apm-package-author — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited apm-package-author (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Invoke this skill when the user asks to:
If the user asks to "add a package to the marketplace" or "publish an APM package", redirect to the apm-marketplace-publisher skill instead.
Before writing any files, classify the content against this decision tree. Choose the single correct primitive per unit of content.
| Content nature | Primitive | Reasoning |
|---|---|---|
| Always-on policy rules, style guides, conventions | instructions | Implicit — compiled into AGENTS.md, active when files matching applyTo are touched |
| Multi-step procedural workflow, task guide | skill | Explicit — SKILL.md with description as agent router trigger |
| Saved user command, prompt template | prompts | Manual — user types command name |
| Both always-on rules AND on-demand workflows in one package | hybrid | Combines instructions + skills (or other primitives) |
Gate questions (from the custom-skill-creator heuristic):
AGENTS.md.Do not create a skill.
For a detailed analysis of each primitive, see references/primitives-decision-framework.md.
Create the directory with mandatory files:
packages/<name>/
apm.yml # Required: package manifest
.apm/ # Required: primitives directory
instructions/ # .instructions.md files (if type: instructions or hybrid)
skills/ # SKILL.md per skill (if type: skill or hybrid)
<skill-name>/
SKILL.md
references/ # Optional: on-demand reference files
prompts/ # .prompt.md files (if type: prompts)apm.yml fieldsSee references/package-anatomy.md for the complete field reference with types and defaults.
Minimal valid apm.yml:
name: my-package
version: 0.4.2
type: skill # or instructions, hybrid, prompts
includes: auto.apm/ contentstype | Populate .apm/ with |
|---|---|
instructions | .apm/instructions/*.instructions.md |
skill | .apm/skills/<name>/SKILL.md |
hybrid | Any combination of instructions/, skills/, prompts/, agents/ |
prompts | .apm/prompts/*.prompt.md |
Dispatch to the appropriate reference based on your chosen type:
| Primitive | Reference |
|---|---|
| Instruction files | references/writing-instructions.md |
| SKILL.md for skills | references/writing-skills.md |
| Prompt files | references/writing-prompts.md |
| HYBRID dual-description model | references/hybrid-packages.md |
Skills can use references/ to keep the main SKILL.md body slim (aim for under 500 lines). Load references on demand when the agent needs depth. See references/writing-skills.md for the pattern.
Before proceeding to marketplace registration, run these two commands:
just fmt # yamlfmt — formats apm.yml + packages/*/apm.yml
just yaml-validate # check-jsonschema against schemas/apm.jsonResolve any failures. The package is now structurally valid and ready for marketplace registration — use the apm-marketplace-publisher skill for that phase.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.