Drive ONE already selected open pull request in microsoft/apm to mergeable. Classifies copilot-pull-request-reviewer[bot] inline review, runs autopilot-pr-review-worker, folds (by default) every recommendation inside the PR's stated scope, pushes to the head branch or a superseding PR that preserves authorship via commit trailers, watches CI to green (`agent-merge` when that skill or `<agent_merge_state>` is present; otherwise `gh pr checks --watch`), and iterates under fixed caps until ready-to-merge, advisory-with-deferred, superseded, or blocked. Plan before any fold, push, or reviewer request. Never spawned by autopilot-pr-review-scheduler. That scheduler is advisory only. Invoke this skill by name when the caller asked to drive a PR to merge.

Use this skill to triage ONE microsoft/apm issue already selected by autopilot-issue-triage-scheduler. Return one advisory recommendation and a proposed scope brief, never human approval. Do not implement the issue, manage the backlog, or list the queue.

Queue open microsoft/apm issues and fan them out through an isolated pool (default 2) of autopilot-issue-triage-worker sessions. Advisory only. Never implements, never assigns, never requests reviewers. Activate on a mixed issue list or queue-all when the job is triage. Works in a local session, Copilot App automation, Cloud Agent, Remote Agent, or Agentic Workflow.

Update, deploy, or roll out a Tinybird pipe or datasource to staging or production. Use for "update a pipe", "push to Tinybird", "tb push", "tb pull", "change a datasource", "add a field to a pipe", or anything touching the `lfx_insights` / `lfx_insights_stg` Tinybird workspaces.

Automated vulnerability triage and dependency bumps for the git_integration worker (Python via uv + the two vendored Go modules). Fetches open Dependabot alerts scoped to git_integration manifests, correlates them with open Dependabot PRs, classifies each fix as safe or needs-human, validates safe fixes locally on the PR branches merged with latest main (uv sync / lint / pytest + full git-integration image build, which compiles both Go modules), updates safe PR branches server-side so they are one click from merge, then posts a "safe to merge" review summary to Slack and opens PRs for alerts Dependabot has no PR for. NEVER merges PRs, never dismisses alerts, never deploys without explicit user confirmation. Use when the user says "fix vulns", "bump deps", "dependabot triage", or asks about git_integration vulnerabilities.

Hypothesis-driven, tool-grounded security review of coverage gaps

Implement approved tasks using TDD with native subagent dispatch. Runs all pending tasks autonomously or selected tasks manually.

Analyze implementation gap between requirements and existing codebase

Interactive technical design quality review and validation

Generate implementation tasks for a specification

Generate comprehensive requirements for a specification

Create comprehensive technical design for a specification

Create complete specs (requirements, design, tasks) for all features in roadmap.md using parallel sub-agent dispatch by dependency wave.

Implement approved tasks using TDD with subagent dispatch. Runs all pending tasks autonomously or selected tasks manually.

评估 AFK 批次的工程、产品、知识与执行改进，生成可留存报告供用户裁决。

统一资产生成 skill：接受 `--type=character|scene|prop|product`，或不传自动扫所有 pending（缺 sheet）资源并按类型分发。当用户说“生成角色图”/“生成场景图”/“生成道具图”/“生成商品图”、想为新资产创建参考图、或有资产缺少 *_sheet 时使用。

当用户要求把采用 JSON 提交后轮询协议的视频供应商接入 ArcReel，或要求编写、验证、测试、保存自定义调用端点定义时使用。

为 CC GUI 桌面客户端创建、修改、迭代插件（Tier-0 声明式 CSS/JSON，或 Tier-1 单文件 ESM）。当用户要"做一个插件 / 给 CC GUI 加个功能 / 改输入框或界面样式 / 加设置页、侧边栏或状态栏入口 / 加面板页签或命令面板命令 / 把某套工作流包装成插件 / 改一下我做过的那个插件"，或提到 ccgui 插件、插件目录、从本地目录安装插件时使用。

Open a user-provided URL in the host's built-in browser and use the page's MCP or WebMCP tools before browser UI automation for app communication or edits.

Turn ordinary text plans into rich interactive visual plans with diagrams, file maps, annotated code, open questions, and UI/prototype review when useful.