SkillsAdd

microsoft/apm

supply-chain-security

>- Activate when reviewing or modifying dependency resolution, lockfile schema, package downloaders, signature/integrity checks, file integration cleanup, or anything that could expose APM to dependency confusion, typosquatting, malicious packages, or token leakage.

First seen Apr 29, 2026

Installation

$ npx skills add microsoft/apm --skill supply-chain-security
View on skills.sh ↗ GitHub repository ↗

Similar popular skills

Related neighbors and high-traction skills in the same topics — useful to compare before installing.

microsoft-foundry Same topic
microsoft/azure-skills

Build, deploy, evaluate, optimize, fine-tune, and manage Microsoft Foundry agents, models, and …

576.5K installs
azure-diagnostics Same topic
microsoft/azure-skills

Debug Azure production issues on Azure using AppLens, Azure Monitor, resource health, and safe …

568.9K installs
azure-prepare Same topic
microsoft/azure-skills

Prepare azd-based Azure projects for deployment: generates azure.yaml, infrastructure (Bicep/Te…

568.3K installs
azure-ai Same topic
microsoft/azure-skills

Use for Azure AI: Search, Speech, OpenAI, Document Intelligence. Helps with search, vector/hybr…

568.2K installs
azure-deploy Same topic
microsoft/azure-skills

Execute Azure deployments for ALREADY-PREPARED applications that have existing .azure/deploymen…

568.2K installs
azure-validate Same topic
microsoft/azure-skills

Pre-deployment validation for Azure readiness. Run deep checks on configuration, infrastructure…

567.7K installs

Also in this package

Other skills from microsoft/apm · top by installs.

npx skills add microsoft/apm
cli-logging-ux 16 apm-triage-panel 16 apm-strategy 16 python-architecture 15 apm-review-panel 15 oss-growth 14 auth 14 devx-ux 13 pr-description-skill 13 docs-sync 10

Browse all from microsoft/apm

More details

Agent compatibility

Declared targets from SKILL.md / docs. Unmarked agents are not listed — the skill may still install via the CLI.

Claude Code Not declared
Cursor Not declared
Codex Not declared
GitHub Copilot Not declared
Windsurf Not declared
Gemini CLI Not declared
Cline Not declared
OpenCode Not declared

Repository health

Stars 3.7K
License LICENSE
Default branch main
Open issues 143
Status Active

Package contents

Files included with this skill beyond the listing page.

  • skill md SKILL.md 1,361 B
  • docs SUMMARY.md 292 B

History

  1. First seen on skills.sh
  2. First recorded snapshot · 14 installs

SKILL.md

Supply Chain Security Skill

[Supply chain security expert persona](../../../.apm/agents/supply-chain-security-expert.agent.md)

When to activate

  • Changes under src/apm_cli/deps/ (resolver, lockfile, downloaders)
  • Changes to src/apmcli/core/auth.py or tokenmanager.py
  • Changes to src/apm_cli/integration/cleanup.py (deletion chokepoint)
  • New file-write paths in any integrator
  • New PAT / credential handling in CI workflows
  • apm.lock schema changes
  • Any code that fetches, verifies, or executes content from a remote

source

Key rules

  • All path construction routes through

src/apmcli/utils/pathsecurity.py (no ad-hoc ".." in x).

  • All deletions of deployed files route through

integration/cleanup.py:removestaledeployed_files() (3 safety gates).

  • All credential reads route through AuthResolver -- never raw

os.getenv for token vars.

  • Fail closed: if integrity / signature cannot be verified, refuse

rather than proceed.

  • Token values must never appear in user-facing strings.