---
name: supply-chain-security
description: "[Supply chain security expert persona](../../../.apm/agents/supply-chain-security-expert.agent.md)"
license: "MIT"
metadata:
  decimalai-skill-id: "2d88d6e1-c251-4a6d-a94c-3ecd68d1f167"
  decimalai-version-id: "d02dc4b9-eeb3-4025-bdc5-53239d361d7f"
  decimalai-version: "1"
  decimalai-body-sha256: "401d1d6f4437ec8623d96f3232948ade8b94da87d224318a3f094b54d502135b"
  decimalai-name: "supply-chain-security"
  decimalai-format: "1"
  decimalai-invocation: "model"
  decimalai-category: "security"
  decimalai-source: "https://app.decimal.ai/s/supply-chain-security@1/SKILL.md"
---
# Supply Chain Security Skill

[Supply chain security expert persona](../../../.apm/agents/supply-chain-security-expert.agent.md)

## When to activate

- Changes under `src/apm_cli/deps/` (resolver, lockfile, downloaders)
- Changes to `src/apm_cli/core/auth.py` or `token_manager.py`
- Changes to `src/apm_cli/integration/cleanup.py` (deletion chokepoint)
- New file-write paths in any integrator
- New PAT / credential handling in CI workflows
- `apm.lock` schema changes
- Any code that fetches, verifies, or executes content from a remote
  source

## Key rules

- All path construction routes through
  `src/apm_cli/utils/path_security.py` (no ad-hoc `".." in x`).
- All deletions of deployed files route through
  `integration/cleanup.py:remove_stale_deployed_files()` (3 safety
  gates).
- All credential reads route through `AuthResolver` -- never raw
  `os.getenv` for token vars.
- Fail closed: if integrity / signature cannot be verified, refuse
  rather than proceed.
- Token values must never appear in user-facing strings.