supply-chain-security

Activate when reviewing or modifying dependency resolution, lockfile schema, package downloaders, signature/integrity checks, file integration cleanup, or anything that could expose APM to dependency confusion, typosquatting, malicious packages, or token leakage.

Quality

83%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Quality

Content

88%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

An efficient, actionable guardrails skill that names exact code chokepoints and bakes fail-closed validation into its rules. Its only weakness is the lack of runnable examples and a slightly buried external persona reference.

Suggestions

Add one short, copy-paste-ready snippet showing the correct routing pattern (e.g. calling `path_security.py` and `AuthResolver` instead of ad-hoc checks) to lift actionability toward 5.

Move the persona reference into a dedicated "## References" section and verify the path resolves within the skill bundle, or inline a one-line summary of the persona instead.

Consider a brief "## Verification" section listing how to confirm a change satisfies each rule (e.g. grep for raw `os.getenv`, check deletions pass the 3 safety gates).

Dimension	Reasoning	Score
Conciseness	The body is lean with no concept explanations Claude already knows and no padding — each rule is a terse, directive sentence and every token earns its place, matching anchor 5.	5 / 5
Actionability	Rules route to concrete, named chokepoints ("`src/apm_cli/utils/path_security.py`", "`integration/cleanup.py:remove_stale_deployed_files()` (3 safety gates)", "`AuthResolver` -- never raw `os.getenv`") which is highly actionable, but there are no runnable code or commands — a minor gap fitting anchor 4 for this instruction-only skill.	4 / 5
Workflow Clarity	As a guardrails skill with no multi-step destructive operation, its single "enforce these rules when activating" action is unambiguous and validation is baked in ("Fail closed", "refuse rather than proceed", "3 safety gates"), so the simple-skill exception applies and it scores 5.	5 / 5
Progressive Disclosure	Well-organized into clear sections ("When to activate", "Key rules") and under 50 lines with only a single one-level-deep reference, but that reference is an external persona link ("../../../.apm/agents/supply-chain-security-expert.agent.md") placed inline after the title rather than a clean bundle-internal references section — a minor organization gap matching anchor 4.	4 / 5
	Total	18 / 20 Passed

Description

78%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, trigger-rich description that excels at the "when" and distinctiveness but is slightly weaker on explicitly stating the skill's "what" and action verbs. Concrete threat vectors and named areas make it unlikely to misfire.

Suggestions

Add an explicit "what" clause stating the skill's action, e.g. "Reviews dependency-handling and credential code for supply-chain risks" before the "Activate when" trigger.

Broaden trigger terms with common synonyms like "supply chain", "checksum/hash verification", and "lockfile integrity".

Lead with the concrete verbs the skill performs (review, audit, gate) rather than relying on "reviewing or modifying" across a noun list.

Dimension	Reasoning	Score
Specificity	Names the supply-chain domain and a comprehensive list of concrete objects ("dependency resolution, lockfile schema, package downloaders, signature/integrity checks, file integration cleanup" plus "dependency confusion, typosquatting, malicious packages, or token leakage"), but the action verbs are limited to "reviewing or modifying" spread across many nouns — a minor coverage gap that fits anchor 4 rather than 5.	4 / 5
Completeness	The explicit "Activate when reviewing or modifying ..." clause clearly and specifically answers "when", while the "what" is only weakly implied (activate to guard these areas) rather than crisply stated — anchor 4: both present with the "what" less explicit.	4 / 5
Trigger Term Quality	Includes good, natural keywords a security-minded user would say ("dependency resolution", "lockfile", "signature/integrity checks", "typosquatting", "dependency confusion", "token leakage") with some synonyms, but misses common variations like "supply chain", "checksums", and "hash verification", matching anchor 4.	4 / 5
Distinctiveness Conflict Risk	Tightly scoped to APM's supply-chain surface with concrete code areas and specific threat vectors, giving it a clear niche with distinct triggers and minimal conflict risk, matching anchor 5.	5 / 5
	Total	17 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
relative_links	Relative link issues: 1 suspicious	Warning

	Total	15 / 16 Passed

Repository: microsoft/apm
Path: .agents/skills/supply-chain-security/SKILL.md
Commit: 71a877c

Reviewed: ~4 hours ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.