install-apm-package — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited install-apm-package (Agent Skill) and scored it 87/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 3 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 3 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
This skill manages the safe deployment of APM primitives into their respective runtime environments. It enforces validation and target discovery to ensure byte-identical reproducibility across environments.
.agents/, .github/, or .claude/ directly. Always edit the source in .apm/ and re-install.apm.lock.yaml MUST be committed after any install change.validate_apm_package.py before executing the install.apm install from the project root to ensure converged skills land in the authoritative .agents/ folder. Running inside a package directory creates local, isolated artifacts.apm install ./path-to-package from the project root.apm install from within the package directory..claude/ exists) -> Run apm install.apm install will exit with code 2; ask user for explicit --target (e.g., agent-skills, claude, all)..agents/skills/. Use --target agent-skills for explicit skill deployment.--legacy-skill-paths flag.--frozen flag to ensure lockfile compliance.apm.yml existence (locally or at root).python scripts/validate_apm_package.py.cd <repo-root>cd <package-dir>apm install [--target <slug>] --dry-run --verbose.apm install [./relative-path-to-pkg] [--target <slug>] [--legacy-skill-paths].--target all,agent-skills to deploy to all harnesses AND converged skills.apm.lock.yaml update at the execution root.Before recommending all,agent-skills, check whether the user is doing:
For smoke tests, all,agent-skills is appropriate. For real use, prefer the smallest target list that matches the runtime. Installing both converged and target-specific skills may cause duplicate skill visibility in runtimes that scan multiple skill locations.
.github/agents/ by hand instead of using apm install.apm.lock.yaml after adding a dependency..apm/ source.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.