免费在 GitHub 公开

supply-chain-security

Activate when reviewing or modifying dependency resolution, lockfile schema, package downloaders, signature/integrity checks, file integration cleanup, or anything that could expose APM to dependency confusion, typosquatting, malicious packages, or token leakage.

中文简介正在准备中。当前显示原文说明。

microsoft/apm

查看安装方法

包含的文件（1）

SKILL.md1.3 KB

SKILL.md（原文）

安装前可以查看交给 AI 代理的指令内容。

Supply Chain Security Skill

Supply chain security expert persona

When to activate

Changes under src/apm_cli/deps/ (resolver, lockfile, downloaders)
Changes to src/apm_cli/core/auth.py or token_manager.py
Changes to src/apm_cli/integration/cleanup.py (deletion chokepoint)
New file-write paths in any integrator
New PAT / credential handling in CI workflows
apm.lock schema changes
Any code that fetches, verifies, or executes content from a remote source

Key rules

All path construction routes through src/apm_cli/utils/path_security.py (no ad-hoc ".." in x).
All deletions of deployed files route through integration/cleanup.py:remove_stale_deployed_files() (3 safety gates).
All credential reads route through AuthResolver -- never raw os.getenv for token vars.
Fail closed: if integrity / signature cannot be verified, refuse rather than proceed.
Token values must never appear in user-facing strings.

评价

还没有评价。欢迎分享你的使用感受。

无需登录即可发表。欢迎分享使用感受、提问，或说明在哪些环境下无法运行。

还没有评论。来写第一条吧。

同一仓库的技能

apm-spec-guardian

免费

Use this skill to run a four-panel adversarial advisory review on any pull request that touches the OpenAPM specification artifact (docs/src/content/docs/specs/openapm-*.md), its inline / sidecar JSON Schemas (docs/src/content/docs/specs/schemas/*.schema.json), or the conformance fixture seed (tests/fixtures/spec-conformance/**). The panel fans out to four spec-ecosystem reviewers (swagger-openapi-editor, oci-distribution-editor, pkgmgr-registry-contract-editor, w3c-tag-architect), each running in its own agent thread, and a spec-editor synthesizer that produces a fold-now / defer-v0.1.1 / defer-v0.2 / reject list plus a ship decision keyed off a 1..10 shocked_meter scale. The orchestrator is the sole writer to the PR: ONE consolidated comment, no verdict labels, no merge gating. The panel is advisory -- it surfaces findings, prioritizes folds, and renders a ship recommendation that the maintainer weighs.

中文简介正在准备中。当前显示原文说明。