the security detection command, obtain a hybrid structure plugin containing natural language commands and executable code; It should be noted that the security detection command refers to the control command initiated by the system's internal scheduling module or an external trigger signal to start the plug-in security detection process.

[0029] It should be noted that hybrid structure plugins refer to intelligent agent capability extension packages written in Markdown format. Their content includes both natural language descriptions of prompt instructions (such as role settings, task descriptions, and output format requirements) and executable code blocks (such as Python, JavaScript, and Bash scripts). A typical example is the Skills plugin.

[0030] In this embodiment, upon receiving a security detection command, the system actively acquires the target plugin through a multi-source data acquisition module (supporting mainstream ecosystems such as ClawHub and Smithery). Customized acquisition protocols are used for different ecosystems. For the ClawHub ecosystem, incremental changes are monitored in real time via a WebSocket long-lived connection to identify newly added or updated plugins and download ZIP archives by calling the platform's dedicated API. The downloaded plugin files are then sent to a local isolated sandbox for secure decompression and preliminary preprocessing to ensure the original content is securely readable.

[0031] For the Smithery ecosystem, HTTP polling is used to obtain plugin metadata, and the Git Tree URL parser is used to convert the repository address into a direct URL for raw files, so that the core file (such as SKILL.md) can be downloaded directly.

[0032] Understandably, this step enables the automatic and real-time capture of new plugins in the Skills / MCP supply chain, solving the problems of time-consuming full cloning and lagging incremental identification in the traditional model. At the same time, it prevents malicious files from escaping and infecting the host, providing clean and complete plugin content for subsequent detection.

[0033] Specifically, before the step of obtaining the hybrid structure plugin containing natural language instructions and executable code, steps S11-S12 are also included: Step S11: If the plugin ecosystem is the ClawHub ecosystem, a WebSocket long connection channel is built based on Convex Cloud cloud service to monitor the incremental updates of the plugin in real time. If an incremental update of the plugin occurs, the plugin in compressed package format is downloaded through a dedicated application programming interface. The downloaded compressed package format plugin is transferred to an isolated local sandbox to perform decompression operation. The isolated local sandbox adopts process isolation and file system read-only strategy. It should be noted that Convex Cloud service refers to a cloud platform that provides real-time backend capabilities, supporting WebSocket long connections, state synchronization, and change subscription.

[0034] WebSocket long-lived connection channels refer to a full-duplex communication protocol connection that remains open after establishment, allowing the server to proactively push data to the client for real-time receipt of incremental plugin change notifications without requiring repeated polling by the client.

[0035] The proprietary application programming interface (PAPI) refers to a specific interface provided by the ClawHub platform, which is used to initiate a plugin compressed package download request and return a plugin file package in ZIP format.

[0036] Plugins in compressed format refer to plugins in the ClawHub ecosystem that are distributed in ZIP compressed packages, containing core files such as SKILL.md and auxiliary resources.

[0037] An isolated local sandbox is an execution environment subject to strict security policies, isolated from the host operating system, used for decompressing and preprocessing downloaded ZIP packages.

[0038] Process isolation means that all processes running in a sandbox are isolated from host processes in terms of namespace, permissions, and resource access. Even if a process is maliciously controlled, it cannot affect the host system.

[0039] The read-only file system policy means that the file system inside the sandbox is set to read-only mode (or a specific temporary directory can be written but is destroyed after being written to disk), to prevent malicious plugins from writing executable files or modifying system configurations after decompression.

[0040] In this embodiment, after determining that the plugin to be collected belongs to the ClawHub ecosystem, the system establishes a long-lived WebSocket connection through the Convex Cloud service to subscribe to plugin change events on the ClawHub platform. When a new or updated plugin is added to the platform, the WebSocket channel pushes incremental update notifications in real time. After receiving the notification, the system calls ClawHub's dedicated API to initiate a download request and obtain the plugin's ZIP archive. The downloaded ZIP archive is then transferred to a pre-deployed isolated local sandbox. Decompression is performed in the sandbox environment, which has process isolation and a read-only file system policy enabled: the decompression process is restricted to the sandbox namespace; the decompressed files can only be written to a temporary area of ​​the read-only file system, cannot be persisted to the host file system, and cannot escape operations. After decompression, the plugin's core content (such as SKILL.md) is securely read from the sandbox for use in subsequent detection steps.

[0041] Understandably, this step, tailored to the unique distribution method of the ClawHub ecosystem, enables real-time capture of incremental plugin changes (via WebSocket), avoiding the latency and resource waste associated with traditional polling. Simultaneously, it fundamentally eliminates the escape risks of malicious ZIP packages triggering path traversal, file overwriting, and malicious program release and execution during decompression, ensuring the security of the data collection host itself.

[0042] Step S12: If the plugin ecosystem is the Smithery ecosystem, a standard HTTP polling mechanism is used to simulate CLI tool requests to quickly obtain plugin metadata. Based on the plugin metadata, the built-in repository address resolver dynamically converts the repository address into a direct file link (URL) URI. Based on the URL URI, the plugin's core markup language document is downloaded at high speed.

[0043] It should be noted that the standard HTTP polling mechanism refers to a communication method that actively sends HTTP requests to the server at fixed time intervals (such as every minute or every hour) to query and pull the latest plugin metadata.

[0044] CLI tool requests refer to HTTP request headers, parameters, and authentication information sent by simulating command-line tools (such as the official Smithy CLI) to make the system recognize it as a legitimate client, thereby obtaining complete plugin metadata.

[0045] Plugin metadata refers to structured data that describes information such as plugin name, version, repository address, author, and description. It is usually returned in JSON format and includes the Git repository address.

[0046] The built-in repository address resolver is a built-in functional module of the system that can parse Git repository addresses (Tree URL format, such as https: / / github.com / user / repo / tree / main), extract branch and path information, and dynamically convert them into direct URLs of the original files.

[0047] A raw URL is a direct download link to the raw content of a file in a Git repository (e.g., https: / / raw.githubusercontent.com / user / repo / main / SKILL.md), allowing you to access the file content without cloning the entire repository.

[0048] The core markup language document refers to the plugin's main description file, usually named SKILL.md in the Smithery ecosystem. It is a file written in Markdown format that contains a mixture of natural language instructions and code blocks.

[0049] In this embodiment, after determining that the current plugin belongs to the Smithery ecosystem, the system initiates a standard HTTP polling mechanism, sending simulated CLI tool requests (carrying necessary User-Agent, Token, and other parameters) to the Smithery platform at preset intervals to obtain a list of plugin metadata. The system extracts the Git repository address (e.g., the Tree URL of a GitHub repository) for each plugin from the returned metadata. It then calls the built-in repository address resolver to parse the address, identifying the Git platform (GitHub, GitLab, etc.), branch name (e.g., main, master), and file path (e.g., / SKILL.md), dynamically constructing the corresponding RawURL. Using the generated RawURL, it directly initiates an HTTP GET request to download the SKILL.md core file at high speed, skipping the traditional git clone full download process. The downloaded SKILL.md file is then fed into the subsequent content structure extraction step.

[0050] Understandably, this step, targeting the Git Tree metadata characteristics of the Smithery ecosystem, bypasses the cumbersome operation of full repository cloning by directly converting raw URLs, downloading only the necessary core file (SKILL.md). The combination of standard HTTP polling and simulated CLI requests ensures compatibility with the official ecosystem and the completeness of metadata acquisition, providing efficient support for subsequent fast, high-frequency, large-scale plugin scanning.

[0051] Step S20: Perform content structure extraction on the hybrid structure plugin to obtain standardized detection data, wherein the standardized detection data includes at least natural language instruction fragments and code fragments; It should be noted that content structure extraction refers to splitting and classifying the original Markdown format plugin document according to content type, forming a data structure with clear fields that can be used for automated analysis.

[0052] It should be noted that standardized test data refers to a unified format data set generated after structured extraction, containing at least two core fields: Natural language instruction fragments: Text content extracted from non-code block areas in Markdown, including Prompt descriptions, user guidance, role definitions, output constraints, etc.

[0053] Code snippets: Extracted from code blocks in Markdown marked as languages ​​such as Python, JavaScript, and Bash, which may contain executable logic such as dependency declarations, system calls, and network requests.

[0054] In this embodiment, Markdown formatted text is read, and natural language regions such as headings, paragraphs, and lists are identified to extract natural language instruction fragments. Code block markers (such as python and bash) are identified, and the corresponding code content and language type are extracted. Optional additional elements such as external links and dependency declarations (such as a package list in the style of requirements.txt) can also be extracted as supplementary detection data. All extracted results are encapsulated in a preset JSON or structure format to generate standardized detection data.

[0055] Understandably, this step transforms disordered and mixed plugin documentation into structured, programmable standard data. By separating natural language and code—two different semantic objects—it lays the foundation for subsequent specialized audits targeting Prompt semantic threats and code execution threats, significantly reducing input noise and understanding complexity in large model detection.

[0056] Specifically, the step of performing content structure extraction on the hybrid structure plugin further includes steps S21 to S24: Step S21: Split the markup language document of the hybrid structure plugin to extract the natural language instruction fragments; It should be noted that the markup language document refers to the plugin core file downloaded in the aforementioned steps. It is usually in Markdown format (such as SKILL.md), which is a lightweight markup language document that supports structured elements such as headings, paragraphs, lists, and code blocks.

[0057] In this embodiment, the raw text content of the plugin's markup language document is read. Based on Markdown syntax rules, different element types in the document are identified and distinguished: headings, paragraphs, lists, quotes, tables, code blocks, links, etc. All elements outside of code blocks (such as text paragraphs, list items, and text within tables) are categorized as natural language content. This natural language content is extracted, markup syntax symbols are removed, and the plain text semantic information is retained to form a natural language instruction fragment. This fragment typically contains prompt information such as the plugin's role setting, task description, usage instructions, and output format requirements.

[0058] Understandably, this step separates the human-readable instructions from the executable code in the markup language document, allowing subsequent large models to focus on semantic-level threat analysis (such as prompt injection and role hijacking) and avoiding interference from code content with natural language understanding. Simultaneously, the extracted natural language fragments retain complete contextual logic, providing clean input for accurate detection of semantic attacks.

[0059] Step S22: Extract the code snippets written in different programming languages ​​from the markup language document, wherein the programming languages ​​include object-oriented languages, scripting languages, and command-line languages; It should be noted that object-oriented languages ​​refer to programming languages ​​such as Python and Java, which organize code around classes and objects.

[0060] It should be noted that scripting languages ​​refer to interpreted languages ​​such as JavaScript and Shell scripts (Bash), which are commonly used for automating tasks.

[0061] Command-line languages ​​are sequences of commands that can be executed directly in the operating system terminal, such as Bash and PowerShell commands. They are typically used for file operations, network requests, process management, etc.

[0062] In this embodiment, all regions marked as code blocks are identified within the markup language document. Code snippets are categorized based on language identifiers (or heuristically determined by code features) into types such as Python (object-oriented / scripting), JavaScript (scripting / object-oriented), and Bash (command line / scripting). The original code text within each code block is extracted, and its language type and starting position (line number) in the document are recorded for evidence location during subsequent threat assessment. The extracted code snippets are stored in a list format, maintaining their association with natural language instruction snippets.

[0063] Understandably, this step enables the unified extraction and classification of multilingual code in hybrid structures, ensuring that malicious code written in different languages ​​can be fully captured and sent to subsequent detection. Language type annotation helps in selecting targeted threat pattern libraries during subsequent semantic auditing, improving detection accuracy.

[0064] Step S23: Extract the dependency information declared in the markup language document; It should be noted that dependency information refers to the declarations of external packages, libraries, or modules required for the plugin to run. These are usually listed in a specific format (such as requirements.txt style, package.json snippets, embedded pip install commands, etc.), indicating the dependencies that need to be downloaded and installed from third-party repositories.

[0065] In this embodiment, the entire markup language document is scanned, focusing not only on standard code blocks but also on dependency declarations that may appear as lists or commands in the natural language region. Common dependency declaration patterns are identified: code blocks containing installation commands such as pipinstall, npm install, and apt-get install; independent paragraphs listing package names and version numbers; and multi-line text mimicking the requirements.txt format. Dependency names, version constraints (if any), and source repository addresses are extracted. The dependency information is then stored in a structured manner.

[0066] Understandably, dependency information is one of the primary vectors for supply chain poisoning attacks. By specifically extracting dependency declarations, this step can identify whether a plugin attempts to introduce unexpected malicious dependency packages, points to suspicious third-party repositories, or contains fileless attack instructions. This fine-grained extraction provides direct evidence for subsequent detection of supply chain poisoning.

[0067] Step S24: Extract the Uniform Resource Locator (URL) links contained in the markup language document.

[0068] It's important to note that a Uniform Resource Locator (URL) is a network address string appearing in a document, which can point to external websites, API interfaces, file download addresses, image resources, tracking probes, etc. This includes HTTP / HTTPS links, FTP links, WebSocket links, etc.

[0069] In this embodiment, all text content of the markup language document is scanned. Regular expressions or URL parsing libraries are used to identify links conforming to standard formats. Exactly safe internal or self-referential links are excluded, but all complete URLs pointing to external domains are retained. For each extracted URL, its location (e.g., paragraph number, code block line number) and context (e.g., whether it's within an image tag, or used as a command parameter) are recorded. The URL list is stored in a structured manner for subsequent data theft and covert communication detection (e.g., determining whether sensitive information is being sent to untrusted domains, or whether pixel tracking probes are embedded).

[0070] Understandably, URLs serve as channels for data breaches and external control. This step extracts all backlinks, enabling the detection engine to analyze whether plugins are sending sensitive information to attacker-controlled servers, loading external malicious scripts, or transmitting data back through covert channels. Furthermore, by combining URL reputation databases or domain analysis, malicious callback addresses can be further identified, effectively blocking data theft threats.

[0071] Step S30: Based on the preset large model, perform multi-dimensional semantic threat determination on the standardized detection data to generate risk determination results; It should be noted that the pre-selected large-scale model refers to a pre-selected and integrated large-scale language model (such as the GPT series, open-source LLaMA, etc.), which has deep semantic understanding and threat pattern recognition capabilities. It is guided to perform threat detection tasks in specific dimensions through a customized security audit prompt.

[0072] It should be noted that multi-dimensional semantic threat assessment refers to analyzing the plugin content item by item from four key threat dimensions, including: High-risk command execution (RCE) and unauthorized operations: Identify high-risk system-level calls (such as os.system, subprocess, eval obfuscation, and reverse shell).

[0073] Supply chain poisoning: Detecting fileless attack commands (curl|bash), unexpected installation of unknown dependencies, and introduction of malicious repositories.

[0074] Prompt injection and jailbreaking: Identifying malicious prompt patterns such as role hijacking (e.g., "Ignore previous instructions"), system command overwriting, and security restriction bypassing.

[0075] Data theft and covert communication: Detection of pixel tracking probes, XSS scripts, sensitive data being sent to untrusted URLs, and covert channel communication.

[0076] It should be noted that the risk assessment result refers to the uniform risk level label output for each plugin, specifically divided into: MALICIOUS: Clearly indicates the presence of a high-risk attack payload or serious violation.

[0077] RISKY: A suspicious pattern exists but malice has not been confirmed. Manual review or further analysis is required.

[0078] SAFE (Safety): No known or suspected threat signatures detected.

[0079] In this embodiment, firstly, the standardized detection data (natural language instruction fragments + code fragments) generated in step S20 is concatenated with the customized security audit prompt to construct a complete model input. Then, a preset large model interface is called, requiring the model to sequentially perform semantic judgments on the four major threat dimensions, outputting the detection results and overall risk level for each dimension. The model output results are then format-validated and parsed to generate a standardized detection report containing the threat type, risk level, and specific evidence location (such as line number, code segment). For plugins determined to be MALICIOUS or RISKY, a unique feature value is extracted for subsequent asset association.

[0080] Understandably, this step overcomes the bottleneck of traditional regular expression matching and AST parsing in understanding natural language semantics, enabling accurate detection of threats that pure code analysis cannot uncover, such as prompt injection, role hijacking, and indirect prompt word attacks. The multi-dimensional joint judgment of the large model covers the core attack surface of the intelligent agent plugin, greatly reducing the false negative rate, while providing a clear decision basis for subsequent automated handling (alarms, blocking) through level labeling.

[0081] Specifically, the step of performing multi-dimensional semantic threat determination on the standardized detection data further includes steps S31 to S34: Step S31: Perform risk semantic recognition of high-risk command execution and unauthorized operation on the code fragment to detect system-level high-risk function calls and sensitive path access behaviors; In this embodiment, the code fragments of each programming language extracted in step S22 are sequentially input into a preset large model. Customized security audit instructions are provided to the large model, requiring it to focus on analyzing whether the code contains: calls to high-risk system functions (such as os.system, subprocess.run, eval) with parameters containing externally controllable or obfuscated content; covert command execution constructed through string concatenation, encoding bypass, nested calls, etc.; file operations such as open, read, write, and chmod on sensitive system paths; and unauthorized behaviors such as reverse shell statements and network scanning. The large model outputs the threat type, danger level, and code location of each detected item based on semantics. The identification results are categorized into the "high-risk command execution and unauthorized operation" dimension and used as one of the inputs for subsequent risk level labeling.

[0082] Understandably, this step can identify malicious execution logic hidden through techniques such as indirect variable calls, string concatenation obfuscation, and encoding spoofing. Through semantic understanding, it can effectively detect dynamic code execution behaviors that are difficult to cover with regular expressions, such as eval(decompress(encoded_string)), significantly reducing the false negative rate for RCE and privilege escalation operations.

[0083] Step S32: Perform supply chain poisoning risk semantic recognition on the code fragment to detect fileless attack instructions and unexpected third-party dependency installation behavior; In this embodiment, code snippets are input into a pre-defined large model, and a special detection instruction for supply chain poisoning is provided. The model is required to recognize the following typical patterns: A fileless attack chain is used, employing tools like curl, wget, and fetch to retrieve data from external URLs and pipe it to interpreters such as bash, sh, and python. Commands like pip install, npm install, and gem install are embedded in the code, with package names or repository addresses pointing to non-standard sources. External scripts are dynamically downloaded and executed. A requirements.txt class dependency list is declared in the code block, containing typosquatting packages with names highly similar to official package names but with character substitutions. The model outputs detection results, marking the code locations and specific threat types with supply chain poisoning risks. Cross-validation is performed using the dependency declaration information extracted in step S23 to improve accuracy.

[0084] Understandably, this step is specifically designed to target the most covert supply chain attack vectors (fileless execution and malicious dependency injection) in intelligent agent plugins, identifying malicious packages disguised as legitimate dependencies, and effectively preventing attackers from completing system intrusion the moment the plugin is installed or running.

[0085] Step S33: Perform prompt word injection and jailbreak risk semantic recognition on the natural language command fragment to detect malicious commands that hijack roles and bypass security restrictions; In this embodiment, the natural language instruction fragments extracted in step S21 are input into a preset large model, with additional prompt-based injection detection instructions. The model is required to identify threat patterns through semantic analysis: instruction overlay, role-playing hijacking, jailbreak splicing, and system instruction leakage inducement. The model outputs the original text, danger type, and confidence level of each suspected malicious prompt. Injection / jailbreak behaviors with high confidence are marked as prompt injection threats.

[0086] Understandably, large models can comprehend complex attack techniques such as semantic variations, indirect manipulation, and step-by-step jailbreaks. Through semantic auditing, carefully crafted Prompt injection payloads by attackers can be effectively detected, preventing agents from being hijacked and leaking sensitive data, performing unauthorized operations, or generating illegal content.

[0087] Step S34: Perform risk semantic recognition of data theft and covert communication on the Uniform Resource Locator (URL) link to detect the behavior of sending sensitive data to untrusted network addresses.

[0088] In this embodiment, the list of all URLs extracted in step S24, along with their locations and context codes (or natural language fragments), is input into a preset large model. The model is required to perform comprehensive semantic judgment to identify typical data theft or covert communication behaviors: URLs pointing to external domains and with obvious data outbound operations in the context; the use of pixel tracking probes to collect user access information; covert channels established through DNS tunnels, WebSocket connections to non-standard ports, etc.; URLs containing dynamic parameter placeholders, implying that variable values ​​are appended to outbound requests; and the use of short link services or URL redirection services to hide the real receiving address. The model outputs the threat determination, basis, and risk level for each suspicious URL. For URLs determined to be data theft or covert communication, the corresponding plugins are marked as having an information leakage risk.

[0089] Understandably, this step transforms the URL from an isolated string into a security assessment object with behavioral context. By understanding the role of the URL in the plugin logic through a large model, it is possible to effectively detect hidden threats such as pixel tracking, callback-based data theft, and C2 signaling, preventing the agent from leaking sensitive business data without the user's knowledge.

[0090] Step S40: Based on the risk assessment result, perform security verification on the behavior of the intelligent agent through a trust security middleware pre-deployed between the intelligent agent and the large language model.

[0091] Specifically, the step of performing security verification on the behavior of the intelligent agent through a trust-secure middleware pre-deployed between the intelligent agent and the large language model further includes steps S41 to S44: Step S41: Based on the trusted security middleware, dynamically construct the execution control flow graph of the intelligent agent to verify the legitimacy of key behavior nodes and intercept execution process hijacking; Step S42: Based on the trusted security middleware, establish a data asset security level marking system to track the flow of sensitive data in real time and intercept illegal data leakage; Step S43: Based on the trusted security middleware, perform deep semantic analysis to compare the agent's execution behavior with the user's original intent and intercept unauthorized operations; Step S44: Based on the trusted security middleware, perform security analysis in both asynchronous and synchronous modes to achieve real-time identification and mitigation of runtime risks.

[0092] It should be noted that the trust security middleware refers to a lightweight protection component (named armor-plugin) pre-deployed between agents such as OpenClaw and the Large Language Model (LLM). This middleware adopts a client-server architecture, requiring no modification to the agent's source code or joint compilation; deployment can be completed with just one command. At runtime, it intercepts the interaction flow between the agent and the LLM, performing three layers of security checks.

[0093] It should be noted that security verification refers to the mechanism by which middleware performs real-time checks on the behavior executed by the intelligent agent, encompassing three dimensions: Control flow integrity verification: Dynamically construct the intelligent agent execution control flow graph, verify the legitimacy of key behavioral nodes (such as tool calls, memory read and write, process jumps), and intercept execution flow hijacking initiated from the outside.

[0094] Data Stream Confidentiality Verification: Track the flow of sensitive data (local files, SSH configurations, business keys) during the operation of the intelligent agent, and detect and block illegal disclosures.

[0095] Intent alignment verification: By comparing the actual execution behavior of the agent with the user's original intent through semantic analysis, deviation behaviors such as permission tampering, tool abuse, and unauthorized operations are identified.

[0096] In this embodiment, a lightweight deployment of the trusted security middleware is pre-completed within the agent environment (single-command installation, no source code intrusion). During agent operation, the middleware monitors in real-time requests initiated by the agent to the LLM and responses / tool ​​invocation instructions returned by the LLM. For each critical action the agent is about to perform (such as executing system commands, reading / writing files, initiating network requests, and accessing internal APIs), the middleware executes sequentially: Control flow verification: Compare the current execution path with the preset valid control flow graph to check for illegal jumps or memory tampering.

[0097] Data flow verification: Analyze whether the data involved in the analysis is a sensitive asset and determine whether its flow violates security policies.

[0098] Intent alignment validation: Evaluate whether the current behavior aligns with the expected goal based on the user's original input and the context of the historical dialogue.

[0099] If any validation fails, the middleware immediately blocks the behavior, records a risk log, and can optionally report it to the alarm system; if all validations pass, the behavior is allowed to proceed, permitting the agent to continue execution. The entire validation process is designed in both asynchronous and synchronous modes, with response time controlled within hundreds of milliseconds, ensuring no impact on normal user experience.

[0100] Understandably, this step extends security defense from "static detection" to "real-time runtime protection," forming a defense-in-depth system. It effectively intercepts emerging runtime threats that static analysis cannot cover, such as zero-day attacks, dynamic penetration payloads, memory-based poisoning, and tool abuse. Through non-intrusive deployment, it significantly reduces the barrier to entry and compatibility costs of integrating security capabilities into the intelligent agent environment, while maintaining extremely high protection efficiency, providing continuous and proactive operational security assurance for the intelligent agent supply chain.

[0101] This application discloses a method and related equipment for intelligent agent supply chain security detection, relating to the field of data processing technology. In contrast to existing supply chain security detection technologies, which are primarily designed for traditional pure code assets and rely on regular expression matching, AST parsing, or static rule scanning, these technologies can only identify malicious features at the code level and cannot perform semantic-level security auditing of natural language prompts. This results in a very high false negative rate for novel semantic attack methods such as prompt injection, role hijacking, and system instruction overwriting. Attackers can bypass detection through carefully crafted prompt instructions, inducing intelligent agents to perform unauthorized operations or leak sensitive data. In this application, firstly, in response to a security detection instruction, a hybrid structure plugin containing natural language instructions and executable code is obtained. Then, content structure extraction is performed on the hybrid structure plugin to obtain standardized detection data. The standardized detection data includes at least natural language instruction fragments and code fragments. Further, based on a preset large model, multi-dimensional semantic threat judgment is performed on the standardized detection data to generate risk judgment results. Finally, based on the risk judgment results, security verification is performed on the intelligent agent's behavior through a trust security middleware pre-deployed between the intelligent agent and the large language model.

[0102] Understandably, this application performs structured extraction of hybrid-structured plugins to obtain standardized detection data. Based on a pre-set large model, it analyzes the standardized detection data from multiple dimensions and combines it with a trusted security middleware to perform security verification on the intelligent agent's behavior, thereby achieving secure detection of the intelligent agent supply chain.

[0103] Based on the first embodiment of this application, in the second embodiment of this application, the content that is the same as or similar to that in Embodiment 1 above can be referred to the above description, and will not be repeated hereafter. Based on this, please refer to... Figure 2 Following the step of generating the risk assessment result, steps A10 to A40 are also included: Step A10: Extract the unique feature value of plugins with malicious or suspicious risks, and periodically match the unique feature value with the enterprise's internal asset database to identify internally introduced nodes; It should be noted that a unique feature value refers to a combination of attributes extracted from plugins judged to be malicious or RISKY that can uniquely identify the plugin, such as plugin name, version number, publisher identifier, file hash value, core code fragment fingerprint, etc. This feature value is used for precise matching across different systems.

[0104] An enterprise internal asset database refers to a database built by the enterprise to record information about all Skills / MCP plugins that have been introduced into the internal office network and production environment. It typically includes fields such as plugin name, device introduced, introduction time, and frequency of use.

[0105] Periodic matching refers to automatically performing feature value comparison tasks at preset time intervals (such as hourly or daily), matching the unique feature value of external risk plugins with the plugin records in the internal asset database one by one.

[0106] Internally introduced nodes refer to specific terminal devices, servers, business system instances, or intelligent agent operating environments within an enterprise that have introduced or used the risk plugin.

[0107] In this embodiment, after generating the risk assessment result in step S30, unique feature values ​​(such as plugin ID, name, and key content hash) are extracted from plugins identified as MALICIOUS or RISKY. The system initiates a matching task at a set period, cross-referencing the extracted unique feature values ​​with plugin records in the established internal asset database. The matching rules support exact matching (e.g., identical names) and fuzzy matching (e.g., name similarity threshold) to address plugin version differences or naming variations. Upon successful matching, the matched internal asset entries are recorded, including device identifier, business system name, and introduction time, forming an internal introduction node list. If the matching fails (i.e., the plugin has not yet been introduced internally), only external risks are marked, without triggering internal handling procedures.

[0108] Understandably, this step achieves a precise mapping between external risk plugins and internal actual assets. Through periodic matching, it can dynamically discover which internal devices have introduced newly released malicious plugins, providing a target list for subsequent precise handling and avoiding blind full scanning or missing high-risk nodes.

[0109] Step A20: Based on the precise counting operator, calculate in real time the number of times the plug-in with malicious or suspicious risks is referenced in the enterprise's internal devices and business systems to generate a risk impact quantification report. It should be noted that the precise counting operator refers to a dedicated calculation logic that can perform deduplication statistics or precise counting on specific plugin fields (such as plugin names) in the internal asset library, filtering out duplicate, invalid, or noisy data generated in the test environment, and retaining only valid reference records.

[0110] The number of references refers to the total number of times the same risk plugin is actually loaded or recorded in different devices, business systems, and agent instances within an enterprise, reflecting the breadth of risk diffusion.

[0111] A risk impact quantification report is a structured document that includes indicators such as the name of the risk plugin, risk level, total number of internal references, list of affected devices (or quantity distribution), first introduction time, and most recent active time, used to support emergency response decisions.

[0112] In this embodiment, based on the list of internally introduced nodes obtained in step A10, a precise counting operator is invoked. The operator processes the records in the list: deduplication, filtering, and aggregation. The reference count of each risk plugin is calculated in real time. The calculation results are combined with the plugin's basic information and risk details to generate a risk impact quantification report, which supports tabular or JSON format output.

[0113] Understandably, this step transforms the abstract "risk plugin" into a quantifiable "internal exposure surface," enabling the security team to clearly understand the actual scale of threat spread. By filtering noisy data using precise counting operators, misjudgments caused by testing environments, repeated installations, etc., are avoided. The quantified report provides an objective basis for subsequent work order prioritization and emergency response resource allocation.

[0114] Step A30: If the risk assessment result is malicious and the number of references is greater than zero, an emergency response work order containing the threat type and risk details is automatically generated. It should be noted that the malice level refers to the MALICIOUS tag determined in step S30, which means that the plugin explicitly contains high-risk attack payloads or serious violations.

[0115] An emergency response work order is an automatically generated task document used to trigger an enterprise's internal emergency response process. It typically includes the threat type, risk details, security score, source tracing link, handling recommendations, and responsible person information.

[0116] Threat type refers to the attack category summarized from the detection results of steps S31 to S34, such as RCE, supply chain poisoning, prompt injection, data theft, etc.

[0117] Risk details refer to specific evidence, including the line number of the code that triggered the risk, the original text of the malicious instruction, the sensitive paths or URLs involved, and the confidence level of the large model's determination.

[0118] In this embodiment, the system determines whether the risk assessment result output in step S30 is at the MALICIOUS level. Simultaneously, it determines whether the citation count calculated in step A20 is greater than zero (i.e., there are indeed affected nodes internally). When both conditions are met, the emergency response ticket generation process is automatically triggered. Threat type, risk details, security score (if any), and source tracing link (pointing to the plugin source address or internal asset record) are extracted from the detection results. The Lark Open API is called to automatically populate the above information into a preset ticket template, generating an emergency response ticket containing handling recommendations. The ticket is automatically pushed to the security manager and operations personnel, and a tracking record is created simultaneously.

[0119] Understandably, this step achieves a fully automated closed loop from risk discovery to response triggering, effectively avoiding false alarms or ineffective interference from low-risk plugins. The automatic generation and push of emergency response tickets significantly shortens threat detection and response time (MTTD / MTTR).

[0120] Step A40: After converting the risk assessment results, the risk impact quantification report, and the emergency response work order into a unified standard Parquet format, store them in a distributed file system cluster to build a data warehouse.

[0121] It should be noted that Parquet format is a columnar data file format with features such as high compression ratio, efficient query performance, and support for complex nested structures, and is widely used in big data analysis scenarios.

[0122] A distributed file system cluster refers to a distributed storage system such as HDFS (Hadoop Distributed File System) that can store large amounts of data across multiple servers, supporting high-throughput data read and write and fault tolerance.

[0123] A data warehouse is an offline analytical database built on the aforementioned persistent data. It supports organization by time partitioning, ecosystem partitioning (ClawHub / Smithery), and risk level partitioning, and is used for long-term security posture analysis and trend mining.

[0124] In this embodiment, three types of data (risk assessment results, risk impact quantification reports, and emergency response work order records) from each plugin detection cycle are integrated to form a complete detection event record. A data conversion module is used to convert the records from JSON / structured objects to Parquet format, and compression encoding (such as Snappy or ZSTD) is applied to save storage space. The converted Parquet files are written to a distributed file system cluster (HDFS) and stored according to preset directory partitioning rules. The system automatically creates or updates metadata, allowing the data to be directly read by analysis engines such as Hive and Spark. Based on this data, an offline data warehouse is built, supporting dynamic monitoring of plugins at the time dimension (daily / weekly / monthly), threat trend analysis (such as changes in the number of attacks at various dimensions), and vulnerability tracing (such as finding the historical occurrence records of a specific malicious plugin).

[0125] Understandably, this step provides a long-term, reliable, and analyzable data foundation for security operations. The Parquet format, combined with HDFS storage, supports low-cost storage and efficient retrieval of large-scale data. By building an offline data warehouse, enterprises can perform long-term trend analysis that was previously impossible (such as quarterly increases in malicious plugin numbers or the evolution of certain attack methods), providing data support for security strategy optimization, supply chain risk prediction, and compliance auditing, thus achieving an upgrade from single-point detection to continuous situational awareness.

[0126] It should be noted that the above examples are only for understanding this application and do not constitute a limitation on the intelligent agent supply chain security detection method of this application. Any simple modifications based on this technical concept are within the protection scope of this application.

[0127] This application also provides an intelligent agent supply chain security detection device; please refer to [reference needed]. Figure 3 The intelligent agent supply chain security detection device includes: Acquisition module 10, the acquisition module is used to acquire a hybrid structure plugin containing natural language instructions and executable code in response to a security detection command; Extraction module 20, the extraction module is used to perform content structure extraction on the hybrid structure plugin to obtain standardized detection data, wherein the standardized detection data includes at least natural language instruction fragments and code fragments; The determination module 30 is used to perform multi-dimensional semantic threat determination on the standardized detection data based on a preset large model, and generate a risk determination result; Verification module 40 is used to perform security verification on the behavior of the intelligent agent based on the risk determination result, through a trust security middleware pre-deployed between the intelligent agent and the large language model.

[0128] The intelligent agent supply chain security detection device provided in this application, employing the intelligent agent supply chain security detection method in the above embodiments, can solve the technical problem of intelligent agent supply chain security detection. Compared with related technologies, the beneficial effects of the intelligent agent supply chain security detection device provided in this application are the same as those of the intelligent agent supply chain security detection method provided in the above embodiments, and other technical features in the intelligent agent supply chain security detection device are the same as those disclosed in the methods of the above embodiments, and will not be repeated here.

[0129] This application provides an intelligent agent supply chain security detection device, which includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the intelligent agent supply chain security detection method in the first embodiment described above.

[0130] The following is for reference. Figure 4 The diagram illustrates a structural schematic suitable for implementing the intelligent agent supply chain security detection device in the embodiments of this application. The intelligent agent supply chain security detection device in the embodiments of this application may include, but is not limited to, mobile terminals such as mobile phones, laptops, digital broadcast receivers, PDAs (Personal Digital Assistants), PADs (Portable Application Description), PMPs (Portable Media Players), in-vehicle terminals (e.g., in-vehicle navigation terminals), and fixed terminals such as digital TVs and desktop computers. Figure 4 The intelligent agent supply chain security detection device shown is merely an example and should not impose any limitations on the functionality and scope of use of the embodiments of this application.

[0131] like Figure 4As shown, the intelligent agent supply chain security detection device may include a processing unit 1001 (e.g., a central processing unit, a graphics processing unit, etc.), which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 1002 or a program loaded from a storage device 1003 into a random access memory (RAM) 1004. The RAM 1004 also stores various programs and data required for the operation of the intelligent agent supply chain security detection device. The processing unit 1001, ROM 1002, and RAM 1004 are interconnected via a bus 1005. An input / output (I / O) interface 1006 is also connected to the bus. Typically, the following systems can be connected to the I / O interface 1006: input devices 1007 including, for example, a touchscreen, touchpad, keyboard, mouse, image sensor, microphone, accelerometer, gyroscope, etc.; output devices 1008 including, for example, a liquid crystal display (LCD), speaker, vibrator, etc.; storage devices 1003 including, for example, magnetic tape, hard disk, etc.; and communication devices 1009. Communication device 1009 allows the intelligent agent supply chain security detection equipment to communicate wirelessly or wiredly with other devices to exchange data. While the figure shows intelligent agent supply chain security detection equipment with various systems, it should be understood that implementation or possession of all the systems shown is not required. More or fewer systems may be implemented alternatively.

[0132] Specifically, according to the embodiments disclosed in this application, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments disclosed in this application include a computer program product comprising a computer program carried on a computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via a communication device, or installed from storage device 1003, or installed from ROM 1002. When the computer program is executed by processing device 1001, it performs the functions defined in the methods of the embodiments disclosed in this application.

[0133] The intelligent agent supply chain security detection device provided in this application, employing the intelligent agent supply chain security detection method in the above embodiments, can solve the technical problems of intelligent agent supply chain security detection. Compared with related technologies, the beneficial effects of the intelligent agent supply chain security detection device provided in this application are the same as those of the intelligent agent supply chain security detection method provided in the above embodiments, and other technical features in this intelligent agent supply chain security detection device are the same as those disclosed in the method of the previous embodiment, and will not be repeated here.

[0134] It should be understood that the various parts disclosed in this application can be implemented using hardware, software, firmware, or a combination thereof. In the description of the above embodiments, specific features, structures, materials, or characteristics can be combined in any suitable manner in one or more embodiments or examples.

[0135] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

[0136] This application provides a computer-readable storage medium having computer-readable program instructions (i.e., a computer program) stored thereon, which are used to execute the intelligent agent supply chain security detection method in the above embodiments.

[0137] The computer-readable storage medium provided in this application may be, for example, a USB flash drive, but is not limited to, electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems or devices, or any combination thereof. More specific examples of computer-readable storage media may include, but are not limited to: electrical connections having one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof. In this embodiment, the computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system or device. The program code contained on the computer-readable storage medium may be transmitted using any suitable medium, including but not limited to: wires, optical cables, RF (Radio Frequency), etc., or any suitable combination thereof.

[0138] The aforementioned computer-readable storage medium may be included in the intelligent agent supply chain security detection equipment; or it may exist independently and not be assembled into the intelligent agent supply chain security detection equipment.

[0139] The aforementioned computer-readable storage medium carries one or more programs, which, when executed by the intelligent agent supply chain security detection device, cause the intelligent agent supply chain security detection device to: In response to security detection commands, obtain a hybrid plugin structure containing natural language commands and executable code; Content structure extraction is performed on the hybrid structure plugin to obtain standardized detection data, wherein the standardized detection data includes at least natural language instruction fragments and code fragments; Based on a pre-set large model, multi-dimensional semantic threat determination is performed on the standardized detection data to generate risk determination results; Based on the risk assessment results, a security verification is performed on the agent's behavior through a trust and security middleware pre-deployed between the agent and the large language model.

[0140] Computer program code for performing the operations of this application can be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, and C++, and conventional procedural programming languages ​​such as the "C" language or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network—including a Local Area Network (LAN) or a Wide Area Network (WAN)—or can be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0141] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0142] The modules described in the embodiments of this application can be implemented in software or hardware. The names of the modules do not necessarily limit the functionality of the unit itself.

[0143] The readable storage medium provided in this application is a computer-readable storage medium that stores computer-readable program instructions (i.e., a computer program) for executing the above-described intelligent agent supply chain security detection method, thereby solving the technical problem of intelligent agent supply chain security detection. Compared with related technologies, the beneficial effects of the computer-readable storage medium provided in this application are the same as those of the intelligent agent supply chain security detection method provided in the above embodiments, and will not be elaborated here.

[0144] This application also provides a computer program product, including a computer program that, when executed by a processor, implements the steps of the intelligent agent supply chain security detection method described above.

[0145] The computer program product provided in this application can solve the technical problem of intelligent agent supply chain security detection. Compared with related technologies, the beneficial effects of the computer program product provided in this application are the same as those of the intelligent agent supply chain security detection method provided in the above embodiments, and will not be repeated here.

[0146] The above description is only a part of the embodiments of this application and does not limit the scope of protection of this application. All equivalent structural transformations made under the technical concept of this application and using the content of this application specification and drawings, or direct / indirect applications in other related technical fields, are included in the scope of protection of this application.

Claims

1. A method for intelligent agent supply chain security detection, characterized in that, The intelligent agent supply chain security detection method includes: In response to security detection commands, obtain a hybrid plugin structure containing natural language commands and executable code; Content structure extraction is performed on the hybrid structure plugin to obtain standardized detection data, wherein the standardized detection data includes at least natural language instruction fragments and code fragments; Based on a pre-set large model, multi-dimensional semantic threat determination is performed on the standardized detection data to generate risk determination results; Based on the risk assessment results, a security verification is performed on the agent's behavior through a trust and security middleware pre-deployed between the agent and the large language model.

2. The intelligent agent supply chain security detection method as described in claim 1, characterized in that, Before the step of obtaining the hybrid structure plugin containing natural language instructions and executable code, the method further includes: If the plugin ecosystem is the ClawHub ecosystem, a WebSocket long connection channel is built based on Convex Cloud cloud service to monitor incremental plugin updates in real time. If an incremental plugin update occurs, the plugin in compressed package format is downloaded through a dedicated application programming interface. The downloaded compressed package format plugin is then transferred to an isolated local sandbox for decompression. The isolated local sandbox adopts process isolation and file system read-only strategy. If the plugin ecosystem is the Smithery ecosystem, a standard HTTP polling mechanism is used to simulate CLI tool requests to quickly obtain plugin metadata. Based on the plugin metadata, the built-in repository address resolver dynamically converts the repository address into a raw file direct link URI. Based on the raw file direct link URI, the plugin's core markup language document is downloaded at high speed.

3. The intelligent agent supply chain security detection method as described in claim 1, characterized in that, The step of performing content structure extraction on the hybrid structure plugin further includes: The markup language document of the hybrid structure plugin is split to extract the natural language instruction fragments; Extract the code snippets written in different programming languages ​​from the markup language document, wherein the programming languages ​​include object-oriented languages, scripting languages, and command-line languages; Extract the dependency information declared in the markup language document; Extract the Uniform Resource Locator (URL) links contained in the markup language document.

4. The intelligent agent supply chain security detection method as described in claim 3, characterized in that, The step of performing multi-dimensional semantic threat determination on the standardized detection data further includes: The code snippet is subjected to risk semantic recognition of high-risk command execution and unauthorized operation in order to detect system-level high-risk function calls and sensitive path access behaviors; The code snippet is subjected to risk semantic recognition of supply chain poisoning in order to detect fileless attack instructions and unexpected third-party dependency installation behavior; The natural language command fragments are subjected to prompt word injection and jailbreak risk semantic recognition to detect malicious commands that hijack roles and bypass security restrictions; The system performs risk semantic recognition of data theft and covert communication on the Uniform Resource Locator (URL) links to detect the outgoing of sensitive data to untrusted network addresses.

5. The intelligent agent supply chain security detection method as described in claim 4, characterized in that, The step of performing security verification on the behavior of the intelligent agent through a pre-deployed trust and security middleware between the intelligent agent and the large language model further includes: Based on the aforementioned trust security middleware, the execution control flow graph of the intelligent agent is dynamically constructed to verify the legitimacy of key behavioral nodes and intercept execution process hijacking. Based on the aforementioned trust security middleware, a data asset security level marking system is established to track the flow of sensitive data in real time and intercept illegal data leakage. Based on the aforementioned trust security middleware, deep semantic analysis is performed to compare the agent's execution behavior with the user's original intent and to intercept unauthorized operations. Based on the aforementioned trust security middleware, security analysis is performed in both asynchronous and synchronous modes to achieve real-time identification and mitigation of runtime risks.

6. The intelligent agent supply chain security detection method as described in claim 4, characterized in that, Following the step of generating the risk assessment result, the method further includes: Extract the unique feature value of plugins with malicious or suspicious risks, and periodically match the unique feature value with the enterprise's internal asset database to identify internally introduced nodes; Based on precise counting operators, the number of times the malicious or suspicious plug-in is referenced in the enterprise's internal devices and business systems is calculated in real time to generate a quantitative report on the risk impact. If the risk assessment result is malicious and the number of references is greater than zero, an emergency response work order containing the threat type and risk details will be automatically generated. After converting the risk assessment results, the risk impact quantification report, and the emergency response work order into a unified standard Parquet format, they are stored in a distributed file system cluster to build a data warehouse.

7. A smart agent supply chain security detection device, characterized in that, The intelligent agent supply chain security detection device includes: The acquisition module is used to acquire a hybrid structure plugin containing natural language instructions and executable code in response to a security detection command. An extraction module is used to perform content structure extraction on the hybrid structure plugin to obtain standardized detection data, wherein the standardized detection data includes at least natural language instruction fragments and code fragments; The determination module is used to perform multi-dimensional semantic threat determination on the standardized detection data based on a preset large model, and generate a risk determination result. The verification module is used to perform security verification on the behavior of the agent based on the risk assessment result, through a trust and security middleware pre-deployed between the agent and the large language model.

8. A smart agent supply chain security detection device, characterized in that, The device includes: a memory, a processor, and a computer program stored in the memory and executable on the processor, the computer program being configured to implement the steps of the intelligent agent supply chain security detection method as described in any one of claims 1 to 6.

9. A storage medium, characterized in that, The storage medium is a computer-readable storage medium, and a computer program is stored on the storage medium. When the computer program is executed by a processor, it implements the steps of the intelligent agent supply chain security detection method as described in any one of claims 1 to 6.

10. A computer program product, characterized in that, The computer program product includes a computer program that, when executed by a processor, implements the steps of the intelligent agent supply chain security detection method as described in any one of claims 1 to 6.

Images