| Skill | Added | Review |
|---|---|---|
apm-spec-guardian .agents/skills/apm-spec-guardian/SKILL.md Use this skill to run a four-panel adversarial advisory review on any pull request that touches the OpenAPM specification artifact (docs/src/content/docs/specs/openapm-*.md), its inline / sidecar JSON Schemas (docs/src/content/docs/specs/schemas/*.schema.json), or the conformance fixture seed (tests/fixtures/spec-conformance/**). The panel fans out to four spec-ecosystem reviewers (swagger-openapi-editor, oci-distribution-editor, pkgmgr-registry-contract-editor, w3c-tag-architect), each running in its own agent thread, and a spec-editor synthesizer that produces a fold-now / defer-v0.1.1 / defer-v0.2 / reject list plus a ship decision keyed off a 1..10 shocked_meter scale. The orchestrator is the sole writer to the PR: ONE consolidated comment, no verdict labels, no merge gating. The panel is advisory -- it surfaces findings, prioritizes folds, and renders a ship recommendation that the maintainer weighs. | 68 68 Impact — No eval scenarios have been run Securityby Low Low-risk findings worth noting Version: 0495ced | |
apm-spec-guardian .apm/skills/apm-spec-guardian/SKILL.md Use this skill to run a four-panel adversarial advisory review on any pull request that touches the OpenAPM specification artifact (docs/src/content/docs/specs/openapm-*.md), its inline / sidecar JSON Schemas (docs/src/content/docs/specs/schemas/*.schema.json), or the conformance fixture seed (tests/fixtures/spec-conformance/**). The panel fans out to four spec-ecosystem reviewers (swagger-openapi-editor, oci-distribution-editor, pkgmgr-registry-contract-editor, w3c-tag-architect), each running in its own agent thread, and a spec-editor synthesizer that produces a fold-now / defer-v0.1.1 / defer-v0.2 / reject list plus a ship decision keyed off a 1..10 shocked_meter scale. The orchestrator is the sole writer to the PR: ONE consolidated comment, no verdict labels, no merge gating. The panel is advisory -- it surfaces findings, prioritizes folds, and renders a ship recommendation that the maintainer weighs. | 70 70 Impact — No eval scenarios have been run Securityby Low Low-risk findings worth noting Version: 0495ced | |
apm-strategy .agents/skills/apm-strategy/SKILL.md Activate for changes to project positioning, release communication, community-facing artifacts, or breaking-change decisions in microsoft/apm. Triggers on README, MANIFESTO, PRD, CHANGELOG, release workflows, and issue templates. | 56 56 Impact — No eval scenarios have been run Securityby Passed No findings from the security scan Version: 0495ced | |
apm-strategy .apm/skills/apm-strategy/SKILL.md Activate for changes to project positioning, release communication, community-facing artifacts, or breaking-change decisions in microsoft/apm. Triggers on README, MANIFESTO, PRD, CHANGELOG, release workflows, and issue templates. | 54 54 Impact — No eval scenarios have been run Securityby Passed No findings from the security scan Version: 0495ced | |
apm-usage packages/apm-guide/.apm/skills/apm-usage/SKILL.md Activate when the user asks about APM (Agent Package Manager): installing, configuring, authoring, or troubleshooting AI-agent packages, dependencies, compilation, MCP servers, policy, or any `apm` CLI command. | 60 60 Impact — No eval scenarios have been run Securityby Passed No findings from the security scan Version: 0495ced | |
auth .agents/skills/auth/SKILL.md Activate when code touches token management, credential resolution, git auth flows, GITHUB_APM_PAT, ADO_APM_PAT, AuthResolver, HostInfo, AuthContext, or any remote host authentication -- even if 'auth' isn't mentioned explicitly. | 56 56 Impact — No eval scenarios have been run Securityby Passed No findings from the security scan Version: 0495ced | |
auth .apm/skills/auth/SKILL.md Activate when code touches token management, credential resolution, git auth flows, GITHUB_APM_PAT, ADO_APM_PAT, AuthResolver, HostInfo, AuthContext, or any remote host authentication -- even if 'auth' isn't mentioned explicitly. | 60 60 Impact — No eval scenarios have been run Securityby Passed No findings from the security scan Version: 0495ced | |
autopilot-comment .agents/skills/autopilot-comment/SKILL.md Use this skill to post or patch ONE GitHub comment for a microsoft/apm autopilot run. It owns public vs debug body assembly and the AI disclaimer footer. Never labels, assigns, requests reviewers, or merges. Autopilot skills that write comments must load this skill and must not call gh comment APIs themselves. | 69 69 Impact — No eval scenarios have been run Securityby Passed No findings from the security scan Version: 0495ced | |
autopilot-comment packages/autopilot/autopilot-comment/SKILL.md Use this skill to post or patch ONE GitHub comment for a microsoft/apm autopilot run. It owns public vs debug body assembly and the AI disclaimer footer. Never labels, assigns, requests reviewers, or merges. Autopilot skills that write comments must load this skill and must not call gh comment APIs themselves. | 72 72 Impact — No eval scenarios have been run Securityby Passed No findings from the security scan Version: 0495ced | |
autopilot-issue-delivery-scheduler .agents/skills/autopilot-issue-delivery-scheduler/SKILL.md Use this skill to queue maintainer-accepted microsoft/apm issues (`status/accepted`) and fan them out through an isolated pool (default 2) of autopilot-issue-delivery-worker sessions. Any accepted type is eligible. Advisory `triage/recommended` is not authorization. Does not triage. Does not review PRs. Works in a local session, Copilot App automation, Cloud Agent, Remote Agent, or Agentic Workflow. | 59 59 Impact — No eval scenarios have been run Securityby Low Low-risk findings worth noting Version: 0495ced | |
autopilot-issue-delivery-scheduler packages/autopilot/autopilot-issue-delivery-scheduler/.apm/skills/autopilot-issue-delivery-scheduler/SKILL.md Use this skill to queue maintainer-accepted microsoft/apm issues (`status/accepted`) and fan them out through an isolated pool (default 2) of autopilot-issue-delivery-worker sessions. Any accepted type is eligible. Advisory `triage/recommended` is not authorization. Does not triage. Does not review PRs. Works in a local session, Copilot App automation, Cloud Agent, Remote Agent, or Agentic Workflow. | 60 60 Impact — No eval scenarios have been run Securityby Low Low-risk findings worth noting Version: 0495ced | |
autopilot-issue-delivery-worker .agents/skills/autopilot-issue-delivery-worker/SKILL.md Use this skill to implement ONE microsoft/apm issue already selected by autopilot-issue-delivery-scheduler. Queue signal is `status/accepted` or a named bounded accept; that is not permission. Requires fresh human-scope evidence from scripts/governance before any mutate. May reproduce a bug, implement the accepted change, and open a fix PR. Not a queue manager and not a triage scheduler. Works in the scheduler's session, a child session, Cloud Agent, Remote Agent, or Agentic Workflow. | 72 72 Impact — No eval scenarios have been run Securityby Low Low-risk findings worth noting Version: 0495ced | |
autopilot-issue-delivery-worker packages/autopilot/autopilot-issue-delivery-worker/.apm/skills/autopilot-issue-delivery-worker/SKILL.md Use this skill to implement ONE microsoft/apm issue already selected by autopilot-issue-delivery-scheduler. Queue signal is `status/accepted` or a named bounded accept; that is not permission. Requires fresh human-scope evidence from scripts/governance before any mutate. May reproduce a bug, implement the accepted change, and open a fix PR. Not a queue manager and not a triage scheduler. Works in the scheduler's session, a child session, Cloud Agent, Remote Agent, or Agentic Workflow. | 70 70 Impact — No eval scenarios have been run Securityby Low Low-risk findings worth noting Version: 0495ced | |
autopilot-issue-triage-scheduler .agents/skills/autopilot-issue-triage-scheduler/SKILL.md Queue open microsoft/apm issues and fan them out through an isolated pool (default 2) of autopilot-issue-triage-worker sessions. Advisory only. Never implements, never assigns, never requests reviewers. Activate on a mixed issue list or queue-all when the job is triage. Works in a local session, Copilot App automation, Cloud Agent, Remote Agent, or Agentic Workflow. | — — — Impact — No eval scenarios have been run Securityby Low Low-risk findings worth noting Version: 0495ced | |
autopilot-issue-triage-scheduler packages/autopilot/autopilot-issue-triage-scheduler/.apm/skills/autopilot-issue-triage-scheduler/SKILL.md Queue open microsoft/apm issues and fan them out through an isolated pool (default 2) of autopilot-issue-triage-worker sessions. Advisory only. Never implements, never assigns, never requests reviewers. Activate on a mixed issue list or queue-all when the job is triage. Works in a local session, Copilot App automation, Cloud Agent, Remote Agent, or Agentic Workflow. | 68 68 Impact — No eval scenarios have been run Securityby Low Low-risk findings worth noting Version: 0495ced | |
autopilot-issue-triage-worker .agents/skills/autopilot-issue-triage-worker/SKILL.md Use this skill to triage ONE microsoft/apm issue already selected by autopilot-issue-triage-scheduler. Return one advisory recommendation and a proposed scope brief, never human approval. Do not implement the issue, manage the backlog, or list the queue. | — — — Impact — No eval scenarios have been run Securityby Low Low-risk findings worth noting Version: 0495ced | |
autopilot-issue-triage-worker packages/autopilot/autopilot-issue-triage-worker/SKILL.md Use this skill to triage ONE microsoft/apm issue already selected by autopilot-issue-triage-scheduler. Return one advisory recommendation and a proposed scope brief, never human approval. Do not implement the issue, manage the backlog, or list the queue. | 65 65 Impact — No eval scenarios have been run Securityby Low Low-risk findings worth noting Version: 0495ced | |
autopilot-pr-merge-worker .agents/skills/autopilot-pr-merge-worker/SKILL.md Drive ONE already selected open pull request in microsoft/apm to mergeable. Classifies copilot-pull-request-reviewer[bot] inline review, runs autopilot-pr-review-worker, folds (by default) every recommendation inside the PR's stated scope, pushes to the head branch or a superseding PR that preserves authorship via commit trailers, watches CI to green (`agent-merge` when that skill or `<agent_merge_state>` is present; otherwise `gh pr checks --watch`), and iterates under fixed caps until ready-to-merge, advisory-with-deferred, superseded, or blocked. Plan before any fold, push, or reviewer request. Never spawned by autopilot-pr-review-scheduler. That scheduler is advisory only. Invoke this skill by name when the caller asked to drive a PR to merge. | — — — Impact — No eval scenarios have been run Securityby Low Low-risk findings worth noting Version: 0495ced | |
autopilot-pr-merge-worker packages/autopilot/autopilot-pr-merge-worker/SKILL.md Drive ONE already selected open pull request in microsoft/apm to mergeable. Classifies copilot-pull-request-reviewer[bot] inline review, runs autopilot-pr-review-worker, folds (by default) every recommendation inside the PR's stated scope, pushes to the head branch or a superseding PR that preserves authorship via commit trailers, watches CI to green (`agent-merge` when that skill or `<agent_merge_state>` is present; otherwise `gh pr checks --watch`), and iterates under fixed caps until ready-to-merge, advisory-with-deferred, superseded, or blocked. Plan before any fold, push, or reviewer request. Never spawned by autopilot-pr-review-scheduler. That scheduler is advisory only. Invoke this skill by name when the caller asked to drive a PR to merge. | 71 71 Impact — No eval scenarios have been run Securityby Low Low-risk findings worth noting Version: 0495ced | |
autopilot-pr-review-scheduler .agents/skills/autopilot-pr-review-scheduler/SKILL.md Queue microsoft/apm pull requests labelled `panel-review` (or an explicit named list) and fan them out through an isolated pool (default 2) of autopilot-pr-review-worker sessions. Advisory only. Never implements. Never composes autopilot-pr-merge-worker. Never review every open PR. Works in a local session, Copilot App automation, Cloud Agent, Remote Agent, or Agentic Workflow. Does not triage issues or open greenfield PRs. | 63 63 Impact — No eval scenarios have been run Securityby Low Low-risk findings worth noting Version: 0495ced |