supply-chain-security

Activate when reviewing or modifying dependency resolution, lockfile schema, package downloaders, signature/integrity checks, file integration cleanup, or anything that could expose APM to dependency confusion, typosquatting, malicious packages, or token leakage.

Quality

93%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Quality

Content

87%Weight 40%Scale 1-3

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A tight, well-organized guardrail skill that points Claude to specific chokepoints and fail-closed rules with minimal tokens. Its only weakness is that destructive-operation workflows (deletions) are referenced by name but not sequenced with an explicit validation feedback loop.

Suggestions

Add a short sequenced checklist for the deletion flow (e.g., enumerate the 3 safety gates in cleanup.py and a validate-before-proceed step) to turn the 'remove_stale_deployed_files' rule into an explicit feedback loop.

Spell out the fail-closed verification step as a concrete action (e.g., 'call verify_signature() before install; on failure, abort and report the package') so the guardrail is copy-paste actionable.

Clarify what the 3 safety gates are (or link to where they are documented) so the guardrail is self-contained rather than deferring detail to the function body.

Dimension	Reasoning	Score
Conciseness	Lean bullet lists of triggers and rules with no concept explanation or padding; every line names a concrete file, symbol, or guardrail, matching the 'every token earns its place' anchor.	3 / 3
Actionability	Concrete routing rules cite specific symbols: 'src/apm_cli/utils/path_security.py', 'integration/cleanup.py:remove_stale_deployed_files()', 'AuthResolver'; the fail-closed rule is an executable directive, appropriate for an instruction-only guardrail skill.	3 / 3
Workflow Clarity	Content is a rules/trigger list rather than a sequenced multi-step workflow, and although deletions (a destructive operation) are mentioned with '3 safety gates', no validate->fix->retry feedback loop is spelled out in the body, capping this at 2 per the feedback-loop guideline.	2 / 3
Progressive Disclosure	Under 50 lines with no bundle files present; the single external link (the expert persona agent file) is clearly signaled and one level deep, and the sections (When to activate / Key rules) are well organized, satisfying the simple-skill allowance.	3 / 3
	Total	11 / 12 Passed

Description

100%Weight 40%Scale 1-3

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A focused, trigger-rich description that names concrete supply-chain domains and attack classes with an explicit 'Activate when' clause. It is concise, in third person, and clearly distinguishable from generic skills.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions/domains: 'dependency resolution, lockfile schema, package downloaders, signature/integrity checks, file integration cleanup', matching the multi-action anchor rather than the single-domain score-2.	3 / 3
Completeness	Explicitly answers when ('Activate when reviewing or modifying...') and what (the enumerated supply-chain scopes and attack classes), so both halves are present with explicit trigger guidance; not capped at 2 because the trigger clause is explicit.	3 / 3
Trigger Term Quality	Good coverage of natural terms a user would say: 'dependency confusion', 'typosquatting', 'malicious packages', 'lockfile', 'token leakage', framed by an explicit 'Activate when...' trigger.	3 / 3
Distinctiveness Conflict Risk	APM-specific supply-chain niche with distinct triggers (lockfile schema, dependency confusion, typosquatting, token leakage) makes it unlikely to fire for unrelated skills.	3 / 3
	Total	12 / 12 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
relative_links	Relative link issues: 1 suspicious	Warning

	Total	15 / 16 Passed

Repository: microsoft/apm
Path: .apm/skills/supply-chain-security/SKILL.md
Commit: 634f7b6

Reviewed: 8 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.