microsoft/apm-usage
packages/apm-guide/.apm/skills/apm-usage/SKILL.md
Activate when the user asks about APM (Agent Package Manager): installing, configuring, authoring, or troubleshooting AI-agent packages, dependencies, compilation, MCP servers, policy, or any `apm` CLI command.
$ install --global
skillsauthnpx skillsauth add microsoft/apm apm-usageInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Apr 16, 2026, 6:00 AM4.7s9 files scanned
SKILL.md
- name:
- apm-usage
- description:
- >
- Activate when the user asks about APM (Agent Package Manager):
- installing,
APM Usage
APM (Agent Package Manager) is the open-source package manager for AI coding agents. It lets teams install, share, and govern reusable instructions, prompts, agents, skills, and MCP server configurations across projects.
When to activate
- User mentions
apmor "Agent Package Manager" - Questions about installing or managing AI-agent packages
- Setting up instructions, prompts, agents, skills, or chatmodes
- Configuring MCP servers through apm.yml
- Authentication for private repos (GitHub, ADO, GHES, Artifactory)
- Policy enforcement or
apm audit - Package authoring or publishing
- Compiling agent context (
apm compile) - Troubleshooting apm errors
Key rules
- Commit these files: apm.yml, apm.lock.yaml, .apm/, .github/, .claude/, .cursor/
- Never commit: apm_modules/ (add to .gitignore)
- Team sync: after
git clone, runapm installto restore dependencies - Update deps:
apm install --updaterefreshes to latest refs - Pin versions: use tags (
#v1.0.0) in production, branches for development - ASCII only: all CLI output and source must stay within printable ASCII
Reference
For detailed guidance, see the following resources:
- Installation -- install and update APM
- Workflow -- core workflow, apm.yml format, what to commit
- Commands -- full CLI command reference
- Dependencies -- all dependency formats and version pinning
- Authentication -- token setup for private repos
- Governance -- policy engine and audit checks
- Package Authoring -- creating APM packages
- Troubleshooting -- common errors and fixes
Related Skills
microsoft/shepherd-driver
testing
VerifiedTrustedCommunity
Use only as the composed drive-to-merge stage of an APM batch orchestrator (batch-bug-shepherd, apm-issue-autopilot) that has already selected ONE open pull request in microsoft/apm. Do NOT use for user-facing requests to triage issues, sweep a queue, or open PRs -- the parent orchestrator owns those. Spawn one shepherd-driver subagent per PR: it classifies copilot-pull-request-reviewer[bot] inline review, runs the apm-review-panel, folds (by default) every recommendation inside the PR's stated scope, pushes to the head branch or a superseding PR that preserves authorship via commit trailers, watches CI to green, and iterates under fixed caps until ready-to-merge, advisory-with-deferred, superseded, or blocked. Also provides the cross-PR conflict-resolution and mergeability-gate phase. This is NOT a standalone entrypoint.
2,734SKILL.mdUpdated Jun 3, 2026
microsoft/pr-description-skill
testing
VerifiedTrustedCommunity
Use this skill to write the PR description (PR body) for any pull request opened against microsoft/apm. Produces one self-sufficient GitHub-Flavored Markdown artifact: TL;DR, Problem (WHY), Approach (WHAT), Implementation (HOW), 1-3 validated mermaid diagrams, explicit trade-offs, validation evidence, and a How-to-test section -- with every WHY-claim backed by a verbatim quote from PROSE or Agent Skills. Activate when the user asks to "write a PR description", "draft a PR body", "open a PR", "fill in the PR template", or any equivalent.
2,734SKILL.mdUpdated Jun 3, 2026
microsoft/apm-triage-panel
testing
VerifiedTrustedCommunity
Use this skill to triage a single newly opened, reopened, or `status/needs-triage`-labelled issue in microsoft/apm. Emit one synthesized comment with a triage decision, label set, milestone, and suggested next action.
2,734SKILL.mdUpdated Jun 3, 2026
microsoft/apm-review-panel
tools
VerifiedTrustedCommunity
Use this skill to run a multi-persona expert advisory review on a labelled pull request in microsoft/apm. The panel fans out to five mandatory specialists plus a test-coverage specialist (active on every PR that touches src/) plus three conditional specialists (auth, doc-writer, performance-expert), all running in their own agent threads, and a CEO synthesizer. The orchestrator is the sole writer to the PR: ONE recommendation comment, no verdict labels, no merge gating. The panel is advisory -- it surfaces findings, prioritizes follow-ups, and renders a ship-recommendation that the maintainer and author weigh. Activate when a non-trivial PR needs a cross-cutting recommendation (architecture, CLI logging, DevX UX, supply-chain security, growth/positioning, optionally auth, docs, perf, and test coverage, with CEO arbitration).
2,451SKILL.mdUpdated May 22, 2026