github

Two related workflows for a locally-cloned codebase, in one skill. Documentation mode produces a single, comprehensive, verifiable architecture document primarily by reading files on disk (local-first) — use it whenever the user wants to understand, map, document, research, or onboard onto a codebase ("research this repo", "write up the architecture", "do an architecture deep dive", "document how this codebase works", "map the system design", "create an onboarding doc"). Modernization mode generates a phased plan to modernize, migrate, upgrade, or rewrite a legacy system ("modernize this", "plan the migration", "how would we rewrite this", "how do we get off this legacy stack"); if no architecture document exists yet it first runs Documentation mode, then continues straight through to the plan. It assumes the legacy stack may be dead, runs a time-boxed feasibility spike, and picks the highest achievable rung on a safety ladder instead of demanding a fully-green legacy CI gate up front.

Review the implementation source code of MCP (Model Context Protocol) servers, clients, and tool handlers against a security baseline — authentication, sessions, rate limiting, input-schema validation, official-SDK usage, RCE vectors, and the OWASP MCP Top 10 — producing a report with file/line evidence. Use this skill when: - Reviewing an MCP server implementation for security before release - Checking a server against the baseline controls (MCP-01 to MCP-05) and the OWASP MCP Top 10 - Auditing tools for RCE vectors (command/code injection, unsafe deserialization, path traversal, SSTI, dependency hijacking, SSRF) - Verifying auth, session, rate-limiting, and input-validation controls on a network-exposed server - Reviewing MCP client code that handles untrusted server responses and session IDs - Requests like "review this MCP server for security" or "is my MCP server implementation secure?"

Ongoing development guidance for agentic web apps that pair a CopilotKit frontend with Microsoft Agent Framework agents on Azure AI Foundry hosted agents over the AG-UI protocol - add and gate agent tools, wire human-in-the-loop approvals, build generative UI and shared state, debug the event stream, upgrade pre-1.0 packages safely, and deploy hosted agent updates.

Experimental (preview) Pester skill for migrating classic Should -Be (v5) assertion syntax to the new Should-* (v6) assertions (note the hyphen, no space), e.g. `Should -Be` -> `Should-Be`, `Should -Not -Be` -> `Should-NotBe`. Tracks Pester 6, which is still a release candidate, so this guidance may change; verified against Pester 6.0.0-rc2. Use when converting Pester v5 assertions to Pester v6 Should-* operators, modernizing a Pester test suite, or when a user asks to migrate, convert, or rewrite `Should -...` calls in .Tests.ps1 / PowerShell files.

Route gh-aw workflow design/create/debug/upgrade requests to the right prompts.

Experimental (preview) Pester migration skill for upgrading PowerShell Pester test suites across major versions — v3→v4, v4→v5, and v5→v6. The v5→v6 path tracks Pester 6, which is still a release candidate, so that guidance may change. Covers the Discovery/Run two-phase model, moving setup into BeforeAll, $PSScriptRoot vs $MyInvocation, mock changes (Assert-MockCalled → Should -Invoke, removed fall-through), Invoke-Pester parameters → PesterConfiguration, data-driven -ForEach/-TestCases, and the v6 breaking changes. Use when the user asks to upgrade, migrate, or modernize Pester tests, fix *.Tests.ps1 files that broke after bumping the Pester version, or convert legacy Should / Invoke-Pester syntax.

Copilot left 14 review comments on your PR — half are nits. Hours of fix → reply → resolve → re-request, and each round lands MORE comments. This skill runs loop engineering: auto-triggers Copilot Code Review via GraphQL (no @copilot mention), triages every open thread (Copilot, humans, advanced-security) with a fix / decline / escalate rubric, dispatches parallel fix sub-agents that obey the repo build/test/lint conventions, commits per iteration, replies+resolves citing the pushed SHA, then re-triggers until HEAD is reviewed with zero threads awaiting the agent's reply (remaining open threads are explicit hand-offs to the human — escalated declines, design tradeoffs). You merge a clean PR; the bot runs it. Trigger phrases: "address copilot comments", "run a copilot review loop", "fix this PR", "iterate on copilot feedback". Repo-agnostic, gh CLI + PowerShell. Full autopilot needs repo Triage/Write; external PR authors get single-iteration mode plus manual re-trigger (UI 🔄 or substantive-commit push).

Create a new implementation plan file for new features, refactoring existing code or upgrading packages, design, architecture or infrastructure.

Reference for GitHub MCP server tools, methods, and usage patterns.

Route gh-aw workflow design/create/debug/upgrade requests to the right prompts.

Define and validate GitHub custom agent files, prompts, and examples.

Author, validate, and debug canvas extensions that the agent can open in the GitHub Copilot app's side panel. Use when creating, reviewing, or troubleshooting a canvas extension — including its actions, inputs, rendered content, and the surrounding extension wiring (tools, hooks, lifecycle).

Infer JSON structure and types with jq-based schema discovery.

Analyze and reduce token consumption in agentic workflows — guardrail-specific entry points, measurement, and optimization techniques.

Implement secret-safe HTTP headers for MCP transport in gh-aw.

Review code that performs git or gh operations against repository checkouts in gh-aw, checking that the right credentials are available at the right time and that sparseness, shallowness and credential-free factors are properly considered.

Install, run, and fix errors from actionlint — the GitHub Actions workflow linter. Load when validating `.github/workflows/*.yml` files after migration or generation.

Azure DevOps migration to GitHub Actions — syntax mappings and the migration report template for YAML pipelines, templates, variable groups, service connections, deployment jobs, stages, conditional logic. Load with `migration-core` when migrating Azure DevOps sources to GitHub Actions.

Bamboo migration to GitHub Actions — syntax mappings and the migration report template for Build plans, deployment projects, tasks, requirements, variables, plan branches. Load with `migration-core` when migrating Bamboo sources to GitHub Actions.

Bitbucket Pipelines migration to GitHub Actions — syntax mappings and the migration report template for Pipelines, Pipes, parallel steps, branch/pull-request workflows, deployments, variables. Load with `migration-core` when migrating Bitbucket Pipelines sources to GitHub Actions.

CircleCI migration to GitHub Actions — syntax mappings and the migration report template for Workflows, jobs, Orbs, executors, contexts, parameters, matrix jobs, approval gates. Load with `migration-core` when migrating CircleCI sources to GitHub Actions.

Drone CI migration to GitHub Actions — syntax mappings and the migration report template for Pipelines, plugins, services, secrets, triggers, multi-platform pipelines. Load with `migration-core` when migrating Drone CI sources to GitHub Actions.

GitLab CI migration to GitHub Actions — syntax mappings and the migration report template for Pipelines, includes, Pages, environments, rules/only/except, parallel jobs, GitLab-specific variables. Load with `migration-core` when migrating GitLab CI sources to GitHub Actions.

Jenkins migration to GitHub Actions — syntax mappings and the migration report template for Pipelines (declarative + scripted), shared libraries, Groovy scripts, credential bindings, agent labels, parallel stages, plugin replacements. Load with `migration-core` when migrating Jenkins sources to GitHub Actions.

Use the AWF (Agentic Workflow Firewall) to run commands with network isolation and domain whitelisting. Provides L7 HTTP/HTTPS egress control for AI agents.

Prepare an open pull request for merge from a GitHub Copilot cloud agent. Drives Reviews, local validation, and Mergeable to a ready state. Does not merge, and cannot trigger CI.

Regenerate and post-process all agentic workflows. Use when gh-aw is updated, workflow .md files change, or when asked to recompile/regenerate workflows.

Use the AWF (Agentic Workflow Firewall) to run commands with network isolation and domain whitelisting. Provides L7 HTTP/HTTPS egress control for AI agents.

Debug the AWF firewall by inspecting Docker containers (awf-squid, awf-agent), analyzing Squid access logs, checking iptables rules, and troubleshooting blocked domains or network issues.

Practical Python scripts for debugging awf - parse logs, diagnose issues, inspect containers, test domains

Debug GitHub Actions workflows by downloading logs, analyzing summaries, and understanding how agentic workflows and the AWF firewall work together.

Team code quality checklist - use for checking Python code quality, bugs, security issues, and best practices

Generate conventional commit messages - use when creating commits, writing commit messages, or asking for git commit help

A minimal skill example - use when learning the skill format

Generate comprehensive pytest tests - use when generating tests, creating test suites, or testing Python code

Use this skill when creating a new Java E2E integration test (failsafe IT) that requires a new replay proxy YAML snapshot file in test/snapshots/

Use this skill whenever editing `*.java` files in the `java/` directore of the SDK in order to write idiomatic, well-structured Java code for the Copilot SDK

Use this skill whenever editing `*.rs` files in the `rust/` SDK in order to write idiomatic, efficient, well-structured Rust code

Review and refine GitHub Well-Architected Framework (WAF) documentation under the content/ folder for clarity, precision, consistency, and publication readiness. Use this when reviewing pull requests, markdown files, or draft content in content/ to ensure guidance is unambiguous, readable, and aligned with editorial standards.

Validate and improve GitHub Well-Architected Framework (WAF) documentation under the content/ folder for architectural correctness, decision quality, explicit trade-offs, and actionable guidance. Use this when reviewing pull requests, markdown files, or draft content in content/ to ensure recommendations are technically sound, context-aware, and guide readers toward correct architecture and design decisions.

Scan repository dependencies for known vulnerabilities using the GitHub MCP Server's Dependabot toolset and the GitHub Advisory Database. Use when asked to check dependency security, audit lockfiles, or verify packages before merging.

Scan files, content, or recent changes for secrets such as API keys, passwords, tokens, and credentials using the GitHub MCP Server's run_secret_scanning tool.

Instructions for using the struct tag-based console rendering system in Go

Error Message Style Guide for Validation Errors

Add a community extension to the Spec Kit catalog from a GitHub issue submission. USE FOR: processing extension submission issues, validating catalog entries, updating catalog.community.json and docs/community/extensions.md, creating PRs. DO NOT USE FOR: creating new extensions from scratch, or first-party extension work.

Comprehensive guidance for building web apps with opinionated defaults for tech stack, design system, and code standards. Use when user wants to create a new web application, dashboard, or interactive interface. Provides tech choices, styling guidance, project structure, and design philosophy to get users up and running quickly with a fully functional, beautiful web app.

Route gh-aw workflow design/create/debug/upgrade requests to the right prompts.