Updated marketplace.json and plugin.json to version 1.102.0, added gem-team plugin entry with 16 items, refined argument hints in multiple agent definitions, and updated planner, reviewer, and skill creator configurations.
* feat: add Windows app storage inspector canvas
* Apply suggestions from code review
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* fix: address storage inspector review findings
* Correction to package and plugin
* fix: harden storage inspector cleanup
* Harden cleanup operation outcomes
* Add select a file or folder path in the result tabs to navigate the treemap to its deepest visible parent folder.
* Fixes to ensure selftesst pass
---------
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* Enhance Oracle-to-PostgreSQL migration skills and documentation
- Update migration agent guidelines to prioritize extension tool usage for code migration.
- Refine migration phases with detailed steps for pre-migration review and schema migration.
- Add new reviewing skill references for PostgreSQL materialized view refresh and UNION ALL planner risks.
- Ensure consistency in collation handling and testing strategies across skills.
* - Review migration phases to ensure correct order of execution
- Add exit criteria to each migration phase
- Remove invocation of `ms-ossdata.vscode-pgsql` extension due to dependency on VSCode
- Update README.md to reflect changes in migration phases and exit criteria
- Update broken reference to custom agent in plugin.json
* Enhance downstream migration skills and following custom agent improvements
- Added new skill for migrating .NET data access code from Oracle to PostgreSQL.
- Updated README to include new migration skill.
- Improved existing skills with clearer file naming conventions and migration actions.
- Added reference documents for handling Oracle-specific functions and pagination.
- Created detailed guides for NVL, DECODE, ROWNUM, SYSDATE, and DUAL replacements.
* Clarify PostgreSQL schema immutability and stored procedure migration risks
* Update target schema path in migration documentation for clarity
* fix(skills): clarify Phase 3-only scope for Oracle test skills
Both Oracle test skills were ambiguously worded in ways that could
cause a model to invoke them during Phase 6 (PostgreSQL test migration)
instead of using them exclusively in Phase 3.
Key changes:
- Rewrite descriptions to explicitly state Phase 3-only usage and
warn against invoking during Phase 6
- Replace "scaffold for Oracle first" with "Oracle only" to remove
the false implication of a second PostgreSQL scaffolding step
- Replace "Tests validate behavior consistency when running against
Oracle or PostgreSQL" with clear Oracle-only framing
- Rename "DB-agnostic assertions" → "Assertion portability" and
explain the why (survive Phase 6 migration without rewrites)
- Fix datetime bullet in integration tests skill to use generic
Oracle column precision language instead of PostgreSQL type syntax
- Name Oracle NuGet package explicitly (Oracle.ManagedDataAccess.Core)
* feat(oracle-to-postgres): gate Phase 1 on DDL presence; add DDL scan to Phase 2 risk analysis
- Phase 1 success criteria now requires Oracle DDL artifacts to be
confirmed present at the recorded location before proceeding.
If missing, the agent stops and prompts the user to provide them.
- Phase 2 risk analysis now explicitly scans DDL/Oracle/{ProjectName}/
as supplemental context, summarising procedure complexity indicators
(dynamic SQL, DBMS_* / UTL_* references, autonomous transactions,
pipelined functions, BULK COLLECT/FORALL, REF CURSOR, TYPE bodies)
rather than ingesting DDL files wholesale. This ensures schema-level
migration risk is captured even when it isn't visible in application
code alone.
* - Merge in latest 'main' changes
- Update custom agent plugin (eg resolve conflict and add new skill)
- Validate skills
- Run build
* chore(plugin.json): update version to 1.1.0
* feat(oracle-to-postgres): update version to 1.1.0 for migration expert plugin
* fix: add INOUT to ignore-words-list for PostgreSQL migration
---------
Co-authored-by: TCPrimedPaul <paul.delannoy@tc.gc.ca>
* Add Azure API Management AI Gateway instructions
APIM as a GenAI gateway for Microsoft Foundry and OpenAI-compatible LLM APIs:
llm-* token-limit/token-metric policies, managed-identity auth, backend pools
with circuit breakers, semantic caching, and content safety. Corrects the
azure-openai-*/api-key/element-ordering defaults the model produces unprompted.
Regenerates docs/README.instructions.md.
* Potential fix for pull request finding
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* Address Copilot review feedback on APIM AI gateway instructions
* Fix AI gateway auth scope and Consumption-tier note per review
* Fix circuit-breaker 429, auth-role contradiction, and malformed XML per review
* Harden semantic cache isolation, logging privacy, and policy order per review
* Complete emit-token-metric prerequisites and Foundry private-networking requirement
* Fix Bicep array syntax and use supported JWT accessor per review
* Correct content-safety tier support and response-screening default per review
* Fix cache-partition identity, skeleton isolation, and metric cardinality per review
* Make policy expressions valid XML and clarify content-safety timing
---------
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* Add landing-page-conversion-audit and server-side-conversion-tracking skills
* Drop references to skills not present in this repo
---------
Co-authored-by: autonnel <283055447+autonnel@users.noreply.github.com>
* Add Microsoft Foundry (azure-ai-projects v2) Python instructions
* Address Copilot review: raise version floor, add endpoint routing, fix auth/cost/logging notes
* Remove stray closing code fence at end of file
* Address reviewer feedback: add explicit ManagedIdentityCredential pattern for production
* Clarify credential patterns: separate AKS workload identity from managed identity
* Fix credential order and add user-assigned identity example for managed identity and AKS patterns
* Fix credential chain description, logging level clarity, and use correct RBAC role name
* Refine RBAC documentation link, complete function-tool loop, and qualify az login requirement
Adopt the Agent Plugins v1.0.0 namespaced composition model from #2546. Bundle the reusable daily-focus-board canvas into Ember only and remove its obsolete standalone catalog manifest.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 52be9c67-3ae4-4610-93d0-fe0b7ab95ccb
* Add Azure Developer CLI skill and related documentation
* Add Azure Developer CLI skill to README with usage instructions and bundled assets
* Potential fix for pull request finding
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
---------
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* Update dotnet-mcp-builder skill to ModelContextProtocol 2.x
Align the skill with the C# SDK 2.0.0 release and the MCP 2026-07-28
spec: stable line is now 2.x, HttpServerTransportOptions.Stateless
defaults to true, roots/sampling/MCP-channel logging are [Obsolete]
(MCP9005) with the multi-round-trip input_required pattern as the
replacement, discovery-first negotiation (server/discover) supersedes
the initialize handshake, Mcp-Method/Mcp-Name routable headers, raw
structuredContent for non-object results, required Tool.inputSchema,
and the new ModelContextProtocol.Extensions.Tasks and
ModelContextProtocol.Extensions.Apps packages (typed MCP Apps support
replacing the hand-rolled _meta/ui:// pattern on 1.x).
* Address Copilot review: Apps extension accuracy, header scope, capability ownership
- packages.md: the Apps package replaces the manual _meta wiring, not the
ui:// resource; note the experimental MCPEXP003 diagnostic; label the
1.x -> 2.0 list as highlights and add the OAuth/SSE runtime changes
with a pointer to the full release notes.
- transport-http.md: Mcp-Method is on every POST, Mcp-Name only on named
invocations (tools/call, prompts/get, resources/read) - do not require
it globally at gateways.
- mcp-apps.md: current MIME type is text/html;profile=mcp-app (skybridge
is a legacy draft value); document [McpAppUi] + WithMcpApps().
- server-features.md: roots/sampling are client capabilities, only
logging sits on ServerCapabilities.
* Correct stateful HTTP guidance: 2026-07-28 has no HTTP sessions
Per the official SDK v2 elicitation docs, a server with Stateless=false
refuses the 2026-07-28 revision so dual-path clients fall back to an
initialize-capable revision; ElicitAsync cannot be used on 2026-07-28
Streamable HTTP at all. Reframe stateful HTTP as down-level
compatibility mode and document the multi-round-trip pattern
(InputRequiredException / InputRequest.ForElicitation, retry with
InputResponses -> ElicitResult) as the current-protocol way to ask
mid-tool, across SKILL.md, transport-http.md, and elicitation.md.
* Update typescript-mcp-server-generator skill to MCP TypeScript SDK v2
Replace the retired monolithic @modelcontextprotocol/sdk with the v2
focused packages (server, node, core, framework adapters), require
zod@^4.2 and Node 20+, document the registerTool config-object API,
the ctx handler context, the new error hierarchy, removed SSE/WebSocket
transports, and the v1-to-v2 codemod migration path.
* Address Copilot review: adapter peer frameworks and sampling consistency
Framework adapters now note their required peer framework install
(e.g. @modelcontextprotocol/express + express), and the two remaining
sampling recommendations are replaced with the multi-round
input_required pattern that v2 recommends over the deprecated
sampling subsystem.
Resolve the .codespellrc conflict by retaining both the daily-focus-board checkin key and upstream ACI term.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: fd1eae93-cc9f-4777-812c-a2a9872e1c2b
* feat: add Trojan Skill Hunter agent for auditing AI customization contributions
Adds a new agent that audits .agent.md, SKILL.md, .instructions.md,
hooks.json, and MCP/plugin manifests for hidden prompt injection, MCP-style
tool poisoning/shadowing, unicode steganography, excessive-agency scope
mismatches, and rug-pull/supply-chain drift before contributions are
merged, installed, or trusted.
Mapped to the OWASP Top 10 for LLM Applications (2025) and Invariant Labs'
MCP Tool Poisoning Attack research. Includes an explicit self-defense rule
so the agent treats reviewed content as untrusted data, never instructions
to obey.
* fix: reword attack-pattern examples to avoid PR risk-scan false positives
The Rule Zero bullet and two rug-pull/unpinned-fetch examples quoted the
exact literal phrases (e.g. 'ignore previous instructions', 'curl | bash')
that the repo's automated PR Risk Scan greps for. Reworded to convey the
identical meaning without the literal trigger strings - confirmed locally
with 'node eng/pr-risk-scan.mjs' (0 high/medium/info findings, was 3 high).
---------
Co-authored-by: Shubham Jiyani <shubham.jiyani@atqor.com>
* Add azure-well-architected-review skill
Adds a skill that performs a structured Azure Well-Architected Framework
review of a workload's IaC (Bicep, Terraform, ARM) and deployed
infrastructure across the 5 WAF pillars, then creates GitHub issues to
track remediation. Mirrors the existing aws-well-architected-review
skill, which had no Azure equivalent.
* Address Copilot review feedback on azure-well-architected-review
- Step 2: always inventory live Azure resources and compare with IaC to
surface drift, instead of scanning IaC only
- Step 5: add an explicit confirmation gate before any GitHub issue
creation; ambiguous or negative responses stop with a console report
- Fix nested code fences in the issue-body template by using a
four-backtick wrapper
Executive-function-friendly daily focus board (self-contained HTML) you run by
talking to Ember. Registers it in the ember plugin (1.1.0) and regenerates the
skills index + marketplace.json.
Review fixes: emoji XSS escaping; keyboard a11y (semantic buttons + aria, plus
up/down move controls); tagc label colors; local-date storage key + recap
date/filename; guarded execCommand and localStorage; confetti animates only
while active and stops on reduce-motion; loopback serve bind + quoted dir;
JSON config injection with '<' escaped; minute rounding; reorder-to-end; clear
stale focus; counter goal guard; and doc corrections (id charset, sample
reference, counter contract, option-b, frontmatter length).
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 07e720ee-ca02-419e-9adb-300738b6fc76
* Add gitmoji skill and gitmoji-setup agent
Adds two complementary artifacts for the gitmoji commit convention
(https://gitmoji.dev):
- skills/gitmoji: generates gitmoji commit messages from a diff, staged
changes, or a change description. Message-only by design (never runs
git commands), with disambiguation rules and a full reference table of
the 75 official gitmojis generated from the official gitmojis.json.
- agents/gitmoji-setup: sets up gitmoji tooling in a repository. Audits
the existing hook manager and commit convention, then installs either
a non-interactive prepare-commit-msg prefill hook (default, works in
GUI clients and CI), the gitmoji-cli interactive picker, or commitlint
enforcement, without clobbering existing hooks.
Generated README indexes updated via npm start.
* Use local commitlint binary instead of npx in verify step
Addresses the package-exec-command finding from the PR risk scan: the
verification example now calls the locally installed
./node_modules/.bin/commitlint rather than npx, which could fetch and
execute a package on the fly.
* Potential fix for pull request finding
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* Address Copilot review feedback
- Quote the agent description in single quotes per AGENTS.md convention
- Resolve the effective hooks directory via git rev-parse --git-path
hooks for both audit and installation, instead of hard-coding
.git/hooks (core.hooksPath, linked worktrees)
- Correct the prefill-hook compatibility claim: it prefills only when
the message editor opens and silently no-ops for -m/-F, GUI message
boxes, and CI
- Match the official gitmoji set explicitly when detecting an existing
emoji, instead of treating any non-ASCII start as one
- Drop .txt from the docs heuristic (it shadowed requirements.txt) and
remove the dependency-manifest fallback entirely: filenames cannot
distinguish upgrade/add/remove/pin/downgrade
- Restrict gitmoji -i to repos whose effective hooks dir is .git/hooks;
wire the picker through the hook manager otherwise
- Merge gitmoji into an existing commitlint config instead of
overwriting commitlint.config.mjs
- Fix the verification sequence: clean starting state, non-colliding
scratch file, abort by clearing the editor, explicit unstage/remove/
switch-back/branch-delete cleanup
- Skill: ask the user for commit history instead of running git log,
honoring the message-only contract
* Address second round of Copilot review feedback
- Pair the prefill hook with a commit-msg guard: prefilling an empty
COMMIT_EDITMSG defeats git abort-on-empty-message, so an untouched
prefill would create a commit named only with the emoji. The guard
rejects messages that contain nothing but the prefilled gitmoji.
- Extract the gitmoji alternation into a GITMOJI_RE variable shared by
both hooks.
- Document the commitlint-config-gitmoji format mismatch: it enforces
the hybrid <gitmoji> type(scope?): subject format and rejects the
plain gitmoji format produced by Options A/B and the gitmoji skill.
Option C now asks the team to choose a format first, and the
verification example uses a valid hybrid message.
---------
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
The instruction tells Copilot to verify PyPI/npm package and symbol names
against the attester.dev existence oracle (free keyless tier, 25 calls/day
per client IP) before installing or importing, catching hallucinated
dependency names (5.2-21.7% of LLM suggestions per USENIX Security 2025).
The preToolUse hook enforces the same check on code the agent writes:
stdlib-only script, blocks only on a confident oracle negative, fails open
on quota or network trouble, caches answers on disk. README tables
regenerated with npm start.
Syncs with jennyf19/the-workshop PR #8 (merged). Adds the
workshop-create skill with Path A (existing dir) and Path B
(new GitHub repo), explicit guard against repo-in-repo nesting.
TA agent updated with workshop-create section.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 26faf13e-639c-4a21-ac05-c0dc2bff7c62
Pavel Putrenkov
Muhammad Ubaid Raza
DevNode-09
Daniel Scott-Raynsford
Paul Delannoy
Konstantinos Passadis | Azure MVP | MCT
Alex Sokol
Massimo Bonanni
Autonnel
Jenny Ferries
Jason Colapietro
Aaron Powell
Kerolos Atallah
alfredtech2026
Subin Kim
alsoleg89
RJ
jennyf19
Adrien Clerbois
Jenny Ferries
Burak Bayır
denis-a-evdokimov
Shubham Jiyani
skyestrela
jennyf19
Himanshu bamoria
NeilChen
Samuel Bushi
Jonas Tüchler
Ayan Gupta
Mostafa Amini
Baiqing Lyu
Simon He