agent-package-manager
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides instructions to download and install the APM CLI tool using official Microsoft short-links (
https://aka.ms/apm-unixandhttps://aka.ms/apm-windows). These are documented in the troubleshooting section for user-initiated installation. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process external manifest files (
apm.yml) and lockfiles. This represents an inherent attack surface where malicious third-party packages could include deceptive metadata or instructions. However, the skill includes verification steps such as--dry-runand lockfile validation to mitigate these risks. - [COMMAND_EXECUTION]: The skill uses standard shell commands to manage files and run the
apmCLI. All commands are consistent with the stated purpose of a package management tool.
Audit Metadata