feat(skills): import 25 workflow-oriented skills from github#2374

Imports the workflow-oriented skill catalogue from
github#2374 as standalone SKILL.md files served via
the existing Registry. Each skill covers a discrete GitHub workflow
the model can pull on demand rather than loading all guidance up-front.

Imported skills (25): get-context, explore-repo, search-code,
trace-history, create-pr, self-review-pr, address-pr-feedback,
merge-pr, triage-issues, create-issue, manage-sub-issues, debug-ci,
trigger-workflow, security-audit, fix-dependabot, research-vulnerability,
manage-project, prepare-release, manage-repo, manage-labels,
contribute-oss, browse-discussions, delegate-to-copilot,
discover-github, share-snippet.

Skipped from github#2374 (2): review-pr and handle-notifications — those
names are now used by the renamed-and-deepened skills from the prior
commit, so the catalogue ends up with github#2374's names + this fork's
deeper content for those two.

Each skill is a `skills/<name>/SKILL.md` file embedded via //go:embed,
plus a single Registry.Add() call in pkg/github/bundled_skills.go.
The `allowed-tools` frontmatter list is included verbatim from github#2374
as advisory metadata (not enforced; not surfaced via resource _meta).

Tests: adds Test_BundledSkills_NoDuplicateURIs,
Test_BundledSkills_AllFrontmatterValid, and
Test_BundledSkills_AllReadable — these scale across the full catalogue
and protect against regressions when adding more skills.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: olaservo

pkg/github/bundled_skills.go

@@ -26,6 +26,131 @@ func bundledSkills(_ *inventory.Inventory) *skills.Registry {
 			Name:        "handle-notifications",
 			Description: "Systematically triage the current user's GitHub notifications inbox — enumerate unread items, prioritize by notification reason (review requests, mentions, assignments, security alerts), act on the high-priority ones, then dismiss the rest. Use when the user asks \"what should I work on?\", \"catch me up on GitHub\", \"triage my inbox\", \"what needs my attention?\", or otherwise wants to clear their notifications backlog.",
 			Content:     skills.HandleNotificationsSKILL,
+		}).
+		Add(skills.Bundled{
+			Name:        "get-context",
+			Description: "Understand the current user, their permissions, and team membership. Use when starting any workflow, checking who you are, what you can access, or looking up team membership.",
+			Content:     skills.GetContextSKILL,
+		}).
+		Add(skills.Bundled{
+			Name:        "explore-repo",
+			Description: "Understand an unfamiliar codebase quickly. Use when exploring a new repo, understanding project structure, finding entry points, or getting oriented in code you haven't seen before.",
+			Content:     skills.ExploreRepoSKILL,
+		}).
+		Add(skills.Bundled{
+			Name:        "search-code",
+			Description: "Find code patterns, symbols, and examples across GitHub. Use when searching for code, finding how something is implemented, locating files, or looking for usage examples across repositories.",
+			Content:     skills.SearchCodeSKILL,
+		}).
+		Add(skills.Bundled{
+			Name:        "trace-history",
+			Description: "Understand why code changed by tracing commits and PRs. Use when investigating git history, finding who changed something, understanding the motivation behind a change, or tracking down when a bug was introduced.",
+			Content:     skills.TraceHistorySKILL,
+		}).
+		Add(skills.Bundled{
+			Name:        "create-pr",
+			Description: "Create a well-structured pull request that reviews smoothly. Use when opening a new PR, pushing changes for review, or submitting code changes to a repository.",
+			Content:     skills.CreatePRSKILL,
+		}).
+		Add(skills.Bundled{
+			Name:        "self-review-pr",
+			Description: "Review your own PR before requesting team review. Use when you want to self-check your PR, verify CI status, polish description, or prepare your changes for review.",
+			Content:     skills.SelfReviewPRSKILL,
+		}).
+		Add(skills.Bundled{
+			Name:        "address-pr-feedback",
+			Description: "Handle review comments on your PR and push fixes. Use when you received PR feedback, need to respond to reviewer comments, resolve threads, or push fixes based on review.",
+			Content:     skills.AddressPRFeedbackSKILL,
+		}).
+		Add(skills.Bundled{
+			Name:        "merge-pr",
+			Description: "Get a PR to merge-ready state and merge it. Use when merging a pull request, checking if a PR is ready to merge, updating a PR branch, or converting a draft PR.",
+			Content:     skills.MergePRSKILL,
+		}).
+		Add(skills.Bundled{
+			Name:        "triage-issues",
+			Description: "Categorize, deduplicate, and prioritize incoming issues. Use when triaging issues, labeling bugs, organizing a backlog, closing duplicates, or processing new issue reports.",
+			Content:     skills.TriageIssuesSKILL,
+		}).
+		Add(skills.Bundled{
+			Name:        "create-issue",
+			Description: "Create well-structured, searchable, actionable issues. Use when filing a bug report, requesting a feature, creating a task, or opening any new GitHub issue.",
+			Content:     skills.CreateIssueSKILL,
+		}).
+		Add(skills.Bundled{
+			Name:        "manage-sub-issues",
+			Description: "Break down large issues into trackable sub-tasks. Use when decomposing epics, creating task breakdowns, organizing work into smaller pieces, or managing parent-child issue relationships.",
+			Content:     skills.ManageSubIssuesSKILL,
+		}).
+		Add(skills.Bundled{
+			Name:        "debug-ci",
+			Description: "Investigate and fix failing GitHub Actions workflows. Use when CI is failing, a workflow run errored, you need to read build logs, or debug why tests aren't passing.",
+			Content:     skills.DebugCISKILL,
+		}).
+		Add(skills.Bundled{
+			Name:        "trigger-workflow",
+			Description: "Run, rerun, or cancel GitHub Actions workflow runs. Use when triggering a deployment, rerunning failed jobs, canceling a stuck workflow, or dispatching a workflow manually.",
+			Content:     skills.TriggerWorkflowSKILL,
+		}).
+		Add(skills.Bundled{
+			Name:        "security-audit",
+			Description: "Systematically review code scanning, secret, and dependency alerts. Use when auditing repo security, checking for vulnerabilities, reviewing CodeQL alerts, or investigating exposed secrets.",
+			Content:     skills.SecurityAuditSKILL,
+		}).
+		Add(skills.Bundled{
+			Name:        "fix-dependabot",
+			Description: "Handle vulnerable dependency alerts and update PRs. Use when fixing Dependabot alerts, updating vulnerable packages, reviewing dependency update PRs, or managing supply chain security.",
+			Content:     skills.FixDependabotSKILL,
+		}).
+		Add(skills.Bundled{
+			Name:        "research-vulnerability",
+			Description: "Query the GitHub Advisory Database for security advisories. Use when researching CVEs, looking up GHSA IDs, checking if a package has known vulnerabilities, or reviewing security advisories for a repo or org.",
+			Content:     skills.ResearchVulnerabilitySKILL,
+		}).
+		Add(skills.Bundled{
+			Name:        "manage-project",
+			Description: "Track and update work items in GitHub Projects (v2). Use when managing a project board, updating issue status fields, adding items to a project, querying project items, or posting project status updates.",
+			Content:     skills.ManageProjectSKILL,
+		}).
+		Add(skills.Bundled{
+			Name:        "prepare-release",
+			Description: "Compile release notes from commits and merged PRs. Use when preparing a release, writing a changelog, summarizing changes since last version, or reviewing what shipped.",
+			Content:     skills.PrepareReleaseSKILL,
+		}).
+		Add(skills.Bundled{
+			Name:        "manage-repo",
+			Description: "Create repos, manage branches, and push file changes. Use when creating a new repository, making a branch, committing files via the API, forking a repo, or managing repository contents.",
+			Content:     skills.ManageRepoSKILL,
+		}).
+		Add(skills.Bundled{
+			Name:        "manage-labels",
+			Description: "Set up and maintain a consistent label scheme. Use when creating labels, organizing a label system, cleaning up labels, or standardizing label naming across a repository.",
+			Content:     skills.ManageLabelsSKILL,
+		}).
+		Add(skills.Bundled{
+			Name:        "contribute-oss",
+			Description: "Fork, branch, and submit PRs to external repositories. Use when contributing to open source, forking a repo to make changes, or submitting a pull request to a project you don't own.",
+			Content:     skills.ContributeOSSSKILL,
+		}).
+		Add(skills.Bundled{
+			Name:        "browse-discussions",
+			Description: "Read and explore GitHub Discussions and categories. Use when browsing discussions, reading community conversations, checking discussion categories, or looking for answers in a project's discussions.",
+			Content:     skills.BrowseDiscussionsSKILL,
+		}).
+		Add(skills.Bundled{
+			Name:        "delegate-to-copilot",
+			Description: "Assign Copilot to issues and request Copilot PR reviews. Use when you want Copilot to work on an issue, get an automated code review, or delegate tasks to GitHub Copilot.",
+			Content:     skills.DelegateToCopilotSKILL,
+		}).
+		Add(skills.Bundled{
+			Name:        "discover-github",
+			Description: "Search for users, organizations, and repositories. Use when finding GitHub users, looking up organizations, discovering repos by topic or language, or managing your starred repositories.",
+			Content:     skills.DiscoverGitHubSKILL,
+		}).
+		Add(skills.Bundled{
+			Name:        "share-snippet",
+			Description: "Create and manage code snippets via GitHub Gists. Use when sharing a code snippet, creating a quick paste, saving notes as a gist, or managing your existing gists.",
+			Content:     skills.ShareSnippetSKILL,
 		})
 }
 

pkg/github/bundled_skills_test.go

@@ -242,6 +242,85 @@ func Test_DeclareSkillsExtensionIfEnabled(t *testing.T) {
 	})
 }
 
+// Test_BundledSkills_NoDuplicateURIs guards against accidental duplicate
+// registrations — two skills with the same name would collide on the same
+// skill://github/<name>/SKILL.md URI.
+func Test_BundledSkills_NoDuplicateURIs(t *testing.T) {
+	inv, err := NewInventory(translations.NullTranslationHelper).
+		WithToolsets([]string{"all"}).
+		Build()
+	require.NoError(t, err)
+
+	seen := map[string]string{}
+	for _, b := range bundledSkills(inv).Enabled() {
+		uri := b.URI()
+		if prev, dup := seen[uri]; dup {
+			t.Fatalf("duplicate skill URI %q: previously %q, now %q", uri, prev, b.Name)
+		}
+		seen[uri] = b.Name
+	}
+}
+
+// Test_BundledSkills_AllFrontmatterValid verifies that every embedded SKILL.md
+// has YAML frontmatter where the `name` field matches the final segment of the
+// skill's URI — the SEP's structural requirement that lets hosts resolve
+// skill:// URIs back to the declared skill name.
+func Test_BundledSkills_AllFrontmatterValid(t *testing.T) {
+	inv, err := NewInventory(translations.NullTranslationHelper).
+		WithToolsets([]string{"all"}).
+		Build()
+	require.NoError(t, err)
+
+	for _, b := range bundledSkills(inv).Enabled() {
+		t.Run(b.Name, func(t *testing.T) {
+			require.NotEmpty(t, b.Content, "embedded SKILL.md is empty")
+
+			md := strings.ReplaceAll(b.Content, "\r\n", "\n")
+			require.True(t, strings.HasPrefix(md, "---\n"), "must begin with YAML frontmatter fence")
+
+			end := strings.Index(md[4:], "\n---\n")
+			require.GreaterOrEqual(t, end, 0, "must have closing frontmatter fence")
+			frontmatter := md[4 : 4+end]
+
+			var name string
+			for _, line := range strings.Split(frontmatter, "\n") {
+				if strings.HasPrefix(line, "name:") {
+					name = strings.TrimSpace(strings.TrimPrefix(line, "name:"))
+					break
+				}
+			}
+			assert.Equal(t, b.Name, name, "frontmatter name must match registered skill name and final URI segment of %s", b.URI())
+		})
+	}
+}
+
+// Test_BundledSkills_AllReadable verifies that every registered skill resource
+// returns its embedded content via resources/read — a round-trip safety net
+// against subtle handler mismatches.
+func Test_BundledSkills_AllReadable(t *testing.T) {
+	ctx := context.Background()
+	inv, err := NewInventory(translations.NullTranslationHelper).
+		WithToolsets([]string{"all"}).
+		Build()
+	require.NoError(t, err)
+
+	srv := mcp.NewServer(&mcp.Implementation{Name: "test"}, &mcp.ServerOptions{
+		Capabilities: &mcp.ServerCapabilities{Resources: &mcp.ResourceCapabilities{}},
+	})
+	RegisterBundledSkills(srv, inv)
+	session := connectClient(t, ctx, srv)
+
+	for _, b := range bundledSkills(inv).Enabled() {
+		t.Run(b.Name, func(t *testing.T) {
+			res, err := session.ReadResource(ctx, &mcp.ReadResourceParams{URI: b.URI()})
+			require.NoError(t, err)
+			require.Len(t, res.Contents, 1)
+			assert.Equal(t, "text/markdown", res.Contents[0].MIMEType)
+			assert.Equal(t, b.Content, res.Contents[0].Text)
+		})
+	}
+}
+
 // listResources enumerates resources/list via an in-memory client session.
 func listResources(t *testing.T, ctx context.Context, srv *mcp.Server) []*mcp.Resource {
 	t.Helper()

skills/address-pr-feedback/SKILL.md

@@ -0,0 +1,33 @@
+---
+name: address-pr-feedback
+description: Handle review comments on your PR and push fixes. Use when you received PR feedback, need to respond to reviewer comments, resolve threads, or push fixes based on review.
+allowed-tools:
+  - pull_request_read
+  - add_reply_to_pull_request_comment
+  - resolve_review_thread
+  - push_files
+  - create_or_update_file
+  - update_pull_request_branch
+  - request_pull_request_reviewers
+---
+
+# Address PR Feedback
+
+You received review feedback. Address it systematically, not piecemeal.
+
+## Available Tools
+- `pull_request_read` — read all review comments and threads
+- `add_reply_to_pull_request_comment` — respond to reviewer comments
+- `resolve_review_thread` — mark threads as resolved
+- `push_files` / `create_or_update_file` — push fixes
+- `update_pull_request_branch` — rebase/merge with base branch
+- `request_pull_request_reviewers` — re-request review after addressing
+
+## Workflow
+1. Read ALL comments before responding — comments may be related.
+2. Group related feedback and address together in one commit.
+3. Reply to each comment explaining what you changed (or why you disagree).
+4. Resolve threads only after addressing the concern — not before.
+5. Push fixes, then re-request review.
+
+Don't resolve threads without responding. Don't push fixes without explaining them in the thread.

skills/browse-discussions/SKILL.md

@@ -0,0 +1,21 @@
+---
+name: browse-discussions
+description: Read and explore GitHub Discussions and categories. Use when browsing discussions, reading community conversations, checking discussion categories, or looking for answers in a project's discussions.
+allowed-tools:
+  - list_discussions
+  - get_discussion
+  - get_discussion_comments
+  - list_discussion_categories
+---
+
+# Browse Discussions
+
+Read and explore GitHub Discussions.
+
+## Available Tools
+- `list_discussions` — list discussions in a repo
+- `get_discussion` — get discussion details
+- `get_discussion_comments` — read comments and replies
+- `list_discussion_categories` — list available categories
+
+Call `list_discussion_categories` first to understand the discussion structure. Filter by category to find relevant conversations.

skills/bundled.go

@@ -17,3 +17,78 @@ var ReviewPRSKILL string
 
 //go:embed handle-notifications/SKILL.md
 var HandleNotificationsSKILL string
+
+//go:embed get-context/SKILL.md
+var GetContextSKILL string
+
+//go:embed explore-repo/SKILL.md
+var ExploreRepoSKILL string
+
+//go:embed search-code/SKILL.md
+var SearchCodeSKILL string
+
+//go:embed trace-history/SKILL.md
+var TraceHistorySKILL string
+
+//go:embed create-pr/SKILL.md
+var CreatePRSKILL string
+
+//go:embed self-review-pr/SKILL.md
+var SelfReviewPRSKILL string
+
+//go:embed address-pr-feedback/SKILL.md
+var AddressPRFeedbackSKILL string
+
+//go:embed merge-pr/SKILL.md
+var MergePRSKILL string
+
+//go:embed triage-issues/SKILL.md
+var TriageIssuesSKILL string
+
+//go:embed create-issue/SKILL.md
+var CreateIssueSKILL string
+
+//go:embed manage-sub-issues/SKILL.md
+var ManageSubIssuesSKILL string
+
+//go:embed debug-ci/SKILL.md
+var DebugCISKILL string
+
+//go:embed trigger-workflow/SKILL.md
+var TriggerWorkflowSKILL string
+
+//go:embed security-audit/SKILL.md
+var SecurityAuditSKILL string
+
+//go:embed fix-dependabot/SKILL.md
+var FixDependabotSKILL string
+
+//go:embed research-vulnerability/SKILL.md
+var ResearchVulnerabilitySKILL string
+
+//go:embed manage-project/SKILL.md
+var ManageProjectSKILL string
+
+//go:embed prepare-release/SKILL.md
+var PrepareReleaseSKILL string
+
+//go:embed manage-repo/SKILL.md
+var ManageRepoSKILL string
+
+//go:embed manage-labels/SKILL.md
+var ManageLabelsSKILL string
+
+//go:embed contribute-oss/SKILL.md
+var ContributeOSSSKILL string
+
+//go:embed browse-discussions/SKILL.md
+var BrowseDiscussionsSKILL string
+
+//go:embed delegate-to-copilot/SKILL.md
+var DelegateToCopilotSKILL string
+
+//go:embed discover-github/SKILL.md
+var DiscoverGitHubSKILL string
+
+//go:embed share-snippet/SKILL.md
+var ShareSnippetSKILL string

skills/contribute-oss/SKILL.md

@@ -0,0 +1,34 @@
+---
+name: contribute-oss
+description: Fork, branch, and submit PRs to external repositories. Use when contributing to open source, forking a repo to make changes, or submitting a pull request to a project you don't own.
+allowed-tools:
+  - fork_repository
+  - create_branch
+  - push_files
+  - create_pull_request
+  - get_file_contents
+  - search_repositories
+  - pull_request_read
+---
+
+# Contribute to Open Source
+
+Workflow for contributing to repos you don't have write access to.
+
+## Available Tools
+- `fork_repository` — fork upstream to your account
+- `create_branch` — create feature branch on your fork
+- `push_files` — push changes to your fork
+- `create_pull_request` — PR from your fork to upstream
+- `get_file_contents` — read CONTRIBUTING.md and templates
+- `search_repositories` — find the repo
+- `pull_request_read` — track your PR status
+
+## Workflow
+1. Read CONTRIBUTING.md and CODE_OF_CONDUCT.md first.
+2. Fork the repo, create a feature branch (not main).
+3. Keep changes small and focused — one concern per PR.
+4. Follow the project's existing code style.
+5. Create PR with clear description linking related issues.
+
+Look for good-first-issue labels to find starter tasks. Don't submit large PRs without discussing scope first in an issue.