supply-chain-security
Activate when reviewing or modifying dependency resolution, lockfile schema, package downloaders, signature/integrity checks, file integration cleanup, or anything that could expose APM to dependency confusion, typosquatting, malicious packages, or token leakage.
소스 정보
- 저장소
- microsoft/apm
- 최근 소스 활동
- 2026년 4월 21일 22:09
- 감지된 SKILL.md 언어
- 영어
- 스타
- 4,018
- 포크
- 392
설치 방법
기본적으로 소스를 먼저 확인하는 Prompt가 선택됩니다. 직접 명령으로 전환하거나 로컬 사본을 다운로드할 수도 있습니다.
소스 파일 검토
설치 여부를 결정하기 전에 SKILL.md와 SkillsMP에 표시된 보조 파일을 읽어 보세요.
SKILL.md 표시 중
SKILL.md
소스 지침 · 읽기 전용 미리보기- name
- supply-chain-security
- description
- Activate when reviewing or modifying dependency resolution, lockfile schema, package downloaders, signature/integrity checks, file integration cleanup, or anything that could expose APM to dependency confusion, typosquatting, malicious packages, or token leakage.
# Supply Chain Security Skill
[Supply chain security expert persona](../../agents/supply-chain-security-expert.agent.md)
## When to activate
- Changes under `src/apm_cli/deps/` (resolver, lockfile, downloaders)
- Changes to `src/apm_cli/core/auth.py` or `token_manager.py`
- Changes to `src/apm_cli/integration/cleanup.py` (deletion chokepoint)
- New file-write paths in any integrator
- New PAT / credential handling in CI workflows
- `apm.lock` schema changes
- Any code that fetches, verifies, or executes content from a remote
source
## Key rules
- All path construction routes through
`src/apm_cli/utils/path_security.py` (no ad-hoc `".." in x`).
- All deletions of deployed files route through
`integration/cleanup.py:remove_stale_deployed_files()` (3 safety
gates).
- All credential reads route through `AuthResolver` -- never raw
`os.getenv` for token vars.
- Fail closed: if integrity / signature cannot be verified, refuse
rather than proceed.
- Token values must never appear in user-facing strings.
GitHub에서 보기