[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M699FQDV03PS68FX5EM2D8KP":3,"skill-same:01M699FQDV03PS68FX5EM2D8KP":68},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":39,"linkOnly":40,"markdownContent":41,"markdownBody":42,"frontMatter":43,"refName":44,"commitSha":45,"skillDirectory":46,"forksCount":47,"repositoryHtmlUrl":48,"repositoryHomepageUrl":49,"ownerHtmlUrl":50,"ownerBlogUrl":51,"ownerDescription":52,"updatedAt":53,"install":54,"resources":67},"01M699FQDV03PS68FX5EM2D8KP","supply-chain-security",null,"Activate when reviewing or modifying dependency resolution, lockfile schema, package downloaders, signature\u002Fintegrity checks, file integration cleanup, or anything that could expose APM to dependency confusion, typosquatting, malicious packages, or token leakage.","microsoft\u002Fapm","microsoft","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F6154722?v=4","01M698VYDXZ6JW5WH3CRV650R8","Microsoft","01M699CC41JR5QW38C9PDX6101",4336,"MIT","https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fapm\u002Fblob\u002Fmain\u002F.apm\u002Fskills\u002Fsupply-chain-security\u002FSKILL.md",[],[19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38],"security","chain security","supply","chain","supply chain","supply chain security","cleanup","package","file","integration","lockfile","schema","dependency","activate","packages","resolution","integrity checks","dependency resolution","when","malicious","2026-11-10 10:12:30",false,"---\nname: supply-chain-security\ndescription: >-\n  Activate when reviewing or modifying dependency resolution, lockfile\n  schema, package downloaders, signature\u002Fintegrity checks, file\n  integration cleanup, or anything that could expose APM to dependency\n  confusion, typosquatting, malicious packages, or token leakage.\n---\n\n# Supply Chain Security Skill\n\n[Supply chain security expert persona](..\u002F..\u002Fagents\u002Fsupply-chain-security-expert.agent.md)\n\n## When to activate\n\n- Changes under `src\u002Fapm_cli\u002Fdeps\u002F` (resolver, lockfile, downloaders)\n- Changes to `src\u002Fapm_cli\u002Fcore\u002Fauth.py` or `token_manager.py`\n- Changes to `src\u002Fapm_cli\u002Fintegration\u002Fcleanup.py` (deletion chokepoint)\n- New file-write paths in any integrator\n- New PAT \u002F credential handling in CI workflows\n- `apm.lock` schema changes\n- Any code that fetches, verifies, or executes content from a remote\n  source\n\n## Key rules\n\n- All path construction routes through\n  `src\u002Fapm_cli\u002Futils\u002Fpath_security.py` (no ad-hoc `\"..\" in x`).\n- All deletions of deployed files route through\n  `integration\u002Fcleanup.py:remove_stale_deployed_files()` (3 safety\n  gates).\n- All credential reads route through `AuthResolver` -- never raw\n  `os.getenv` for token vars.\n- Fail closed: if integrity \u002F signature cannot be verified, refuse\n  rather than proceed.\n- Token values must never appear in user-facing strings.\n","# Supply Chain Security Skill\n\n[Supply chain security expert persona](..\u002F..\u002Fagents\u002Fsupply-chain-security-expert.agent.md)\n\n## When to activate\n\n- Changes under `src\u002Fapm_cli\u002Fdeps\u002F` (resolver, lockfile, downloaders)\n- Changes to `src\u002Fapm_cli\u002Fcore\u002Fauth.py` or `token_manager.py`\n- Changes to `src\u002Fapm_cli\u002Fintegration\u002Fcleanup.py` (deletion chokepoint)\n- New file-write paths in any integrator\n- New PAT \u002F credential handling in CI workflows\n- `apm.lock` schema changes\n- Any code that fetches, verifies, or executes content from a remote\n  source\n\n## Key rules\n\n- All path construction routes through\n  `src\u002Fapm_cli\u002Futils\u002Fpath_security.py` (no ad-hoc `\"..\" in x`).\n- All deletions of deployed files route through\n  `integration\u002Fcleanup.py:remove_stale_deployed_files()` (3 safety\n  gates).\n- All credential reads route through `AuthResolver` -- never raw\n  `os.getenv` for token vars.\n- Fail closed: if integrity \u002F signature cannot be verified, refuse\n  rather than proceed.\n- Token values must never appear in user-facing strings.\n",{"name":5,"description":7},"main","2920043258932f0f67e6f01df7b9047eb42f358c",".apm\u002Fskills\u002Fsupply-chain-security",415,"https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fapm","https:\u002F\u002Fmicrosoft.github.io\u002Fapm\u002F","https:\u002F\u002Fgithub.com\u002Fmicrosoft","https:\u002F\u002Fopensource.microsoft.com","Open source projects and samples from Microsoft","2026-11-12 02:56:52",{"source":8,"skillName":5,"commands":55,"prompt":65,"zipAvailable":66},[56,59,62],{"tool":57,"command":58},"npx","npx skills add microsoft\u002Fapm --skill supply-chain-security",{"tool":60,"command":61},"bunx","bunx skills add microsoft\u002Fapm --skill supply-chain-security",{"tool":63,"command":64},"pnpm","pnpm dlx skills add microsoft\u002Fapm --skill supply-chain-security","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fapm\u002Fblob\u002Fmain\u002F.apm\u002Fskills\u002Fsupply-chain-security\u002FSKILL.md",true,[],[69,75,81,86,91,96],{"skillNo":70,"name":71,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":72,"categories":73,"keywords":74,"publishedAt":39},"01M699JMZBYWPBT7JYWBSB95Z6","hello","https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fapm\u002Fblob\u002Fmain\u002Ftests\u002Fintegration\u002Ffixtures\u002Ftarget_resolution\u002Fshared\u002Fminimal_skill\u002F.apm\u002Fskills\u002Fhello\u002FSKILL.md",[],[71],{"skillNo":76,"name":77,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":78,"categories":79,"keywords":80,"publishedAt":39},"01M699JKAMZ4DH1PYJMXHE4FG4","placeholder","https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fapm\u002Fblob\u002Fmain\u002Ftests\u002Fintegration\u002Ffixtures\u002Ftarget_resolution\u002Fs25_copilot_alias\u002F.apm\u002Fskills\u002Fplaceholder\u002FSKILL.md",[],[77],{"skillNo":82,"name":77,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":83,"categories":84,"keywords":85,"publishedAt":39},"01M699JHR9DKJ7BZHAPF6DZX2Z","https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fapm\u002Fblob\u002Fmain\u002Ftests\u002Fintegration\u002Ffixtures\u002Ftarget_resolution\u002Fs24_priority_override\u002F.apm\u002Fskills\u002Fplaceholder\u002FSKILL.md",[],[77],{"skillNo":87,"name":77,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":88,"categories":89,"keywords":90,"publishedAt":39},"01M699JG5BJBZSWM25F1VMJ2H6","https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fapm\u002Fblob\u002Fmain\u002Ftests\u002Fintegration\u002Ffixtures\u002Ftarget_resolution\u002Fs23_error_renderer\u002F.apm\u002Fskills\u002Fplaceholder\u002FSKILL.md",[],[77],{"skillNo":92,"name":77,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":93,"categories":94,"keywords":95,"publishedAt":39},"01M699JEFSMBP3HNS061R15CE9","https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fapm\u002Fblob\u002Fmain\u002Ftests\u002Fintegration\u002Ffixtures\u002Ftarget_resolution\u002Fs22_gemini_md_only\u002F.apm\u002Fskills\u002Fplaceholder\u002FSKILL.md",[],[77],{"skillNo":97,"name":77,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":98,"categories":99,"keywords":100,"publishedAt":39},"01M699JCRCJCVZ3Z3RD8F9MXF5","https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fapm\u002Fblob\u002Fmain\u002Ftests\u002Fintegration\u002Ffixtures\u002Ftarget_resolution\u002Fs21_codex_dir\u002F.apm\u002Fskills\u002Fplaceholder\u002FSKILL.md",[],[77]]