Repository navigation
chore: add agent skills from github/awesome-copilot - #336
Merged
Merged
Conversation
Adds 7 skills under .github/skills/ (source commit cb64ad1).
Contributor
Reviewer's GuideInstalls seven agent skills under File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
🔒 Security Analysis ReportSecurity Analysis ReportGenerated: Sat Oct 17 01:08:51 UTC 2026 Bandit Security ScanPip-Audit Results |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: b5cd3a99bb
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Hey - I've found 3 issues
Prompt for AI Agents
Please address the comments from this code review:
## Individual Comments
### Comment 1
<location path=".github/skills/conventional-commit/SKILL.md" line_range="20-23" />
<code_context>
+2. Run `git diff` or `git diff --cached` to inspect changes.
+3. Stage your changes with `git add <file>`.
+4. Construct your commit message using the following XML structure.
+5. After generating your commit message, Copilot will automatically run the following command in your integrated terminal (no confirmation needed):
+
+```bash
+git commit -m "type(scope): description"
+```
+
</code_context>
<issue_to_address>
**Commit message runs shell commands**
When an attacker-controlled diff influences the generated commit message and the agent executes the suggested command, copilot inserts the generated message into a double-quoted shell command, so shell metacharacters in a message influenced by attacker-controlled changes execute as commands before the commit. This gives those commands the agent's local access.
Pass the message as a separately quoted process argument or through a message file rather than interpolating it into a shell command.
</issue_to_address>
### Comment 2
<location path=".github/skills/github-actions-hardening/references/triggers-and-privilege.md" line_range="13-14" />
<code_context>
+| --- | --- | --- | --- | --- |
+| `push` | Repo collaborators | read/write | yes | Low — trusted authors |
+| `pull_request` (same-repo branch) | Collaborators | read/write | yes | Low |
+| `pull_request` (from a fork) | **Anyone** | **read-only** | **no** | Low by design — even malicious code can't steal anything |
+| `pull_request_target` | **Anyone with a fork** | **read/write** | **yes** | **High** — runs in base-repo context |
+| `workflow_run` | Fires after another workflow | **read/write** | **yes** | **High** |
+| `issue_comment`, `issues` | **Anyone** | **read/write** | **yes** | **High** |
</code_context>
<issue_to_address>
**Trigger labels ignore effective permissions**
When fork PRs are configured to receive write tokens or secrets, or a privileged-trigger workflow/job explicitly restricts its token permissions, the trust guidance assigns privileges solely by trigger: it says fork `pull_request` runs have no secrets and a read-only token, and treats privileged-trigger code execution as CRITICAL. Repository settings can grant write tokens to fork PRs, while workflow or job `permissions` can restrict a privileged-trigger token, so the audit can both suppress real exposure findings and raise false CRITICALs.
Assess repository fork-PR settings and the effective workflow/job permissions before assigning trust or severity, and state assumptions when those settings cannot be inspected.
Also at `.github/skills/github-actions-hardening/SKILL.md:78`, `.github/skills/github-actions-hardening/SKILL.md:138-139`.
</issue_to_address>
### Comment 3
<location path=".github/skills/README.md" line_range="4" />
<code_context>
+# Agent skills
+
+Installed from [github/awesome-copilot](https://github.com/github/awesome-copilot) at commit `cb64ad12e32737ae764becd6885462e9b4c7cb00`.
+Read by Copilot (cloud agent, code review, CLI, VS Code agent mode) and Claude Code.
+
+| Skill | Purpose |
</code_context>
<issue_to_address>
**Claude Code does not load the skills**
When claude Code uses its default project skill discovery, claude Code looks for project skills under `.claude/skills/`, but the README advertises skills installed only under `.github/skills/`; Claude Code ignores them, so users cannot invoke the advertised skills.
Install or link the skills under `.claude/skills/`, or remove the Claude Code support claim.
</issue_to_address>Sourcery assessment
Needs a human reviewer. 3 findings to address first, and the conventional-commit skill tells the agent to stage changes and commit without confirmation, and the release skill can push a branch and open a PR. Those repository changes and any resulting notifications remain after reverting this PR, though they are normally bounded and repairable.
Blocking findings: .github/skills/conventional-commit/SKILL.md:23, .github/skills/github-actions-hardening/references/triggers-and-privilege.md:14, .github/skills/README.md:4
Claude Code only loads project skills from .claude/skills/, and Copilot reads that path too, so one copy now serves both. .gitignore re-includes .claude/skills/ while keeping the rest of .claude/ ignored. github-release and conventional-commit are removed: they bypass this repo's own release automation, and conventional-commit commits without confirmation. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01CeXGfVNFFTFVtXdALdSQ1g
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01CeXGfVNFFTFVtXdALdSQ1g
🔒 Security Analysis ReportSecurity Analysis ReportGenerated: Sat Oct 17 01:36:38 UTC 2026 Bandit Security ScanPip-Audit Results |
🔒 Security Analysis ReportSecurity Analysis ReportGenerated: Sat Oct 17 01:37:35 UTC 2026 Bandit Security ScanPip-Audit Results |
…ils, drop pytest-coverage - .gitignore: `.claude/*` only matched the repo root, so nested `.claude/` folders (tests/.claude/settings.json, docs/**/.claude/worktrees/...) became trackable. Use `**/.claude/*` and re-include only `/.claude/skills/` (verified with core.ignorecase on and off). - .pre-commit-config.yaml: top-level `exclude: '^\.claude/skills/(?!README\.md$)'` so markdownlint --fix / end-of-file-fixer cannot rewrite (74 fixable) or reject (82 unfixable) the verbatim upstream copy; the repo-owned README stays linted. - CLAUDE.md "Vendored Agent Skills" + AGENTS.md "Agent Skills": repo rules win over the skills; no PR merges/approvals/auto-merge or @dependabot commands (the dependabot skill suggests `gh pr merge --auto`), no installs, report-only audits, the 85% coverage floor and --maxfail CLI override. - Drop pytest-coverage: its 100% target and loop conflict with the 85% floor and the ML-extras skips. - README.md rewritten (it failed markdownlint) and records what is not vendored, including the docs-sync-audit/test-gap-audit helper scripts that `.gitignore`'s `[Ss]cripts` rule had silently left out. - AGENTS.md: correct the stale "pytest.ini … 70% baseline" line. - CHANGELOG: Unreleased → Added entry. Remaining vendored files unchanged (byte-identical to upstream cb64ad1). Full suite: 2833 passed, 16 skipped. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
🔒 Security Analysis ReportSecurity Analysis ReportGenerated: Mon Oct 19 04:26:25 UTC 2026 Bandit Security ScanPip-Audit Results |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds agent skills under
.claude/skills/. Claude Code loads them as project skills, and GitHub Copilot (cloud agent, CLI, VS Code agent mode) reads the same path.dependabotdocs-sync-auditgithub-actions-hardeningpytest-coveragetest-gap-auditAlso in this PR:
.gitignorere-includes.claude/skills/and keeps the rest of.claude/ignored.LICENSEships alongside the skills.Source: github/awesome-copilot, vendored verbatim at the commit recorded in
.claude/skills/README.md.github-releaseandconventional-commitwere deliberately left out because they conflict with this repo's release and commit workflow. No skill pre-approvesshell/bash.The open review threads are about the upstream skill content itself and are waiting on the owner's call.
https://claude.ai/code/session_01CeXGfVNFFTFVtXdALdSQ1g
Generated by Claude Code
Summary by Sourcery
Add and document vendored agent skills that support dependency management, documentation audits, workflow security reviews, and test coverage audits.
New Features:
Enhancements:
Documentation:
Chores: