Process the top Todo card on a GitHub Project (v2) board end-to-end: pull the board into a task-agent `tasks.yml`, run `task-agent` to open a PR for the top pending task, sync the PR back to the card, then wait for Copilot to review the PR and apply fixes for actionable comments. Use when the user says "work on the next task", "do the next board task", "pick up the next GitHub project item", "process the next card", "work on the next item in github project", "run the next board task", "drain the top todo", "process the top board todo", "auto-process the next card", or any phrasing that means "take the next pending item from a GitHub Project board and implement it". Composes `gh-project-sync` → `task-agent` → `gh-project-sync` → `copilot-review-fixer` (skill wrapper shipped by `task-agent`) via the `workflow` skill against the fixed YAML at `${CLAUDE_PLUGIN_ROOT}/workflows/auto-board-task.yaml`. All arguments are forwarded verbatim to the workflow runner; validation happens there and inside the composed sub-sk
Reads unresolved Copilot review comments on a pull request and applies code fixes for actionable ones. Thin skill wrapper around the `copilot-review-fixer` sub-agent — callable as a workflow step.
Reads a list of tasks in a yaml to be done in certain github repos. Agents clone the repo, do the task, commit the changes and create a PR. Not to be called automatically by Claude by any means.
Reconciler between a GitHub Project (v2) board and a task-agent unified `tasks.yml`. Use when the user asks to "sync the project board with tasks.yml", "reconcile the GitHub project", "pull Todo cards into the task queue", "push completed tasks back to the board", or supplies both a project URL/number and a tasks file. Arguments use `key=value` grammar: `tasks=<path>` (required), one of `project_url=<url>` OR `project_owner=<owner> project_number=<n>` (required), optional `default_repo=<owner/repo>` (for draft cards without a linked issue), and optional column name overrides `todo_column=…`, `in_review_column=…`, `done_column=…`, `wont_do_column=…` (default: `Todo` / `In Review` (falling back to `In Progress` if the board has no `In Review` column) / `Done` / `Won't Do`). Idempotent — running it any number of times converges to the same state.
Scan all dependencies for outdated versions and known security vulnerabilities. Uses npm audit / pip-audit / cargo audit / bundler-audit with grep-based fallbacks when dedicated tools are unavailable. Produces a prioritised, read-only report. Use when the user asks to "audit dependencies", "check for vulnerabilities", "find outdated packages", "run a dependency audit", "check npm audit", "scan for CVEs in dependencies", or anything about dependency security or freshness.
Run a multi-step skill workflow declared in a workflow YAML file. Use when the user asks to "run the workflow at <path>", "execute workflow <name>", "run the <name> workflow", "chain these skills", "compose <skill-a> and <skill-b>", or supplies a path to a `.yaml` workflow definition. Arguments follow a `key=value` grammar: the first positional value is the workflow file path, remaining `key=value` pairs are workflow inputs. The runner executes steps strictly in order, halts on the first non-zero exit, and writes a summary JSON to the workflow directory.
Scan a codebase for OWASP Top-10 vulnerabilities, hardcoded secrets, insecure dependencies, and unsafe code patterns. Produces a read-only markdown report ranked by severity (Critical / High / Medium / Low). Use when the user says "security review", "scan for vulnerabilities", "check for secrets", "audit my code for security issues", "find OWASP issues", "check for hardcoded passwords", "security audit", or "find insecure patterns".
Read the project and suggest the 5 most valuable features or improvements the developer could build next. Use when the user asks "what should I build next?", "brainstorm ideas for this project", "what features are missing?", "how can I improve this?", "what's worth adding?", "give me ideas", or anything about deciding what to work on next. Also use when the user seems stuck or is asking for direction on their project. TRIGGER this skill whenever the user asks for ideas, suggestions, or "what next" guidance about their own codebase — even if they don't say "brainstorm" explicitly.