supply-chain-security Skill
Activate when reviewing or modifying dependency resolution, lockfile schema, package downloaders, signature/integrity checks, file integration cleanup, or anything that could expose APM to dependency confusion, typosquatting, malicious packages, or token leakage. Published by microsoft in apm.
What is supply-chain-security Skill?
Activate when reviewing or modifying dependency resolution, lockfile schema, package downloaders, signature/integrity checks, file integration cleanup, or anything that could expose APM to dependency confusion, typosquatting, malicious packages, or token leakage. Published by microsoft in apm. This profile combines repository metadata with install, compatibility, and usage signals so developers can quickly decide whether it fits their agent workflow before opening the source repository.
Automated repository signals based on public metadata such as recency, license, installation evidence, and adoption. These are not a security audit or endorsement.
Key capabilities
- Includes SKILL.md support
- Reusable instructions support
- Security review
- Writing
- Security review use cases
- Writing use cases
Technical details
- Install or run with Copy skill directory
When to use supply-chain-security Skill
- Use it for security review.
- Use it for writing.
Built with
Editorial notes
Source
- Creator: microsoft
- Repository: microsoft/apm
- Skill file: .apm/skills/supply-chain-security/SKILL.md
What it does
Activate when reviewing or modifying dependency resolution, lockfile schema, package downloaders, signature/integrity checks, file integration cleanup, or anything that could expose APM to dependency confusion, typosquatting, malicious packages, or token leakage.
Skill instructions
Supply Chain Security Skill Supply chain security expert persona When to activate - Changes under src/apmcli/deps/ (resolver, lockfile, downloaders) - Changes to src/apmcli/core/auth.py or tokenmanager.py - Changes to src/apmcli/integration/cleanup.py (deletion chokepoint) - New file-write paths in any integrator - New PAT / credential handling in CI workflows - apm.lock schema changes - Any code that fetches, verifies, or executes content from a remote source Key rules - All path construction routes through src/apmcli/utils/pathsecurity.py (no ad-hoc ".." in x). - All deletions of deployed files route through integration/cleanup.py:removestaledeployedfiles() (3 safety gates). - All credential reads route through AuthResolver -- never raw os.getenv for token vars. - Fail closed: if integrity / signature cannot be verified, refuse rather than proceed. - Token values must never appear in user-facing strings.
Explore related resources
Frequently asked questions
What is supply-chain-security?
supply-chain-security is a open-source AI agent skill with Copy skill directory. Activate when reviewing or modifying dependency resolution, lockfile schema, package downloaders, signature/integrity checks, file integration cleanup, or anything that could expose APM to.
Who is supply-chain-security best for?
supply-chain-security is best for reusing agent instructions, scripts, and references, security review workflows, writing workflows.
How do I install supply-chain-security?
Install or run supply-chain-security using Copy skill directory. Check supply-chain-security for the latest setup command.
Is supply-chain-security actively maintained?
supply-chain-security may need a closer maintenance check before production use.
Auto-fetched from GitHub.
