skills.rest
githubnext
githubnextOFFICIAL
Explore all skills by this author →
Website𝕏@githubnextGitHub

supply-chain-security

Enforce security protocols for APM dependency resolution and package management.

4|1|Updated May 7, 2026
Search Tags:#package management#integrity checks#APM#dependency security#credential security
One-click install
npx skills add https://github.com/githubnext/apm --skill supply-chain-security-githubnext
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: supply-chain-security
Source: https://github.com/githubnext/apm/tree/main/.apm/skills/supply-chain-security
Command: npx skills add https://github.com/githubnext/apm --skill supply-chain-security-githubnext

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) components.

What problem does it solve?

This Skill ensures the security of APM's dependency resolution and package management processes, mitigating risks from dependency confusion, typosquatting, malicious packages, or token leakage.

Core Features & Use Cases

  • Dependency Security: Monitors and enforces security checks on dependency resolution, lockfile schema, package downloaders, and signature/integrity checks.
  • Clean Integration Cleanup: Ensures that all file deletions and integration cleanup are performed securely, with multiple safety gates.
  • Secure Credential Handling: Requires all credential reads to route through AuthResolver, preventing raw credential exposure.
  • Fail Closed Approach: Refuses to proceed if integrity or signature verification fails, ensuring a secure execution environment.
  • Use Case: When modifying src/apm_cli/deps/, src/apm_cli/core/auth.py, or src/apm_cli/integration/cleanup.py, this Skill activates to enforce security protocols.

Quick Start

Run the supply-chain-security skill to review changes in dependency resolution before deploying a new version of APM.

Frequently Asked Questions about supply-chain-security

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I enforce security checks for dependency resolution and package management?▼

To enforce dependency security, you must verify lockfile schemas, package downloaders, and integrity checks. This approach mitigates risks from dependency confusion and malicious packages by refusing to proceed if signature verification fails.

How does fail-closed verification work for package integrity checks?▼

Fail-closed verification for package integrity checks halts the dependency resolution process completely if signature or integrity validation fails. This strict protocol ensures a secure execution environment by preventing untrusted or corrupted packages from being installed.

What is the best way to secure credentials during package management operations?▼

Securing credentials during package management requires routing all credential reads through an AuthResolver. This method prevents raw credential exposure and mitigates the risk of token leakage during dependency resolution and integration cleanup.

Can I use these security protocols for lockfile changes in APM projects?▼

Yes, these security protocols apply directly to scenarios involving lockfile changes and dependency resolution in APM projects. The system activates specifically when modifying dependency resolution paths, auth modules, or integration cleanup scripts.

Why does dependency resolution fail when integrity verification encounters an error?▼

Dependency resolution fails during integrity verification errors because the system uses a fail-closed approach. It actively refuses to proceed with package management operations if signature or integrity checks fail, ensuring strict supply-chain security.

What problems does secure dependency resolution solve for APM projects?▼

Secure dependency resolution solves critical supply-chain vulnerabilities like dependency confusion, typosquatting, malicious package installation, and token leakage. It achieves this by enforcing strict integrity checks and secure credential handling during package management.

Related Skills

Explore More Software Engineering Skills→
UiPathUiPath
18

fix-security-vulnerabilities

Trace transitive dependencies and apply validated fixes for npm and pnpm vulnerabilities.

Official
Advanced
jonnymuirjonnymuir
1

nuget-vulnerability-overrides

Override transitive NuGet dependency versions to resolve vulnerability warnings.

Community
Intermediate
OneWave-AIOneWave-AI
245

code-review-pro

Review code for security vulnerabilities, performance bottlenecks, and maintainability issues.

Official
Basic
GoldenWing-360GoldenWing-360
15

dependency-supply-chain

Audit dependencies and enforce lockfile hygiene to detect supply chain threats.

Official
Intermediate