Supply Chain Security Skill
SkillFiles & storageGuides your agent to safely review and edit dependency resolution, lockfiles, and package integrity checks.
Available today. Use it from your connected AI after setup.
No other account needed.
Connect ahel once, and every AI you use reads what you have installed.
Then ask your AI: use the Supply Chain Security Skill skill
About this capability
Activate when reviewing or modifying dependency resolution, lockfile schema, package downloaders, signature/integrity checks, file integration cleanup, or anything that could expose APM to dependency confusion, typosquatting, malicious packages, or token leakage.
What this skill tells your AI
The instructions your AI receives, as published by microsoft/apm in .agents/skills/supply-chain-security/SKILL.md and read by ahel’s review.
Supply chain security expert persona
When to activate
- Changes under
src/apm_cli/deps/(resolver, lockfile, downloaders) - Changes to
src/apm_cli/core/auth.pyortoken_manager.py - Changes to
src/apm_cli/integration/cleanup.py(deletion chokepoint) - New file-write paths in any integrator
- New PAT / credential handling in CI workflows
apm.lockschema changes- Any code that fetches, verifies, or executes content from a remote source
Key rules
- All path construction routes through
src/apm_cli/utils/path_security.py(no ad-hoc".." in x). - All deletions of deployed files route through
integration/cleanup.py:remove_stale_deployed_files()(3 safety gates). - All credential reads route through
AuthResolver-- never rawos.getenvfor token vars. - Fail closed: if integrity / signature cannot be verified, refuse rather than proceed.
- Token values must never appear in user-facing strings.
Signals
- GitHub stars
- 4k
- Forks
- 357
- Last commit
- Sep 2026
Advanced
- Catalog kind
- skill
- Gateway key
supply-chain-security-microsoft- Source
- github.com/microsoft/apm