supply-chain-security
Activate when reviewing or modifying dependency resolution, lockfile schema, package downloaders, signature/integrity checks, file integration cleanup, or anything that could expose APM to dependency confusion, typosquatting, malicious packages, or token leakage.
来源信息
- 仓库
- microsoft/apm
- 最近来源活动
- 2026年6月9日 19:52
- 检测到的 SKILL.md 语言
- 英语
- 星标
- 3,997
- 分支
- 388
安装方式
默认使用会先检查来源的 Prompt；你也可以切换为直接命令，或下载本地副本。
检查来源文件
决定是否安装前，请先阅读 SKILL.md，以及 SkillsMP 当前展示的配套文件。
正在显示 SKILL.md
SKILL.md
来源说明 · 只读预览- name
- supply-chain-security
- description
- Activate when reviewing or modifying dependency resolution, lockfile schema, package downloaders, signature/integrity checks, file integration cleanup, or anything that could expose APM to dependency confusion, typosquatting, malicious packages, or token leakage.
# Supply Chain Security Skill
[Supply chain security expert persona](../../../.apm/agents/supply-chain-security-expert.agent.md)
## When to activate
- Changes under `src/apm_cli/deps/` (resolver, lockfile, downloaders)
- Changes to `src/apm_cli/core/auth.py` or `token_manager.py`
- Changes to `src/apm_cli/integration/cleanup.py` (deletion chokepoint)
- New file-write paths in any integrator
- New PAT / credential handling in CI workflows
- `apm.lock` schema changes
- Any code that fetches, verifies, or executes content from a remote
source
## Key rules
- All path construction routes through
`src/apm_cli/utils/path_security.py` (no ad-hoc `".." in x`).
- All deletions of deployed files route through
`integration/cleanup.py:remove_stale_deployed_files()` (3 safety
gates).
- All credential reads route through `AuthResolver` -- never raw
`os.getenv` for token vars.
- Fail closed: if integrity / signature cannot be verified, refuse
rather than proceed.
- Token values must never appear in user-facing strings.
在 GitHub 查看