supply-chain-security

Activate when reviewing or modifying dependency resolution, lockfile schema, package downloaders, signature/integrity checks, file integration cleanup, or anything that could expose APM to dependency confusion, typosquatting, malicious packages, or token leakage.

Quality

87%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Quality

Content

87%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is concise, highly actionable, and well-structured for a single-purpose security-gate skill. Its main weakness is workflow clarity: it lists rules and triggers but lacks an explicit sequenced review process with validation/feedback checkpoints for destructive and batch operations.

Suggestions

Add a short numbered review workflow with explicit validation checkpoints (e.g. 1. Locate every changed path/delete/credential read; 2. Confirm each routes through the required chokepoint; 3. Fail closed if any check is unverified; 4. Re-run the check after fixes).

Include a small checklist Claude can tick through for destructive/batch changes (deletions, file writes, token reads) so the gate is exercised rather than merely described.

State the explicit failure/retry loop for integrity/signature verification ('refuse -> report the failing artifact -> do not retry download automatically').

Dimension	Reasoning	Score
Conciseness	Lean and efficient with no concept padding; every line states a concrete rule or trigger and assumes Claude's competence, so every token earns its place.	5 / 5
Actionability	Concrete file paths and symbols ('src/apm_cli/utils/path_security.py', 'integration/cleanup.py:remove_stale_deployed_files()', 'AuthResolver') with specific constraints ('no ad-hoc `".." in x`', '3 safety gates', 'Fail closed') give copy-locate-ready guidance; code absence is fine for an instruction-only skill.	5 / 5
Workflow Clarity	Activation triggers and rules are listed but there is no sequenced multi-step review workflow; because this skill governs destructive and batch operations (deletion chokepoint, credential handling) without an explicit validate-fix-retry feedback loop, workflow clarity is capped at 3.	3 / 5
Progressive Disclosure	Under 50 lines with clean sections (When to activate, Key rules) and a single clearly signaled one-level-deep reference to the persona agent file, satisfying the simple-skill exception.	5 / 5
	Total	18 / 20 Passed

Description

87%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is strong, explicit, and third-person, clearly answering both what the skill covers and when to activate it with concrete domain-specific trigger terms. The only soft spot is specificity, where the action verbs are generic across otherwise well-named subsystems.

Dimension	Reasoning	Score
Specificity	Names the supply-chain domain plus several concrete subsystems to act on ('dependency resolution, lockfile schema, package downloaders, signature/integrity checks, file integration cleanup'), but the verbs are generic review/modify rather than distinct enumerated operations.	4 / 5
Completeness	Explicitly states both the what ('reviewing or modifying dependency resolution, lockfile schema, ...') and the when ('Activate when ... or anything that could expose APM to ...') with concrete trigger phrases.	5 / 5
Trigger Term Quality	Natural user-facing terms like 'dependency confusion', 'typosquatting', 'malicious packages', 'lockfile', and 'token leakage' are well covered; a few common synonyms (e.g. 'supply chain attack') are missing.	4 / 5
Distinctiveness Conflict Risk	A clear APM supply-chain niche with distinct triggers (dependency confusion, typosquatting, token leakage) gives minimal overlap risk with unrelated skills.	5 / 5
	Total	18 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
relative_links	Relative link issues: 1 suspicious	Warning

	Total	15 / 16 Passed

Repository: microsoft/apm
Path: .apm/skills/supply-chain-security/SKILL.md
Commit: 71a877c

Reviewed: ~5 hours ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.