mirror of https://github.com/github/awesome-copilot.git synced 2026-08-01 23:12:29 +00:00

Files

T

Shubham Jiyani 0648d53070 Add Trojan Skill Hunter agent for auditing AI customization contributions 🤖🤖🤖 (#2423 )

* feat: add Trojan Skill Hunter agent for auditing AI customization contributions

Adds a new agent that audits .agent.md, SKILL.md, .instructions.md,
hooks.json, and MCP/plugin manifests for hidden prompt injection, MCP-style
tool poisoning/shadowing, unicode steganography, excessive-agency scope
mismatches, and rug-pull/supply-chain drift before contributions are
merged, installed, or trusted.

Mapped to the OWASP Top 10 for LLM Applications (2025) and Invariant Labs'
MCP Tool Poisoning Attack research. Includes an explicit self-defense rule
so the agent treats reviewed content as untrusted data, never instructions
to obey.

* fix: reword attack-pattern examples to avoid PR risk-scan false positives

The Rule Zero bullet and two rug-pull/unpinned-fetch examples quoted the
exact literal phrases (e.g. 'ignore previous instructions', 'curl | bash')
that the repo's automated PR Risk Scan greps for. Reworded to convey the
identical meaning without the literal trigger strings - confirmed locally
with 'node eng/pr-risk-scan.mjs' (0 high/medium/info findings, was 3 high).

---------

Co-authored-by: Shubham Jiyani <shubham.jiyani@atqor.com>

2026-07-30 10:59:29 +10:00

.gitkeep

Partners (#354 )

2025-10-29 06:07:13 +11:00

README.agents.md

Add Trojan Skill Hunter agent for auditing AI customization contributions 🤖🤖🤖 (#2423 )

2026-07-30 10:59:29 +10:00

README.hooks.md

Add attester package-verification instruction and import-check hook

2026-07-22 01:23:34 -04:00

README.instructions.md

Add attester package-verification instruction and import-check hook

2026-07-22 01:23:34 -04:00

README.plugins.md

Add UIZZE anti-ui-slop plugin (#2390 )

2026-07-23 10:50:47 -07:00

README.skills.md

Add bug reproduction brief skill (#2420 )

2026-07-30 10:28:46 +10:00

README.workflows.md

Add weekly comment sync workflow

2026-04-15 14:58:57 +02:00

README.workflows.md

⚡ Agentic Workflows

Agentic Workflows are AI-powered repository automations that run coding agents in GitHub Actions. Defined in markdown with natural language instructions, they enable event-triggered and scheduled automation with built-in guardrails and security-first design.

How to Contribute

See CONTRIBUTING.md for guidelines on how to contribute new workflows, improve existing ones, and share your use cases.

How to Use Agentic Workflows

What's Included:

Each workflow is a single .md file with YAML frontmatter and natural language instructions
Workflows are compiled to .lock.yml GitHub Actions files via gh aw compile
Workflows follow the GitHub Agentic Workflows specification

To Install:

Install the gh aw CLI extension: gh extension install github/gh-aw
Copy the workflow .md file to your repository's .github/workflows/ directory
Compile with gh aw compile to generate the .lock.yml file
Commit both the .md and .lock.yml files

To Activate/Use:

Workflows run automatically based on their configured triggers (schedules, events, slash commands)
Use gh aw run <workflow> to trigger a manual run
Monitor runs with gh aw status and gh aw logs

When to Use:

Automate issue triage and labeling
Generate daily status reports
Maintain documentation automatically
Run scheduled code quality checks
Respond to slash commands in issues and PRs
Orchestrate multi-step repository automation

Name	Description	Triggers
Daily Issues Report	Generates a daily summary of open issues and recent activity as a GitHub issue	schedule
OSPO Contributors Report	Monthly contributor activity metrics across an organization's repositories.	schedule, workflow_dispatch
OSPO Organization Health Report	Comprehensive weekly health report for a GitHub organization. Surfaces stale issues/PRs, merge time analysis, contributor leaderboards, and actionable items needing human attention.	schedule, workflow_dispatch
OSPO Stale Repository Report	Identifies inactive repositories in your organization and generates an archival recommendation report.	schedule, workflow_dispatch
OSS Release Compliance Checker	Analyzes a target repository against open source release requirements and posts a detailed compliance report as an issue comment.	issues, workflow_dispatch
Relevance Check	Slash command to evaluate whether an issue or pull request is still relevant to the project	slash_command, roles
Relevance Summary	Manually triggered workflow that summarizes all open issues and PRs with a /relevance-check response into a single issue	workflow_dispatch
Weekly Comment Sync	Weekly workflow that finds stale code comments or README snippets, makes text-only synchronization updates, and opens a draft pull request when changes are needed.	schedule, workflow_dispatch