* Add poka-yoke skill: make misuse unrepresentable rather than warned against
Mistake-proofing, applied to code. The skill pushes toward devices that make
a wrong action impossible or self-announcing, rather than instructions asking
someone to avoid it, and refuses to accept a comment or a convention as a fix.
The gap it addresses. Given a design, models readily list what to fix and
rarely state what the fix makes impossible. Measured across 591 blind-graded
runs and six model families, responses named the foreclosed set 42% of the
time unprompted and 81% with this skill applied. Assertions were written
before the runs and graded blind to configuration.
Stated with its limits, because they matter: every run was the first turn of
a fresh session, so this measures the ceiling rather than what survives a
long working session; the comparison was against no methodology rather than a
different one, so it does not establish that this particular method caused
the gain; and the skill costs something measurable, making responses somewhat
worse at spotting the specific defect already on the page while better at
changing the shape that allowed it. All of that is in the skill body rather
than omitted.
Bundled, all self-contained, no network access and no dependencies:
scripts/detect_hazards.py standard-library scanner, 42 pattern rules
across 20 hazard shapes, five languages
references/hazard-catalog.md the taxonomy with device per shape
references/lang-*.md Python, TypeScript, Go and Rust patterns
Verified with npm run skill:validate and npm run build. Raw benchmark runs,
the harness and the assertion checklists are public at
https://github.com/rainmanjam/poka-yoke
* Rename HasTable to HasFrom in the TypeScript typestate example
codespell failed the PR: it reads HasTable as a misspelling of hashtable.
The identifier is a legitimate generic parameter on a typestate builder,
QueryBuilder<HasTable, HasWhere>, so this is a false positive, but it is our
file breaking their gate and the fix costs nothing.
HasFrom is also the better name: the flag tracks whether .from() has been
called, not whether a table exists.
Renamed in the upstream repository too, so the two copies do not diverge on
day one. Verified the whole bundle is codespell-clean locally.
* Correct the effect figures in the poka-yoke skill
The submitted numbers (42% -> 81%) could not be reproduced from the upstream
gradings. Recomputed over the six models the sentence describes: 45% -> 80%
across 132 verdicts. Adds the per-scenario breakdown, which is the more useful
claim: the gains are in tasks where nobody asked for a design review.
* Add repo-standardizer skill: polish any GitHub repo surface
* fix(skill): remove non-string metadata and fix template README refs for vally lint
* docs(skill): drop markdown relative links from README language-switcher example
Vally valid-refs flagged ./README.md and ./README.zh.md as missing file
references; they are generated artifacts, not skill files. Keep the
example as plain text to satisfy the linter.
* fix(template): add missing language switcher to English README template
Align with README.zh.md template and SKILL.md switcher convention:
current language as plain text, other languages as relative links.
---------
Co-authored-by: programmingWTF <programmingWTF@users.noreply.github.com>
The MCP Apps sample HTML bundle imported ext-apps from esm.sh using an
unpinned major-version tag (@1), which Snyk flags as an unverifiable
external dependency / third-party content exposure risk (indirect
prompt-injection surface, since the imported module can call
app.updateModelContext and app.callServerTool). Pin it to the current
release (1.7.5).
Also pin the sample `dotnet add package` commands for the
ModelContextProtocol* and Microsoft.Extensions.Hosting packages to
their current exact versions (2.2.0 / 10.0.11), and correct a stale
"2.0.0 is current" note in packages.md.
* Bump gem-team plugin version to 1.102.0 and add entry
Updated marketplace.json and plugin.json to version 1.102.0, added gem-team plugin entry with 16 items, refined argument hints in multiple agent definitions, and updated planner, reviewer, and skill creator configurations.
* Bump gem-team plugin version to 1.103.0 and update acceptance_criteria references
* refactor: simplify agent definitions and add gem-design-md-guidelines and gem-devops-guidelines skills
* feat: optimize orchstrator for faster workflows
* chore: optimize skills
* chore: update readme
* chore: bump version to 1.108.0
* chore: streamline planner
* Enhance Oracle-to-PostgreSQL migration skills and documentation
- Update migration agent guidelines to prioritize extension tool usage for code migration.
- Refine migration phases with detailed steps for pre-migration review and schema migration.
- Add new reviewing skill references for PostgreSQL materialized view refresh and UNION ALL planner risks.
- Ensure consistency in collation handling and testing strategies across skills.
* - Review migration phases to ensure correct order of execution
- Add exit criteria to each migration phase
- Remove invocation of `ms-ossdata.vscode-pgsql` extension due to dependency on VSCode
- Update README.md to reflect changes in migration phases and exit criteria
- Update broken reference to custom agent in plugin.json
* Enhance downstream migration skills and following custom agent improvements
- Added new skill for migrating .NET data access code from Oracle to PostgreSQL.
- Updated README to include new migration skill.
- Improved existing skills with clearer file naming conventions and migration actions.
- Added reference documents for handling Oracle-specific functions and pagination.
- Created detailed guides for NVL, DECODE, ROWNUM, SYSDATE, and DUAL replacements.
* Clarify PostgreSQL schema immutability and stored procedure migration risks
* Update target schema path in migration documentation for clarity
* fix(skills): clarify Phase 3-only scope for Oracle test skills
Both Oracle test skills were ambiguously worded in ways that could
cause a model to invoke them during Phase 6 (PostgreSQL test migration)
instead of using them exclusively in Phase 3.
Key changes:
- Rewrite descriptions to explicitly state Phase 3-only usage and
warn against invoking during Phase 6
- Replace "scaffold for Oracle first" with "Oracle only" to remove
the false implication of a second PostgreSQL scaffolding step
- Replace "Tests validate behavior consistency when running against
Oracle or PostgreSQL" with clear Oracle-only framing
- Rename "DB-agnostic assertions" → "Assertion portability" and
explain the why (survive Phase 6 migration without rewrites)
- Fix datetime bullet in integration tests skill to use generic
Oracle column precision language instead of PostgreSQL type syntax
- Name Oracle NuGet package explicitly (Oracle.ManagedDataAccess.Core)
* feat(oracle-to-postgres): gate Phase 1 on DDL presence; add DDL scan to Phase 2 risk analysis
- Phase 1 success criteria now requires Oracle DDL artifacts to be
confirmed present at the recorded location before proceeding.
If missing, the agent stops and prompts the user to provide them.
- Phase 2 risk analysis now explicitly scans DDL/Oracle/{ProjectName}/
as supplemental context, summarising procedure complexity indicators
(dynamic SQL, DBMS_* / UTL_* references, autonomous transactions,
pipelined functions, BULK COLLECT/FORALL, REF CURSOR, TYPE bodies)
rather than ingesting DDL files wholesale. This ensures schema-level
migration risk is captured even when it isn't visible in application
code alone.
* - Merge in latest 'main' changes
- Update custom agent plugin (eg resolve conflict and add new skill)
- Validate skills
- Run build
* chore(plugin.json): update version to 1.1.0
* feat(oracle-to-postgres): update version to 1.1.0 for migration expert plugin
* fix: add INOUT to ignore-words-list for PostgreSQL migration
---------
Co-authored-by: TCPrimedPaul <paul.delannoy@tc.gc.ca>
* Add landing-page-conversion-audit and server-side-conversion-tracking skills
* Drop references to skills not present in this repo
---------
Co-authored-by: autonnel <283055447+autonnel@users.noreply.github.com>
While implementing the Agent Plugin v1 spec in https://github.com/stbenjam/skillsaw/pull/483, I used this repository as a canonical real-world source for tests. Along the way its checks surfaced genuine correctness issues worth fixing regardless of tooling:
- Internal links that do not resolve (22): wrong relative paths, links whose targets are runtime output paths rather than bundled files (now inline code), a schemeless external URL parsed as a relative path, and links to files that do not exist (removed).
- Bundled skill files never referenced from their SKILL.md (14): each is now cited from the section where it is used, so nothing ships unreachable from the skill's instructions.
- Unclosed or mis-nested code fences (11): markdown templates embedding code blocks now use four-backtick outer fences so inner fences nest instead of closing the template early and leaking example content as live markdown; also removed stray orphan fences and closed an unterminated block at end of file.
- Invisible unicode (1): removed a zero-width space from a code example, a copy-paste artifact invisible to reviewers.
Adopt the Agent Plugins v1.0.0 namespaced composition model from #2546. Bundle the reusable daily-focus-board canvas into Ember only and remove its obsolete standalone catalog manifest.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 52be9c67-3ae4-4610-93d0-fe0b7ab95ccb
* Add Azure Developer CLI skill and related documentation
* Add Azure Developer CLI skill to README with usage instructions and bundled assets
* Potential fix for pull request finding
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
---------
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* Update dotnet-mcp-builder skill to ModelContextProtocol 2.x
Align the skill with the C# SDK 2.0.0 release and the MCP 2026-07-28
spec: stable line is now 2.x, HttpServerTransportOptions.Stateless
defaults to true, roots/sampling/MCP-channel logging are [Obsolete]
(MCP9005) with the multi-round-trip input_required pattern as the
replacement, discovery-first negotiation (server/discover) supersedes
the initialize handshake, Mcp-Method/Mcp-Name routable headers, raw
structuredContent for non-object results, required Tool.inputSchema,
and the new ModelContextProtocol.Extensions.Tasks and
ModelContextProtocol.Extensions.Apps packages (typed MCP Apps support
replacing the hand-rolled _meta/ui:// pattern on 1.x).
* Address Copilot review: Apps extension accuracy, header scope, capability ownership
- packages.md: the Apps package replaces the manual _meta wiring, not the
ui:// resource; note the experimental MCPEXP003 diagnostic; label the
1.x -> 2.0 list as highlights and add the OAuth/SSE runtime changes
with a pointer to the full release notes.
- transport-http.md: Mcp-Method is on every POST, Mcp-Name only on named
invocations (tools/call, prompts/get, resources/read) - do not require
it globally at gateways.
- mcp-apps.md: current MIME type is text/html;profile=mcp-app (skybridge
is a legacy draft value); document [McpAppUi] + WithMcpApps().
- server-features.md: roots/sampling are client capabilities, only
logging sits on ServerCapabilities.
* Correct stateful HTTP guidance: 2026-07-28 has no HTTP sessions
Per the official SDK v2 elicitation docs, a server with Stateless=false
refuses the 2026-07-28 revision so dual-path clients fall back to an
initialize-capable revision; ElicitAsync cannot be used on 2026-07-28
Streamable HTTP at all. Reframe stateful HTTP as down-level
compatibility mode and document the multi-round-trip pattern
(InputRequiredException / InputRequest.ForElicitation, retry with
InputResponses -> ElicitResult) as the current-protocol way to ask
mid-tool, across SKILL.md, transport-http.md, and elicitation.md.
* Update typescript-mcp-server-generator skill to MCP TypeScript SDK v2
Replace the retired monolithic @modelcontextprotocol/sdk with the v2
focused packages (server, node, core, framework adapters), require
zod@^4.2 and Node 20+, document the registerTool config-object API,
the ctx handler context, the new error hierarchy, removed SSE/WebSocket
transports, and the v1-to-v2 codemod migration path.
* Address Copilot review: adapter peer frameworks and sampling consistency
Framework adapters now note their required peer framework install
(e.g. @modelcontextprotocol/express + express), and the two remaining
sampling recommendations are replaced with the multi-round
input_required pattern that v2 recommends over the deprecated
sampling subsystem.
Resolve the .codespellrc conflict by retaining both the daily-focus-board checkin key and upstream ACI term.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: fd1eae93-cc9f-4777-812c-a2a9872e1c2b
Resolves the remaining Copilot review comments.
Canvas extension (board-core.mjs, board.html):
- DNS-rebinding: pin the Host header to the exact 127.0.0.1:<port> authority and
require a per-server capability token (minted at startup, embedded in the served
page, sent as x-board-token) on ALL /api/* routes -- so GET /api/state can't leak
task data and POSTs can't be forged. Mirrors extensions/signals-dashboard.
- Destructive write: loadDoc only synthesizes a fresh board for ENOENT and now
propagates I/O + JSON parse errors, so a transient/malformed state file is never
overwritten by a later mutation.
- XSS: escape emoji (from the seed / add_task action) at render, like title/unit.
Skill (board.template.html, sample-board.html):
- a11y: each task card gets role=group + aria-label so screen readers get task context.
- counters: step=1 on the goal/update number inputs to match the positive-integer contract.
Verified headless (35/35): token gates reads+writes, CSRF + foreign-Host refused,
malformed file left intact. Repo plugin + skill validation green.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: cb356aa8-0af2-48f3-b3c6-8086c69d5308
The issue-body template was wrapped in a three-backtick fence while
containing three-backtick HCL and Bash blocks, so the HCL example's
closing fence terminated the wrapper early and the following fence
swallowed the remaining workflow sections. Use a four-backtick wrapper
so the nested blocks render intact.
Co-authored-by: Aaron Powell <me@aaron-powell.com>
* Add azure-well-architected-review skill
Adds a skill that performs a structured Azure Well-Architected Framework
review of a workload's IaC (Bicep, Terraform, ARM) and deployed
infrastructure across the 5 WAF pillars, then creates GitHub issues to
track remediation. Mirrors the existing aws-well-architected-review
skill, which had no Azure equivalent.
* Address Copilot review feedback on azure-well-architected-review
- Step 2: always inventory live Azure resources and compare with IaC to
surface drift, instead of scanning IaC only
- Step 5: add an explicit confirmation gate before any GitHub issue
creation; ambiguous or negative responses stop with a console report
- Fix nested code fences in the issue-body template by using a
four-backtick wrapper
Add action-oriented aria-labels to the suggest-mantra, focus, remove, add-note, park-thought,
and log-win buttons so screen readers announce the action instead of the emoji (template + sample).
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 07e720ee-ca02-419e-9adb-300738b6fc76
Add a task-specific aria-label to the quadrant <select> and the editable label input so
screen-reader users know which task the control belongs to (template + regenerated sample).
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 07e720ee-ca02-419e-9adb-300738b6fc76
- Validate task ids (^[A-Za-z0-9_-]+$) and dedupe before interpolating into data-* attributes,
so a malformed configured/persisted id can't break out of an attribute (template + sample).
- Seeded counters (current value >0 and below goal) now render as 'in progress', not 'to do'.
- Hide the 'not today' carryover control on done tasks; it was flipping a completed task to
carried and dropping it from the recap's Done tally.
- #eodmsg is now role=status aria-live=polite so screen-reader users hear save/copy results.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 07e720ee-ca02-419e-9adb-300738b6fc76
- Sanitize tagc to [A-Za-z0-9_-] before class-attribute interpolation, so a custom
class name cannot break out of the attribute and inject markup/handlers (template + sample).
- customize.md now points at .tagedit.<name> (the class the renderer actually applies).
- serve-board.ps1: fail when the port is already in use, capture and report the server PID
(with a stop command), and verify the process did not exit before opening the URL.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 07e720ee-ca02-419e-9adb-300738b6fc76
Executive-function-friendly daily focus board (self-contained HTML) you run by
talking to Ember. Registers it in the ember plugin (1.1.0) and regenerates the
skills index + marketplace.json.
Review fixes: emoji XSS escaping; keyboard a11y (semantic buttons + aria, plus
up/down move controls); tagc label colors; local-date storage key + recap
date/filename; guarded execCommand and localStorage; confetti animates only
while active and stops on reduce-motion; loopback serve bind + quoted dir;
JSON config injection with '<' escaped; minute rounding; reorder-to-end; clear
stale focus; counter goal guard; and doc corrections (id charset, sample
reference, counter contract, option-b, frontmatter length).
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 07e720ee-ca02-419e-9adb-300738b6fc76
* Add gitmoji skill and gitmoji-setup agent
Adds two complementary artifacts for the gitmoji commit convention
(https://gitmoji.dev):
- skills/gitmoji: generates gitmoji commit messages from a diff, staged
changes, or a change description. Message-only by design (never runs
git commands), with disambiguation rules and a full reference table of
the 75 official gitmojis generated from the official gitmojis.json.
- agents/gitmoji-setup: sets up gitmoji tooling in a repository. Audits
the existing hook manager and commit convention, then installs either
a non-interactive prepare-commit-msg prefill hook (default, works in
GUI clients and CI), the gitmoji-cli interactive picker, or commitlint
enforcement, without clobbering existing hooks.
Generated README indexes updated via npm start.
* Use local commitlint binary instead of npx in verify step
Addresses the package-exec-command finding from the PR risk scan: the
verification example now calls the locally installed
./node_modules/.bin/commitlint rather than npx, which could fetch and
execute a package on the fly.
* Potential fix for pull request finding
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* Address Copilot review feedback
- Quote the agent description in single quotes per AGENTS.md convention
- Resolve the effective hooks directory via git rev-parse --git-path
hooks for both audit and installation, instead of hard-coding
.git/hooks (core.hooksPath, linked worktrees)
- Correct the prefill-hook compatibility claim: it prefills only when
the message editor opens and silently no-ops for -m/-F, GUI message
boxes, and CI
- Match the official gitmoji set explicitly when detecting an existing
emoji, instead of treating any non-ASCII start as one
- Drop .txt from the docs heuristic (it shadowed requirements.txt) and
remove the dependency-manifest fallback entirely: filenames cannot
distinguish upgrade/add/remove/pin/downgrade
- Restrict gitmoji -i to repos whose effective hooks dir is .git/hooks;
wire the picker through the hook manager otherwise
- Merge gitmoji into an existing commitlint config instead of
overwriting commitlint.config.mjs
- Fix the verification sequence: clean starting state, non-colliding
scratch file, abort by clearing the editor, explicit unstage/remove/
switch-back/branch-delete cleanup
- Skill: ask the user for commit history instead of running git log,
honoring the message-only contract
* Address second round of Copilot review feedback
- Pair the prefill hook with a commit-msg guard: prefilling an empty
COMMIT_EDITMSG defeats git abort-on-empty-message, so an untouched
prefill would create a commit named only with the emoji. The guard
rejects messages that contain nothing but the prefilled gitmoji.
- Extract the gitmoji alternation into a GITMOJI_RE variable shared by
both hooks.
- Document the commitlint-config-gitmoji format mismatch: it enforces
the hybrid <gitmoji> type(scope?): subject format and rejects the
plain gitmoji format produced by Options A/B and the gitmoji skill.
Option C now asks the team to choose a format first, and the
verification example uses a valid hybrid message.
---------
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Andrew Arnott
grgy078033
Shannon Atkinson
Muhammad Ubaid Raza
Chris Arendt
Sepuri Sai Krishna
Samuel Bushi
Guiyu Li
jeanpaulhassane-225
Anton Standrik
Mamdouh Ibrahim
Pavel Putrenkov
Paul Delannoy
Alex Sokol
Massimo Bonanni
Autonnel
Jenny Ferries
Stephen Benjamin
Jason Colapietro
alfredtech2026
Subin Kim
alsoleg89
RJ
jennyf19
Adrien Clerbois
Jenny Ferries
Burak Bayır
denis-a-evdokimov
skyestrela
jennyf19
Himanshu bamoria