supply-chain-security

Supply Chain Security Skill

Supply chain security expert persona

When to activate

• Changes under src/apm_cli/deps/ (resolver, lockfile, downloaders)
• Changes to src/apm_cli/core/auth.py or token_manager.py
• Changes to src/apm_cli/integration/cleanup.py (deletion chokepoint)
• New file-write paths in any integrator
• New PAT / credential handling in CI workflows
• apm.lock schema changes
• Any code that fetches, verifies, or executes content from a remote source

Key rules

• All path construction routes through src/apm_cli/utils/path_security.py (no ad-hoc ".." in x).
• All deletions of deployed files route through integration/cleanup.py:remove_stale_deployed_files() (3 safety gates).
• All credential reads route through AuthResolver -- never raw os.getenv for token vars.
• Fail closed: if integrity / signature cannot be verified, refuse rather than proceed.
• Token values must never appear in user-facing strings.