[skill-update] agent-package-manager-skill-update: clarify default transitive MCP security

[github-actions]

Summary

Updates skills/agent-package-manager to reflect the APM homepage's explicit Secure by default guarantee for transitive MCP server blocking.

Material Deltas Found

Gap: The previous skill documented two security mechanisms separately but did not clearly state that transitive MCP blocking is a default behavior (not only a policy-driven one):

• SKILL.md item 10 only mentioned hidden-Unicode and content-hash scanning
• SKILL.md item 11 only mentioned MCP blocking in the context of apm-policy.yml
• manifest-and-lockfile.md Policy governance section implied blocking required a policy file

Source justification: APM homepage [Secure by default card]((microsoft.github.io/redacted) "Every install scans for hidden Unicode, pins content hashes, and blocks transitive MCP servers unless they are explicitly declared or trusted. No opt-in required."

Files Changed

File	Change
skills/agent-package-manager/SKILL.md	Step 3 item 10: added default transitive MCP blocking note; item 11: clarified policy adds restrictions on top of the default block
skills/agent-package-manager/references/manifest-and-lockfile.md	Policy governance section expanded to distinguish the two-layer security model (default block + optional policy layer)

Validation

• Metadata validator: SUCCESS (name and description unchanged)
• SKILL.md line count: 67 (well under 500-line limit)
• Checklist reviewed: all items pass

Unresolved Risks

• The prefetched source is only the APM homepage HTML (`(microsoft.github.io/redacted) The fuller CLI reference, manifest schema, and governance guide pages were not fetched. The behavioral claim in item 10/11 is consistent with the homepage and existing policy documentation, but cannot be fully verified against the governance guide without fetching that page.
• The exact semantics of "trusted" (i.e., what constitutes a trusted transitive MCP — explicit policy allowlist vs. registry trust level) is not detailed in the homepage; this skill uses the homepage wording verbatim to avoid over-specifying.

Generated by Skill Update Worker · ● 20.3M · ◷