apm-migration — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited apm-migration (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
apm-migration)Follow this 6-phase procedure when migrating a consumer project to APM. The procedure was validated across 11 project migrations during the May 2026 APM transition.
Determine whether the project is greenfield (no pre-existing AI context files) or brownfield (has AGENTS.md or GEMINI.md).
Run: ls AGENTS.md GEMINI.md 2>/dev/null
Run: git ls-files AGENTS.md GEMINI.md 2>/dev/nullRecover pre-existing tribal knowledge before scaffolding replaces the generated files.
git log --oneline -- AGENTS.md GEMINI.md git show <sha>:<file> > /tmp/<file>.recovered.gitignore, or working-tree only):.apm/instructions/<project>.instructions.md..apm/instructions/<project>.instructions.md: ---
description: <project> project conventions
applyTo: "**"
---
# <project> Tribal Knowledge
## Hierarchy (Rule 0)
- This file overrides global mandates for this project.
<original content here>AGENTS.md and GEMINI.md), merge their content into one instructions file with clear section boundaries. Do not create duplicate instructions.Create the APM manifest and project-level instructions. This phase applies to both greenfield and brownfield paths from this point onward.
apm.ymlname: <project-name>
targets:
- opencode
- copilot
dependencies:
apm: []
includes: auto<project-name> must be the repository name in kebab-case.dependencies.apm empty — packages are installed in Phase 4.claude, gemini, codex)..apm/instructions/<project>.instructions.md (if not already present from Phase 2)---
description: <project> project conventions
applyTo: "**"
---
# <project> Tribal Knowledge
## Hierarchy (Rule 0)
- This file overrides global mandates for this project..gitignoreRead the existing .gitignore first to preserve all original entries. Then append:
apm_modules/
.agents/
.opencode/
.github/instructions/
.github/prompts/
.github/agents/
.github/hooks/
.github/copilot-instructions.md
AGENTS.md
GEMINI.mdIf .gitignore does not exist, create it with only the APM block. If the project already has some of these entries, do not duplicate them.
Ask the user which packages to install. If the user defers, detect from project type:
| Project type | Recommended packages |
|---|---|
| General software | development-practices, ci-cd-standards |
| Arch Linux packaging | development-practices, ci-cd-standards, aur-package-management |
| FreeCAD development | development-practices, freecad-development |
| AI context development | development-practices, init-project-guidance, custom-skill-creator |
apm install <package>@<marketplace> <package>@<marketplace> ...If apm install exits with code 128 — a known APM bug caused by --shared flag on shallow clones (affects APM internals with certain git versions) — use the local-path fallback:
git clone https://github.com/pngdeity/apm-user-repository /tmp/apm-marketplace
apm install /tmp/apm-marketplace/packages/<package> /tmp/apm-marketplace/packages/<other-package>
rm -rf /tmp/apm-marketplaceapm compile --target opencode,copilotAdd additional --target flags for any harnesses declared in apm.yml.
If apm compile fails, verify that all packages installed successfully and that apm.yml targets match the compile flags.
If AGENTS.md or GEMINI.md were previously tracked by git:
git rm --cached AGENTS.md GEMINI.mdThese files are now generated by apm compile and must not be committed.
git add apm.yml apm.lock.yaml .gitignore .apm/instructions/Never stage generated files (AGENTS.md, GEMINI.md, .github/copilot-instructions.md, .github/instructions/, .github/prompts/, .github/agents/).
git commit -m "Add APM manifest with <package-list>"Sign the commit if the project requires signed commits (git commit -S).
Run each check and report the result as [✓] or [✗] with details for any failures.
1. git show --stat HEAD — only source files committed
2. cat apm.yml — correct targets, includes: auto
3. cat .gitignore — all original entries preserved + APM block
4. head -30 AGENTS.md — tribal knowledge present, APM sections present
5. apm compile --target ... — exits 0
6. git status --short — cleanExpected results:
[✓] git show --stat HEAD — apm.yml, apm.lock.yaml, .gitignore, .apm/instructions/
[✓] apm.yml — targets opencode, copilot
[✓] .gitignore — original entries preserved + APM block
[✓] AGENTS.md — tribal knowledge + APM sections
[✓] apm compile --target opencode,copilot — exits 0
[✓] git status --short — cleanIf any check fails:
git reset HEAD <file>.apm.yml targets and recompile..gitignore..apm/instructions/<project>.instructions.md contains original content and recompile.apm.yml..gitignore or clean with git clean -fd --exclude=!apm_modules --exclude=!.agents.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.