Managing Agent Context with Agent Package Manager: Versioning, Pinning, and Policy Enforcement

In a Zero to Agent in 30 Minutes episode, Microsoft senior solution engineer Maxim Salnikov demonstrated the Agent Package Manager (APM), an open-source, terminal-driven tool from Microsoft designed to manage the customizations installed for AI agents. APM treats agent context—skills, custom instructions, hooks—the same way modern software treats dependencies: with versioning, pinning, and checks before shipping.

Why this matters

Developers frequently install agent skills and other customizations from public repositories, and those files can become scattered across user profiles, application folders, and codebases with no consistent record of origin or subsequent changes. That lack of traceability raises security and reproducibility concerns.

How APM works, step by step

• Keep customizations in the codebase: Salnikov recommends storing agent skills, custom instructions, and hooks in the project codebase so that anyone on a new machine or using a new harness gets the same configuration. While this enlarges the codebase, the consistency trade-off is intentional. However, ensure skills are secure before adding them to the codebase and consider building a vetted enterprise repository of approved customizations.

• Install APM and initialize a project: APM acts like npm for agent customizations. Running apm init creates an apm.yaml file that targets one or more harnesses (for example, GitHub Copilot, Claude Code, or Cursor). apm install pulls a skill from a repository into the correct location for each harness. APM also generates a log file documenting the entire resolution history when a skill is installed.

• Pin to a version or commit hash: After installation, pin the skill to a specific version or commit hash, much like pinning a library dependency. This prevents scenarios where a previously legitimate skill is later compromised and a malicious version is published under the same name. APM additionally scans files for hidden Unicode characters that could contain malicious instructions.

• Reproduce exact setups with a lock-style log: APM logs every installed file and hash. Running apm install --frozen rebuilds the exact environment from that log instead of re-resolving from apm.yaml, ensuring a teammate’s machine ends up with the precise same setup.

• Source from a vetted registry and enforce policy: Public repositories are useful for experimentation, but Salnikov suggests enterprises maintain a private, gated registry of reviewed skills. APM policy files enforce which sources are approved and flag customizations from unvetted locations.

• Audit for drift and enforce in CI: The apm audit command checks installed customizations against policy and detects unauthorized sources or content that has changed since installation. Running the same audit as a gate in a CI/CD pipeline helps protect the organization from skill drift and malicious actors.

Conclusion

Software supply-chain practices have mature tooling behind them, but those disciplines have not fully extended to agentic AI. APM aims to close that gap by introducing versioning, pinning, registry controls, and auditability for agent context.

What’s next on the show

On September 9, Menyala’s Sajal Sharma will appear on Zero to Agent in 30 Minutes to demonstrate building a shared knowledge base that acts as a common brain across agents. He will show how a single repository of research, logs, and notes can provide Claude Code, Codex, OpenClaw, and Hermes with the same accumulated information rather than starting from zero each session.

Follow Zero to Agent in 30 Minutes on Radar, or watch the latest episode on YouTube, Spotify, Apple, or other podcast platforms. O’Reilly members can watch live.