Tessl • The management layer for AI agent skills

SkillPublic

supply-chain-security

Activate when reviewing or modifying dependency resolution, lockfile schema, package downloaders, signature/integrity checks, file integration cleanup, or anything that could expose APM to dependency confusion, typosquatting, malicious packages, or token leakage.

Quality

70%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./.agents/skills/supply-chain-security/SKILL.md

Quality

Content

76%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A tight, well-targeted policy skill for a specific codebase: concise, concrete rules with exact paths and function names, and no padding. Its main weakness is the absence of a sequenced review workflow with explicit validation checkpoints, which the destructive-operations cap limits to 3, plus an undersignaled external persona reference.

Suggestions

Replace the '3 safety gates' mention with the actual three checks (or link to a reference file listing them) so the deletion-validation loop is explicit rather than implied.

Add a short ordered review workflow (e.g., 1. identify changed files, 2. verify path construction routing, 3. verify deletion routing, 4. verify credential reads, 5. verify integrity fail-closed behavior) with a re-check step for each failure.

Annotate the persona link with when to load it (e.g., 'Read for full review methodology when auditing a new downloader') or move its substance into the SKILL.md body.

Dimension	Reasoning	Score
Conciseness	The ~35-line body contains zero explanations of concepts Claude already knows; every line is a project-specific rule or trigger ('no ad-hoc `".." in x`', 'never raw os.getenv for token vars'). It is lean and every token earns its place.	5 / 5
Actionability	Concrete, executable guidance with exact file paths and function names ('src/apm_cli/utils/path_security.py', 'integration/cleanup.py:remove_stale_deployed_files()', 'AuthResolver'), so absence of code is not penalized per the instruction-skill note. Minor gaps: no examples of violations or what remediation looks like, and '3 safety gates' is referenced but never specified.	4 / 5
Workflow Clarity	Rules are individually clear but there is no sequenced review workflow (no step order, no feedback loop specifying how to verify the safety gates or what to do on failure beyond 'Fail closed'). Because the skill governs destructive/batch operations (deletions, package installation) without explicit validation steps, workflow clarity is capped at 3 per the judging guidelines.	3 / 5
Progressive Disclosure	Good structure with two well-organized sections ('When to activate', 'Key rules') and no monolithic content, fitting the under-50-lines exception. However the persona reference '[Supply chain security expert persona](../../../.apm/agents/supply-chain-security-expert.agent.md)' is a bare link with no signal of what it contains or when to read it, and no bundle files exist alongside the skill — minor organization gaps matching anchor 4 rather than 5.	4 / 5
	Total	16 / 20 Passed

Description

52%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A highly specific, well-targeted trigger description with excellent natural keywords for this codebase's domain. Its critical weakness is completeness: it specifies when to activate in detail but never says what the skill does, which alone caps the description's effectiveness.

Suggestions

Lead with a one-phrase 'what' statement before the trigger clause, e.g., 'Applies supply chain security review rules (path safety, credential handling, integrity verification, deletion gates). Activate when...'.

Add capability verbs that describe the skill's actions (e.g., 'Audits dependency resolution and lockfile changes against path-safety, credential, and integrity rules') so the description answers both 'what' and 'when'.

Tighten the 'or anything that could expose APM to...' catch-all into one or two concrete natural terms (e.g., 'supply chain attacks, credential/token leakage') to reduce over-triggering.

Dimension	Reasoning	Score
Specificity	The description names many concrete domain objects ('dependency resolution, lockfile schema, package downloaders, signature/integrity checks, file integration cleanup') but states no capability actions — only the generic verbs 'reviewing or modifying'. It sits at anchor 3: domain-rich and concrete, but the skill's actual capabilities are never stated, so it cannot reach anchor 4's 'several specific actions'.	3 / 5
Completeness	The description is entirely a 'when' clause ('Activate when reviewing or modifying...') with no 'what' — it never states what the skill does when activated. This matches anchor 2's example ('Use when working with documents') precisely; anchor 3 is unreachable because a clear 'what' is completely missing, however detailed the 'when' is.	2 / 5
Trigger Term Quality	Strong natural-term coverage with synonyms users would actually say: 'dependency resolution', 'lockfile', 'signature/integrity checks', 'dependency confusion', 'typosquatting', 'malicious packages', 'token leakage'. It falls just short of anchor 5 because common variations like 'supply chain', 'vulnerability', or 'CVE' are absent, and the trailing 'or anything that could expose APM to...' is a broad catch-all rather than a keyword.	4 / 5
Distinctiveness Conflict Risk	Terms like 'APM', 'dependency confusion', 'typosquatting', and 'lockfile schema' carve out a clear niche distinct from generic code-review skills. Minor overlap risk comes from the open-ended 'or anything that could expose APM to...' clause, which could over-trigger on unrelated security-adjacent changes — anchor 4 rather than 5.	4 / 5
	Total	13 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
relative_links	Relative link issues: 1 suspicious	Warning

	Total	15 / 16 Passed

Repository: microsoft/apm
Path: .agents/skills/supply-chain-security/SKILL.md
Revision: 2920043

Reviewed: 1 month ago

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.

supply-chain-security

Table of Contents

Is this your skill?