Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/microsoft/apm/supply-chain-securitynpx skills add microsoft/apm --skill supply-chain-securitygit clone --depth 1 https://github.com/microsoft/apmWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/microsoft/apm/supply-chain-security)<a href="https://agentmods.dev/skills/microsoft/apm/supply-chain-security"><img src="https://agentmods.dev/badge/skills/microsoft/apm/supply-chain-security.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00054 | $0.00326 |
| Opus 5 | $0.00027 | $0.00163 |
| Sonnet 5 | $0.00011 | $0.00065 |
| Haiku 4.5 | $0.00005 | $0.00033 |
Grade A, and why
supply-chain-security scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
Supply Chain Security Skill
Supply chain security expert persona
When to activate
- Changes under
src/apm_cli/deps/(resolver, lockfile, downloaders) - Changes to
src/apm_cli/core/auth.pyortoken_manager.py - Changes to
src/apm_cli/integration/cleanup.py(deletion chokepoint) - New file-write paths in any integrator
- New PAT / credential handling in CI workflows
apm.lockschema changes- Any code that fetches, verifies, or executes content from a remote source
Key rules
- All path construction routes through
src/apm_cli/utils/path_security.py(no ad-hoc".." in x). - All deletions of deployed files route through
integration/cleanup.py:remove_stale_deployed_files()(3 safety gates). - All credential reads route through
AuthResolver-- never rawos.getenvfor token vars. - Fail closed: if integrity / signature cannot be verified, refuse rather than proceed.
- Token values must never appear in user-facing strings.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago First seen · 37 lines · 54 tokens per session scan A 55ef10cd0f6b
supply-chain-security is a skill published in the GitHub repository microsoft/apm (3,687 stars, last pushed yesterday), licensed MIT. It adds 54 tokens to every session and 326 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
review
Review a proposed change before applying it.
create-skill-sample
This skill should be used when the user asks to "create a new skill sample", "add a skill", "scaffold a new skill", "contribute a skill", "create a GitHub Copilot skill", "build a custom skill", or needs to create a new GitHub Copilot custom skill sample with proper folder structure, SKILL.md, README, and sample.json…
create-system-prompt
This skill should be used when the user asks to "create an agent instruction", "add agent instructions", "scaffold an agent sample", "create a system prompt sample", "add a system prompt", "create a new agent", "build an agent", or needs to create a new agent instruction sample with proper folder structure, README…
mcp-server-review
Review a Model Context Protocol (MCP) server implementation against the 2026-07-28 protocol revision, which removed the initialize handshake and Mcp-Session-Id and made the protocol stateless. Use when the user asks to review, audit, upgrade or migrate an MCP server, asks whether their MCP server is spec compliant…
code-review-csharp
Perform structured code reviews of C# source code covering naming conventions, performance, security, readability, and .NET best practices. Trigger phrases include "review this C# code", "check my C# for best practices", "analyze this C# class", "find issues in my C# code".
prompt-of-the-week
Generates a weekly PowerPoint slide from a PnP copilot-prompts GitHub sample URL (for example, samples/agent-instructions/creator-agent), derives the correct weekly title from the sample folder, and produces a styled .pptx file that matches the Prompt-K template layout.