supply-chain-security Skill
Activate when reviewing or modifying dependency resolution, lockfile schema, package downloaders, signature/integrity checks, file integration cleanup, or anything that could expose APM to dependency confusion, typosquatting, malicious packages, or token leakage. Published by microsoft in apm.
Decision snapshot
Is this a fit?
Security review, Writing, Includes SKILL.md, Reusable instructions
Compatibility not yet detected.
Permission behavior not yet detected.
Copy skill directory
2 months ago · MIT license
No specific cautions were detected. Review the source and requested permissions before installing.
What is supply-chain-security Skill?
Activate when reviewing or modifying dependency resolution, lockfile schema, package downloaders, signature/integrity checks, file integration cleanup, or anything that could expose APM to dependency confusion, typosquatting, malicious packages, or token leakage. Published by microsoft in apm. This profile combines repository metadata with install, compatibility, and usage signals so developers can quickly decide whether it fits their agent workflow before opening the source repository.
Automated repository signals based on public metadata such as recency, license, installation evidence, and adoption. These are not a security audit or endorsement. See how SkillIndex evaluates profiles.
Key capabilities
- Includes SKILL.md support
- Reusable instructions support
- Security review
- Writing
- Security review use cases
- Writing use cases
Declared skill metadata
- Source file: .apm/skills/supply-chain-security/SKILL.md
These fields retain source and confidence evidence from the indexed SKILL.md.
Compatibility and setup
- Install or run with Copy skill directory
When to use supply-chain-security Skill
- Use it for security review.
- Use it for writing.
Built with
Editorial notes
Source
- Creator: microsoft
- Repository: microsoft/apm
- Skill file: .apm/skills/supply-chain-security/SKILL.md
What it does
Activate when reviewing or modifying dependency resolution, lockfile schema, package downloaders, signature/integrity checks, file integration cleanup, or anything that could expose APM to dependency confusion, typosquatting, malicious packages, or token leakage.
Skill instructions
Supply Chain Security Skill Supply chain security expert persona When to activate - Changes under src/apmcli/deps/ (resolver, lockfile, downloaders) - Changes to src/apmcli/core/auth.py or tokenmanager.py - Changes to src/apmcli/integration/cleanup.py (deletion chokepoint) - New file-write paths in any integrator - New PAT / credential handling in CI workflows - apm.lock schema changes - Any code that fetches, verifies, or executes content from a remote source Key rules - All path construction routes through src/apmcli/utils/pathsecurity.py (no ad-hoc ".." in x). - All deletions of deployed files route through integration/cleanup.py:removestaledeployedfiles() (3 safety gates). - All credential reads route through AuthResolver -- never raw os.getenv for token vars. - Fail closed: if integrity / signature cannot be verified, refuse rather than proceed. - Token values must never appear in user-facing strings.
Verified compatibility and discovery
Frequently asked questions
What is supply-chain-security?
supply-chain-security is a open-source AI agent skill with Copy skill directory. Activate when reviewing or modifying dependency resolution, lockfile schema, package downloaders, signature/integrity checks, file integration cleanup, or anything that could expose APM to.
Who is supply-chain-security best for?
supply-chain-security is best for reusing agent instructions, scripts, and references, security review workflows, writing workflows.
How do I install supply-chain-security?
Install or run supply-chain-security using Copy skill directory. Check supply-chain-security for the latest setup command.
Is supply-chain-security actively maintained?
supply-chain-security may need a closer maintenance check before production use.
Project health auto-fetched from the source repository.
Maintain this resource?
Review this source-backed profile, send a correction with evidence, or link to it from your documentation. Claims verify your relationship to the project; profile facts still require source evidence and editorial review.
