supply-chain-security

Activate when reviewing or modifying dependency resolution, lockfile schema, package downloaders, signature/integrity checks, file integration cleanup, or anything that could expose APM to dependency confusion, typosquatting, malicious packages, or token leakage.

Quality

90%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Quality

Content

80%Weight 40%Scale 1-3

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is lean, specific, and highly actionable, naming exact modules and anti-patterns for supply-chain safety. Its weaknesses are the absence of explicit validation feedback loops for the destructive operations it governs and an unresolvable persona reference.

Suggestions

Add an explicit validation/verification feedback loop (e.g., after running `remove_stale_deployed_files()` or an integrity check, state what to do on failure and require re-validation before proceeding) to lift workflow_clarity past the risky-operation cap.

Fix or relocate the broken persona reference `../../../.apm/agents/supply-chain-security-expert.agent.md` so it resolves to a real file, or inline the essential persona guidance so navigation is verifiable one level deep.

Consider a short "Verify" checklist at the end of Key rules that ties the fail-closed and routing rules to concrete verification commands or checks.

Dimension	Reasoning	Score
Conciseness	Every line is a concrete trigger or rule with no concept padding — e.g. "All path construction routes through `src/apm_cli/utils/path_security.py`" — assuming Claude's competence and earning its tokens.	3 / 3
Actionability	Gives precise file paths and function names with explicit anti-patterns ("never raw `os.getenv`", "no ad-hoc `".." in x`"); per the rubric's instruction-only guidance, the absence of code is not penalized because the directives are concrete and actionable.	3 / 3
Workflow Clarity	The activation/rules structure is clear, but the skill governs destructive and integrity-sensitive operations (file deletion, credential reads, fail-closed checks) yet provides no explicit validate→fix→retry feedback loop, triggering the workflow-clarity cap for risky operations.	2 / 3
Progressive Disclosure	Sections are well-organized and the body is short, but the single reference (`../../../.apm/agents/supply-chain-security-expert.agent.md`) does not resolve to a real file in this environment and no bundle directory exists, so navigation cannot be verified as clean one-level-deep.	2 / 3
	Total	10 / 12 Passed

Description

100%Weight 40%Scale 1-3

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is specific, well-triggered, and distinct: it lists concrete supply-chain capabilities, opens with an explicit "Activate when" clause, and uses recognizable terms unlikely to collide with other skills. It is concise with no fluff or voice issues.

Dimension	Reasoning	Score
Specificity	Enumerates several concrete capability domains — "dependency resolution, lockfile schema, package downloaders, signature/integrity checks, file integration cleanup" — rather than a single vague action, matching the multiple-specific-actions anchor.	3 / 3
Completeness	Explicitly answers both what (the listed capabilities) and when via the "Activate when reviewing or modifying…" trigger clause, satisfying the explicit-trigger requirement that would otherwise cap this at 2.	3 / 3
Trigger Term Quality	Uses natural terms a supply-chain reviewer would actually say — "lockfile", "dependency confusion", "typosquatting", "malicious packages", "token leakage" — giving good coverage rather than internal jargon only.	3 / 3
Distinctiveness Conflict Risk	Narrow APM supply-chain niche with distinct triggers (dependency confusion, typosquatting, token leakage) makes it unlikely to fire for unrelated skills.	3 / 3
	Total	12 / 12 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
relative_links	Relative link issues: 1 suspicious	Warning

	Total	15 / 16 Passed

Repository: microsoft/apm
Path: .agents/skills/supply-chain-security/SKILL.md
Commit: 634f7b6

Reviewed: 8 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.