Instance binding and runtime overreach blocking method for agent SKILL supply chain

Abstract

The application relates to an instance binding and runtime overreach blocking method of an intelligent agent SKILL supply chain. A to-be-released or to-be-used Skill package is parsed to generate a Skill list with a mode version; a file, a permission declaration and a dependency relationship are summarized to form a to-be-signed object; the to-be-signed object is signed by a publisher using a PKI certificate private key and is associated with release. Before installation, loading or execution, the signature, the certificate state, the summary, the version continuity, the release source and the trust policy are verified to generate verification evidence; the access control result is generated by combining the source level, the declared permission, the target tool, the data classification and the task risk, and the access control result is bound with the instance identification. In the runtime, actual tool calling is checked and compared with constraints, and if the actual tool calling exceeds the constraints, the instance is rejected and isolated; meanwhile, the release, verification, calling and disposal results are written into the same action chain, and when the certificate, version, dependency risk or trust policy changes, the related evidence and instance are invalidated.

Description

Technical Field

[0001] This invention relates to the fields of intelligent agent security, software supply chain security, PKI and runtime access control, and more specifically, to an instance binding and runtime privilege escalation prevention method for intelligent agent SKILL supply chain. Background Technology

[0002] A skill typically includes a prompt template, executable code, tool declarations, permission declarations, dependencies, and configuration files. Skills may be distributed through public repositories, enterprise repositories, or third-party channels. If the publisher's identity, content integrity, and dependency sources cannot be verified, malicious content can enter the agent's execution environment along with the skill.

[0003] Traditional package signing can verify file origin and integrity, but a valid signature alone cannot determine whether the capabilities declared in the Skill, the permissions requested, and the actual execution behavior are consistent with the current task. On the other hand, setting access control only during the installation or loading phase can still be circumvented by local replacement, cache pollution, path bypass, or direct invocation of runtime components. Summary of the Invention

[0004] The technical problem to be solved by this invention is to provide an instance binding and runtime privilege escalation blocking method for the SKILL supply chain of an intelligent agent. The method intercepts actual tool calls at runtime and directly rejects them when signature, certificate or binding fails. After successful verification, the access scope is narrowed according to the Skill's declared capabilities and task intent, thereby preventing Skill poisoning, post-verification replacement and access control bypass.

[0005] The technical solution adopted by this invention to solve its technical problem is: constructing an instance binding and runtime privilege escalation prevention method for an intelligent agent SKILL supply chain, including the following steps: S1. Receive Skill packages to be published or used, parse the prompt templates, executable code, tool declarations, permission declarations, dependencies, versions, release sources and update channels, normalize the tool declarations and permission declarations into capability constraint tuples and generate a Skill list with pattern versions; S2. Calculate the Skill component file digest, permission declaration digest, and dependency relationship digest using a cryptographic hash algorithm, and generate a tree root digest that can locate a single component object. Combine the digest, cryptographic hash algorithm identifier, Skill identifier, version, publisher identity, source proof, and validity period into a to-be-signed object. S3. The Skill publisher uses the private key corresponding to its PKI certificate to digitally sign the object to be signed, and associates the signature value, signature certificate identifier, certificate chain reference, algorithm identifier, and timestamp with the Skill package and publishes it. S4. Before the Skill is installed, loaded, or executed, verify the Skill signature, certificate chain, certificate status, timestamp, content digest, dependency digest, version continuity, release source, publisher's release permissions for the Skill namespace or tenant identifier, and local Skill trust policy, and generate a verification evidence object with verification time, verification policy version, and expiration conditions. S5. The AI ​​security access control system generates at least one access control result from among the following: allow, restrict permissions, isolate execution, supplementary verification, or deny, based on the verification evidence object, Skill source level, declared permissions, target tool, data classification, and current task risk. S6. Bind the Skill content summary, verification evidence summary, access control result, agent identifier, workload identifier, and Skill running instance identifier, and have the runtime control node verify the binding relationship and verification status before each tool call; S7. Obtain the actual tool call initiated by the Skill running instance. First, verify the Skill signature, certificate status, verification evidence, and instance binding. If any necessary verification fails, reject the call directly and do not upgrade it from intent judgment to allow. After the necessary verification passes, convert the actual tool call into an actual call constraint tuple according to the mode version of the Skill manifest. Determine whether the tool and interface version, operation, resources, parameters, data level, number of calls or order, and side effects are all within the boundaries of the Skill capability constraint tuple, the current task intent, and the allowed resources. If any necessary field is unknown or exceeds any boundary, reject the call and isolate the corresponding Skill running instance. S8. Write Skill release, verification, access control, instance binding, actual invocation, rejection or isolation results into the same action chain, and invalidate relevant verification evidence and running instances when certificate is revoked, Skill version changes, dependency risk changes or trust policy changes.

[0006] According to the above scheme, in step S1, the capability constraint tuple includes tool identifier and interface version, operation type, resource path mode, parameter mode, data level, number of calls or order, and side effect flag.

[0007] According to the above scheme, in step S1, the Skill list includes a prompt template, executable code, tool declaration, permission declaration, dependencies, version and release source, and records the list mode version.

[0008] According to the above scheme, in step S2, the dependency summary is generated based on the software bill of materials or equivalent dependency list, and direct dependencies and transitive dependencies are identified respectively.

[0009] According to the above scheme, in step S5, the AI ​​security access control generates a rejection or isolation result for Skills with invalid signatures, unknown certificate status, untrusted publishing sources, or declared permissions exceeding the policy limit.

[0010] According to the above scheme, in step S5, when a Skill instance that has not passed the AI ​​security gate is detected, the runtime control node first rejects its tool call or restricts it to an isolated execution environment without external side effects; signature, certificate status, verification evidence, or instance binding failures must not be caused by intention. Figure 1 The consistency check is upgraded to allow, while the intent check is only used to further narrow down or reject calls that have already passed the necessary password verification.

[0011] According to the above scheme, in step S6, the instance binding relationship includes Skill content summary, verification evidence summary, agent identifier, workload identifier, running instance identifier, policy version, and validity period.

[0012] According to the above scheme, in step S7, the consistency determination is based on the list pattern version, which standardizes the actual tool call into an actual call constraint tuple containing tool identifier and interface version, operation type, resource path, parameter value, data level, call count or order and side effect flag; set type fields use inclusion relationship, path type fields use resource path pattern matching, parameter fields use type and value range comparison, and call count or order uses counter or state machine comparison. A rejection result is generated when any required field is missing, cannot be parsed, or does not meet the constraints.

[0013] According to the above scheme, in step S8, the publisher's digital signature and verification are completed by the cryptographic service and implemented based on classical cryptographic algorithms such as SM2, RSA, and ECC, as well as post-quantum algorithms; the Skill component file digest, permission declaration digest, dependency digest, and tree root digest are calculated using a cryptographic hash algorithm, and the cryptographic hash algorithm identifier is included in the object to be signed.

[0014] This invention also provides a signature verification, instance binding, and runtime privilege escalation prevention system for the smart agent SKILL supply chain, comprising: The Skill List Generator module is used to parse the components of a Skill and generate a list with pattern versions and permission declarations. The output data includes object identifiers, generation time, pattern versions, and source identifiers for subsequent modules to verify and associate. The digest and source verification service module is used to calculate file, permission and dependency digests and form source verification. The output data includes object identifier, generation time, mode version and source identifier, which are used for subsequent modules to verify and associate. The PKI signing and verification service module is used to sign and verify certificate chains, states, timestamps, and algorithm policies using publisher certificates. The output data includes object identifiers, generation times, mode versions, and source identifiers for subsequent modules to verify and associate.

[0015] The AI ​​security access control module is used to generate access control results based on verification evidence, source, permissions and task risks. The output data includes object identifier, generation time, mode version and source identifier, which are used for subsequent modules to verify and associate. The instance binding and runtime controller module is used to bind verification evidence to the running instance and perform necessary password verification and unauthorized boundary judgment before each tool call. The output data includes object identifier, generation time, mode version and source identifier, which are used for subsequent module verification and association. The Action Chain and Failure Service module is used to store evidence of publication, verification, access control, retrieval and isolation and to propagate failure events. The output data includes object identifier, generation time, mode version and source identifier, which are used for subsequent modules to verify and associate. The PKI signature and verification service module includes CA, RA, OCSP, CRL, trusted timestamp service, HSM, cryptographic machine or key management system. The publisher certificate is used to verify the source of the Skill, and the certificate status and algorithm policy are used to control the validity of the verification evidence. The publisher digital signature and verification are implemented based on classical cryptographic algorithms such as SM2, RSA, and ECC as well as post-quantum algorithms. The Skill component file digest, permission statement digest, dependency digest, and tree root digest are calculated using a cryptographic hash algorithm. The cryptographic hash algorithm identifier is incorporated into the object to be signed and the verification evidence to support algorithm identification and transfer.

[0016] The instance binding and runtime privilege escalation prevention method for the intelligent agent SKILL supply chain implemented in this invention has the following beneficial effects: 1. This invention verifies Skill prompts, code, tools, permissions, and dependencies as a single signature object, reducing the risk of replacement and dependency poisoning during distribution; it incorporates publisher certificates, certificate status, and source proof into access control judgments, demonstrating the capabilities of PKI vendors in identity, signature, and lifecycle management; it binds verification evidence to specific agents, workloads, and Skill execution instances to prevent replacement or cross-instance reuse after verification; even if the installation or loading access control is bypassed, the runtime can still reject unreasonable tool calls based on Skill declarations and task intents, forming mutually independent secondary control. 2. This invention uses the current task intent obtained through other access control links as the dynamic narrowing boundary at runtime; the task intent can only further restrict tool calls that have passed the necessary password verification, and cannot upgrade signature, certificate status or instance binding verification failure to allow, bind the Skill supply chain verification result to the specific running instance, and perform a consistency comparison of Skill declared capabilities, current task intent and actual tool calls at runtime, so that signature access control and intent control form two independent security controls; 3. This invention forms a verifiable signature object for Skill content, publisher, dependencies, and permission declarations, which is determined by the AI ​​security access control before installation, loading, or execution. When the access control is bypassed or the verification status changes, the runtime control node first performs necessary password verification, and then uses the Skill declaration capabilities and the current task intent as the permission boundary to reject unauthorized calls. The task intent is only used for further permission restriction and does not upgrade password verification failure to permission. Attached Figure Description

[0017] The present invention will be further described below with reference to the accompanying drawings and embodiments. In the accompanying drawings: Figure 1 This is a structural diagram of the signature verification, instance binding, and runtime privilege escalation prevention system of the intelligent agent SKILL supply chain of this invention; Figure 2 This is a flowchart of the instance binding and runtime privilege escalation blocking method for the intelligent agent SKILL supply chain of the present invention. Detailed Implementation

[0018] To provide a clearer understanding of the technical features, objectives, and effects of the present invention, specific embodiments of the present invention will now be described in detail with reference to the accompanying drawings.

[0019] Skill packages, skill lists, and source declarations are all subject to verification. Signature and certificate status are confirmed by the PKI signing and verification service. Publishing permissions and trusted sources are confirmed by the Skill registry and local trust policies. Dependency risks are confirmed by the SBOM and dependency repository status. Actual tool calls are collected by the runtime control node. If any necessary password verification, source verification, or instance binding fails, the AI ​​security access control or runtime control node refuses to call or switches to isolation analysis without external side effects. Only after all necessary verifications pass will the task intent serve as the boundary for further narrowing permissions.

[0020] like Figure 1-2 As shown, the method for instance binding and runtime privilege escalation prevention in the intelligent agent SKILL supply chain of the present invention includes the following steps: S1. Receive Skill packages to be published or used, parse the prompt templates, executable code, tool declarations, permission declarations, dependencies, versions, release sources, and update channels, normalize the tool declarations and permission declarations into capability constraint tuples, and generate a Skill list with pattern versions.

[0021] A capability constraint tuple must include at least the tool identifier and interface version, operation type, resource path pattern, parameter pattern, data level, number or order of invocation, and side effect flags. The Skill list uses a defined field order and pattern version, and the prompt template, executable code, tool declaration, permission declaration, dependencies, and update channels are all included in the list as content summaries or controlled references.

[0022] S2. Use a cryptographic hash algorithm to calculate the Skill component file digest, permission declaration digest, and dependency relationship digest respectively, and generate a tree root digest that can locate individual component objects. Combine the digest, cryptographic hash algorithm identifier, Skill identifier, version, publisher identity, source proof, and validity period into a to-be-signed object.

[0023] The tree-structured root digest allows for the generation of inclusion proofs for individual Skill component objects; permission declarations and dependencies are computed separately, avoiding the omission of semantically critical fields by only verifying the compressed package shell. The dependency digest is generated based on the Software Bill of Materials (SBOM) or equivalent dependency list, and direct dependencies and transitive dependencies are identified separately.

[0024] S3. The Skill publisher uses the private key corresponding to its PKI certificate to digitally sign the object to be signed, and associates the signature value, signature certificate identifier, certificate chain reference, algorithm identifier, and timestamp with the Skill package and publishes it.

[0025] The publisher signature covers the Skill identifier, version, root digest, permission digest, dependency digest, source proof digest, and validity period, while the trusted timestamp covers the signature value.

[0026] S4. Before the Skill is installed, loaded, or executed, verify the Skill signature, certificate chain, certificate status, timestamp, content digest, dependency digest, version continuity, release source, publisher's release permissions for the Skill namespace or tenant identifier, and local Skill trust policy, and generate a verification evidence object with verification time, verification policy version, and expiration conditions.

[0027] The verification service simultaneously checks the authenticity of the signature, certificate chain, certificate status, algorithm policy, timestamp, version continuity, source policy, publisher's publishing permissions for the Skill namespace or tenant identifier, and dependency risks; if any necessary status is unknown, no allowed result is generated.

[0028] S5. The AI ​​security access control system generates at least one access control result based on the verification evidence object, Skill source level, claimed permissions, target tool, data classification, and current task risk, including allow, restrict permissions, isolate execution, supplementary verification, or deny.

[0029] AI-powered security access control uses deterministic fields to process verification results, source level, claimed permissions, target tools, data classification, and task risks. Model judgments are only used as supplementary attributes and do not override signature or policy failures. AI-powered security access control generates rejection or isolation results for Skills with invalid signatures, unknown certificate status, untrusted publishing sources, or claimed permissions exceeding policy limits.

[0030] When a Skill instance running without passing the AI ​​security gate is detected, the runtime control node first rejects its tool calls or restricts it to an isolated execution environment without external side effects; failures in signature verification, certificate status verification, evidence verification, or instance binding are not allowed. Figure 1 The consistency check is upgraded to allow, while the intent check is only used to further narrow down or reject calls that have already passed the necessary password verification.

[0031] S6. Bind the Skill content summary, verification evidence summary, access control result, agent identifier, workload identifier, and Skill running instance identifier, and have the runtime control node verify the binding relationship and verification status before each tool call.

[0032] Instance binding objects are signed by trusted control nodes or stored in a protected state repository. Each tool call verifies the content digest, evidence digest, and instance identifier to prevent replacement after loading. Instance binding relationships include Skill content digest, verification evidence digest, agent identifier, workload identifier, running instance identifier, policy version, and validity period.

[0033] S7. Obtain the actual tool call initiated by the Skill running instance. First, verify the Skill signature, certificate status, verification evidence, and instance binding. If any necessary verification fails, reject the call directly and do not upgrade it from intent judgment to allow. After the necessary verification passes, convert the actual tool call into an actual call constraint tuple according to the mode version of the Skill manifest. Determine whether the tool and interface version, operation, resources, parameters, data level, number of calls or order, and side effects are all within the boundaries of the Skill capability constraint tuple, the current task intent, and the allowed resources. If any necessary field is unknown or exceeds any boundary, reject the call and isolate the corresponding Skill running instance.

[0034] Runtime privilege escalation is determined by static boundaries of the capabilities and permissions limits in the Skill list, and dynamic boundaries of the current task intent; the actual call must fall within both boundaries simultaneously. The Skill list generator and runtime control node are standardized using the same list pattern version; inclusion relationship checks are performed on set fields, pattern matching is performed on resource paths, parameter type and value range checks are performed, counters or state machines are performed on call counts or order checks, and prohibition priority checks are performed on side effect flags; failure and shutdown occur if any required field is unknown.

[0035] The consistency determination is based on the list pattern version, which standardizes the actual tool call into an actual call constraint tuple containing the tool identifier and interface version, operation type, resource path, parameter value, data level, call count or order, and side effect flag. Set-type fields use inclusion relationship, path-type fields use resource path pattern matching, parameter fields use type and value range comparison, and call count or order uses counter or state machine comparison. A rejection result is generated when any required field is missing, cannot be parsed, or does not meet the constraints.

[0036] S8. Write Skill release, verification, access control, instance binding, actual invocation, rejection or isolation results into the same action chain, and invalidate relevant verification evidence and running instances when certificate is revoked, Skill version changes, dependency risk changes or trust policy changes.

[0037] Certificate revocation, version changes, dependency risks, or changes in trust policies generate serialized invalidation events, causing verification evidence, access control results, and associated running instances to become invalid simultaneously. The publisher's digital signature and verification are performed by a cryptographic service, based on classic cryptographic algorithms such as SM2, RSA, and ECC, as well as post-quantum algorithms. The Skill component's file digest, permission declaration digest, dependency digest, and tree root digest are calculated using a cryptographic hash algorithm, and the cryptographic hash algorithm identifier is incorporated into the object to be signed. Example

[0038] An enterprise agent prepares to load a Skill for certificate status queries and secure connection configuration. The platform parses the Skill manifest, verifies the publisher certificate, content digest, SBOM, timestamp, and repository origin, and then allows it to run in an isolated execution environment (sandbox), binding the verification evidence to the agent and the running Skill instance. An attacker then bypasses the loading entry point and directly launches a replaced Skill copy, which attempts to call an undeclared key export interface. The runtime control node detects an inconsistency between the content digest and instance binding, and that the actual call exceeds the Skill's declared capabilities and the intent of the current query task; therefore, it rejects the call, isolates the instance, and logs the action chain.

[0039] When a signature is invalid, certificate status is unknown, content digest is inconsistent, dependency source is untrusted, verification evidence is missing, or instance binding is inconsistent, the system should reject Skill tool calls or only allow isolation analysis without external side effects, and should not allow access simply because the intent appears reasonable. Intent determination should only be used to further restrict actions, resources, parameters, and data ranges after the necessary password verification has passed.

[0040] This invention also provides a signature verification, instance binding, and runtime privilege escalation prevention system for an intelligent agent's SKILL supply chain, comprising: a Skill list generator module, a digest and source proof service module, a PKI signature and verification service module, an AI security access control module, an instance binding and runtime controller module, and an action chain and failure service module. The modules exchange data through interfaces with authentication and integrity protection. The system can be deployed on the same management platform, or the runtime module can be deployed closer to the intelligent agent or target resource, while the control, evidence, and management modules can be deployed on a management network.

[0041] The system comprises several modules: a Skill List Generator module, a Digest and Source Verification Service module, and an Instance Binding and Runtime Controller module. The Skill list generator parses the Skill components and generates a list with schema versions and permission declarations. The output data includes object identifiers, generation time, schema versions, and source identifiers for subsequent module verification and association. A Digest and Source Verification Service module calculates digests of files, permissions, and dependencies to generate source verifications. The PKI Signature and Verification Service module uses the publisher's certificate to sign and verify the certificate chain, status, timestamp, and algorithm policy. The output data includes object identifiers, generation time, schema versions, and source identifiers for subsequent module verification and association. An AI Security Access Control module generates access control results based on verification evidence, source, permissions, and task risks. The output data includes object identifiers, generation time, schema versions, and source identifiers for subsequent module verification and association. A Runtime Controller module binds verification evidence to running instances and performs necessary password verification and privilege escalation checks before each tool call. The output data includes object identifiers, generation time, schema versions, and source identifiers for subsequent module verification and association. The Action Chain and Failure Service module is used to store evidence of publishing, verification, access control, invocation, and isolation, and to propagate failure events. The output data includes object identifiers, generation times, mode versions, and source identifiers for subsequent module verification and association. The PKI Signature and Verification Service module includes CA, RA, OCSP, CRL, trusted timestamp service, HSM, cryptographic machines, or key management systems. The publisher certificate is used to verify the Skill's origin, and the certificate status and algorithm policy are used to control the validity of verification evidence. Publisher digital signatures and verification are implemented based on classical cryptographic algorithms such as SM2, RSA, and ECC, as well as post-quantum algorithms. The Skill's component file digest, permission statement digest, dependency digest, and root tree digest are calculated using a cryptographic hash algorithm. The cryptographic hash algorithm identifier is incorporated into the object to be signed and the verification evidence to support algorithm identification and migration.

[0042] The embodiments of the present invention have been described above with reference to the accompanying drawings. However, the present invention is not limited to the specific embodiments described above. The specific embodiments described above are merely illustrative and not restrictive. Those skilled in the art can make many other forms under the guidance of the present invention without departing from the spirit and scope of the claims. All of these forms are within the protection scope of the present invention.

Claims

1. A method for instance binding and runtime privilege escalation prevention in an intelligent agent SKILL supply chain, characterized in that, Includes the following steps: S1. Receive Skill packages to be published or used, parse the prompt templates, executable code, tool declarations, permission declarations, dependencies, versions, release sources and update channels, normalize the tool declarations and permission declarations into capability constraint tuples and generate a Skill list with pattern versions; S2. Calculate the Skill component file digest, permission declaration digest, and dependency relationship digest using a cryptographic hash algorithm, and generate a tree root digest that can locate a single component object. Combine the digest, cryptographic hash algorithm identifier, Skill identifier, version, publisher identity, source proof, and validity period into a to-be-signed object. S3. The Skill publisher uses the private key corresponding to its PKI certificate to digitally sign the object to be signed, and associates the signature value, signature certificate identifier, certificate chain reference, algorithm identifier, and timestamp with the Skill package and publishes it. S4. Before the Skill is installed, loaded, or executed, verify the Skill signature, certificate chain, certificate status, timestamp, content digest, dependency digest, version continuity, release source, publisher's release permissions for the Skill namespace or tenant identifier, and local Skill trust policy, and generate a verification evidence object with verification time, verification policy version, and expiration conditions. S5. The AI ​​security access control system generates at least one access control result from among the following: allow, restrict permissions, isolate execution, supplementary verification, or deny, based on the verification evidence object, Skill source level, declared permissions, target tool, data classification, and current task risk. S6. Bind the Skill content summary, verification evidence summary, access control result, agent identifier, workload identifier, and Skill running instance identifier, and have the runtime control node verify the binding relationship and verification status before each tool call; S7. Obtain the actual tool call initiated by the Skill running instance, first verify the Skill signature, certificate status, verification evidence, and instance binding; If any necessary verification fails, the call is rejected outright and cannot be escalated to permission based on intent judgment. If the necessary verification passes, the actual tool call is converted into an actual call constraint tuple according to the pattern version of the Skill list. Each field is checked to determine whether the tool and interface version, operation, resources, parameters, data level, number of calls or order, and side effects are all within the boundaries of the Skill capability constraint tuple, the current task intent, and the allowed resources. If any necessary field is unknown or exceeds any boundary, the call is rejected and the corresponding Skill execution instance is isolated. S8. Write Skill release, verification, access control, instance binding, actual invocation, rejection or isolation results into the same action chain, and invalidate relevant verification evidence and running instances when certificate is revoked, Skill version changes, dependency risk changes or trust policy changes.

2. The method for instance binding and runtime privilege escalation prevention in the intelligent agent SKILL supply chain according to claim 1, characterized in that, In step S1, the capability constraint tuple includes tool identifier and interface version, operation type, resource path mode, parameter mode, data level, number of calls or order, and side effect flag.

3. The method for instance binding and runtime privilege escalation prevention in the intelligent agent SKILL supply chain according to claim 2, characterized in that, In step S1, the Skill manifest includes a prompt template, executable code, tool declaration, permission declaration, dependencies, version, and release source, and records the manifest mode version.

4. The method for instance binding and runtime privilege escalation prevention in the intelligent agent SKILL supply chain according to claim 1, characterized in that, In step S2, the dependency summary is generated based on the software bill of materials or equivalent dependency list, and direct dependencies and transitive dependencies are identified respectively.

5. The method for instance binding and runtime privilege escalation prevention in the intelligent agent SKILL supply chain according to claim 1, characterized in that, In step S5, the AI ​​security access control generates rejection or isolation results for Skills with invalid signatures, unknown certificate status, untrusted publishing sources, or claimed permissions exceeding the policy limit.

6. The method for instance binding and runtime privilege escalation prevention in the intelligent agent SKILL supply chain according to claim 5, characterized in that, In step S5, when a Skill running instance that has not passed the AI ​​security gate is detected, the runtime control node first rejects its tool call or restricts it to an isolated execution environment without external side effects; signature, certificate status, verification evidence or instance binding failure shall not be upgraded from intent consistency judgment to allow, and intent judgment is only used to further narrow down or reject calls that have passed the necessary password verification.

7. The method for instance binding and runtime privilege escalation prevention in the intelligent agent SKILL supply chain according to claim 1, characterized in that, In step S6, the instance binding relationship includes Skill content digest, verification evidence digest, agent identifier, workload identifier, running instance identifier, policy version, and validity period.

8. The method for instance binding and runtime privilege escalation prevention in the intelligent agent SKILL supply chain according to claim 1, characterized in that, In step S7, the consistency determination is based on the list pattern version, which standardizes the actual tool call into an actual call constraint tuple containing tool identifier and interface version, operation type, resource path, parameter value, data level, call count or order and side effect flag. Set-type fields use inclusion relationship, path-type fields use resource path pattern matching, parameter fields use type and value range comparison, and call count or order uses counter or state machine comparison. A rejection result is generated when any required field is missing, cannot be parsed, or does not meet the constraints.

9. The method for instance binding and runtime privilege escalation prevention in the intelligent agent SKILL supply chain according to claim 1, characterized in that, In step S8, the publisher's digital signature and verification are completed by the cryptographic service and implemented based on classical cryptographic algorithms such as SM2, RSA, and ECC, as well as post-quantum algorithms. The Skill component file digest, permission declaration digest, dependency digest, and tree root digest are calculated using a cryptographic hash algorithm, and the cryptographic hash algorithm identifier is included in the object to be signed.

10. A signature verification, instance binding, and runtime privilege escalation prevention system for an intelligent agent SKILL supply chain, characterized in that, include: The Skill List Generator module is used to parse the components of a Skill and generate a list with pattern versions and permission declarations. The output data includes object identifiers, generation time, pattern versions, and source identifiers for subsequent modules to verify and associate. The digest and source verification service module is used to calculate file, permission and dependency digests and form source verification. The output data includes object identifier, generation time, mode version and source identifier, which are used for subsequent modules to verify and associate. The PKI signing and verification service module is used to sign and verify certificate chains, states, timestamps, and algorithm policies using publisher certificates. The output data includes object identifiers, generation times, mode versions, and source identifiers for subsequent modules to verify and associate. The AI ​​security access control module is used to generate access control results based on verification evidence, source, permissions and task risks. The output data includes object identifier, generation time, mode version and source identifier, which are used for subsequent modules to verify and associate. The instance binding and runtime controller module is used to bind verification evidence to the running instance and perform necessary password verification and unauthorized boundary judgment before each tool call. The output data includes object identifier, generation time, mode version and source identifier, which are used for subsequent module verification and association. The Action Chain and Failure Service module is used to store evidence of publication, verification, access control, retrieval and isolation and to propagate failure events. The output data includes object identifier, generation time, mode version and source identifier, which are used for subsequent modules to verify and associate. The PKI signature and verification service module includes CA, RA, OCSP, CRL, trusted timestamp service, HSM, cryptographic machine or key management system. The publisher certificate is used to verify the source of the Skill, and the certificate status and algorithm policy are used to control the validity of the verification evidence. The publisher digital signature and verification are implemented based on classical cryptographic algorithms such as SM2, RSA, and ECC as well as post-quantum algorithms. The Skill component file digest, permission statement digest, dependency digest, and tree root digest are calculated using a cryptographic hash algorithm. The cryptographic hash algorithm identifier is incorporated into the object to be signed and the verification evidence to support algorithm identification and transfer.

Images