Ready to supercharge your AI agents?

Install any skill in seconds. Free to start, no credit card required.

Supply Chain Security Skill — measured AI agent skill | DecimalAI

microsoft/supply-chain-security

SkillScore100Maintained

Activate when reviewing or modifying dependency resolution, lockfile schema, package downloaders, signature/integrity checks, file integration cleanup, or anything that could expose APM to dependency confusion, typosquatting, malicious packages, or token leakage.

by microsoft

Links this skill to your agents and keeps it current with the author’s updates.

Automatic

Security & AppSec pack

decimalai skills pull microsoft-supply-chain-security

Get this skill — curl · raw file

curl -fsSL https://app.decimal.ai/s/microsoft-supply-chain-security/SKILL.md

Raw file: /s/microsoft-supply-chain-security/SKILL.md ↗ · machine-readable summary at /s/microsoft-supply-chain-security.json ↗

In productionGlobal

how this skill behaves on real traffic · last 30 days

No production data for this skill yet — usage numbers appear here once agents start running it.

Anonymized aggregate across every org using this skill — proof from real production use, not a demo.

Does this skill help? · Benchmark: with vs. withoutsign in to run this on your agents

22 test cases from the publisher’s eval.yaml · each run twice on gemini-3.6-flash — with the skill injected, then without · last run 33h ago

Yes — +64% lift-16% tokens0% turns100% of whole cases pass with skill (22/22)

Test case	Without → With	Effect	Δ tokens	Δ turns
case-14	✗→✓	▲ Improved	-11%	0%
case-02	✗→✓	▲ Improved	51%	0%
case-03	✗→✓	▲ Improved	21%	0%
case-01	✗→✓	▲ Improved	11%	0%
case-04	✗→✓	▲ Improved	-36%	0%

Showing 5 of 22 cases

SkillSafety

✓ 3 of 3 passed

Code scan15 of 15 checks clean

0 critical · 0 warning · 0 info — scanner v4 — 8/2/2026

live_secretremote_code_executionreverse_shelldata_exfiltrationssrf_metadataagent_snoopinganti_refusaldestructive_commandsobfuscated_unicodeunicode_homoglyphopaque_blobsuspicious_urltool_overreachtrigger_abuseprompt_injection_phrasing

IntentSafe

LLM judge · does the skill do what it claims

ContentClean

LLM judge · policy & harmful-content review

Source

Imported

microsoft / apm

.apm/skills/supply-chain-security/SKILL.md

View on GitHub ↗

License MITImported 8/2/2026Version v1

Skill contents

SKILL.md

Supply Chain Security Skill

Supply chain security expert persona

When to activate

Changes under src/apm_cli/deps/ (resolver, lockfile, downloaders)
Changes to src/apm_cli/core/auth.py or token_manager.py
Changes to src/apm_cli/integration/cleanup.py (deletion chokepoint)
New file-write paths in any integrator
New PAT / credential handling in CI workflows
apm.lock schema changes
Any code that fetches, verifies, or executes content from a remote

source

Key rules

All path construction routes through

src/apm_cli/utils/path_security.py (no ad-hoc ".." in x).

All deletions of deployed files route through

integration/cleanup.py:remove_stale_deployed_files() (3 safety gates).

All credential reads route through AuthResolver -- never raw

os.getenv for token vars.

Fail closed: if integrity / signature cannot be verified, refuse

rather than proceed.

Token values must never appear in user-facing strings.

Want to see if microsoft/supply-chain-security would activate on your phrasing? Try it before you install — no LLM call, no signup.

Other measured skills in the registry, with their headline benchmark lift.