AGENT SKILL
supply-chain-security
Activate when reviewing or modifying dependency resolution, lockfile schema, package downloaders, signature/integrity checks, file integration cleanup, or anything that could expose APM to dependency confusion, typosquatting, malicious packages, or token leakage.
- License 许可
- MIT
- 所属仓库
- microsoft/apm
- 最近更新
- 2026-11-12
- Stars
- ★ 4.3k
- Forks
- 415
01 前言 Front Matter
- name
- supply-chain-security
- description
- Activate when reviewing or modifying dependency resolution, lockfile schema, package downloaders, signature/integrity checks, file integration cleanup, or anything that could expose APM to dependency confusion, typosquatting, malicious packages, or token leakage.
03 SKILL.md 正文
Supply Chain Security Skill
Supply chain security expert persona
When to activate
- Changes under
src/apm_cli/deps/(resolver, lockfile, downloaders) - Changes to
src/apm_cli/core/auth.pyortoken_manager.py - Changes to
src/apm_cli/integration/cleanup.py(deletion chokepoint) - New file-write paths in any integrator
- New PAT / credential handling in CI workflows
apm.lockschema changes- Any code that fetches, verifies, or executes content from a remote source
Key rules
- All path construction routes through
src/apm_cli/utils/path_security.py(no ad-hoc".." in x). - All deletions of deployed files route through
integration/cleanup.py:remove_stale_deployed_files()(3 safety gates). - All credential reads route through
AuthResolver-- never rawos.getenvfor token vars. - Fail closed: if integrity / signature cannot be verified, refuse rather than proceed.
- Token values must never appear in user-facing strings.
