plugins/developer-kit-tools/skills/copilot-cli/SKILL.md
Provides GitHub Copilot CLI task delegation in non-interactive mode with multi-model support (Claude, GPT, Gemini), permission controls, output sharing, and session resume. Use when users ask to hand work to Copilot, compare models, or run Copilot programmatically from Claude Code.
npx skillsauth add giuseppe-trisciuoglio/developer-kit copilot-cliInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
Delegate selected tasks from Claude Code to GitHub Copilot CLI using non-interactive commands, explicit model selection, safe permission flags, and shareable outputs.
This skill standardizes delegation to GitHub Copilot CLI (copilot) for cases where a different model may be more suitable for a task. It covers:
-p / --prompt--model--allow-tool, --allow-all-tools, --allow-all-paths, --allow-all-urls, --yolo)--silent--share--resumeUse this skill only when delegation to Copilot is explicitly requested or clearly beneficial.
Use this skill when:
Trigger phrases:
# CLI availability
copilot --version
# GitHub authentication status
gh auth status
If copilot is unavailable, ask the user to install/setup GitHub Copilot CLI before proceeding.
All delegated prompts to Copilot CLI must be in English.
Prompt template:
Task: <clear objective>
Context: <project/module/files>
Constraints: <do/don't constraints>
Expected output: <format + depth>
Validation: <tests/checks to run or explain>
Pick a model based on task type and user preference.
Use exact model names available in the local Copilot CLI model list.
Default to the minimum required capability.
--allow-tool '<tool>' when task scope is narrow--allow-all-tools only when multiple tools are clearly needed--allow-all-paths only if task requires broad filesystem access--allow-all-urls only if external URLs are required--yolo unless the user explicitly requests full permissionsBase pattern:
copilot -p "<english prompt>" --model <model-name> --allow-all-tools --silent
Add optional flags only as needed:
# Capture session to markdown
copilot -p "<english prompt>" --model <model-name> --allow-all-tools --share
# Resume existing session
copilot --resume <session-id> --allow-all-tools
# Strictly silent scripted output
copilot -p "<english prompt>" --model <model-name> --allow-all-tools --silent
After command execution:
--share is used, provide generated markdown pathWhen requested, run the same prompt with multiple models and compare:
Keep the comparison objective and concise.
Input:
Ask Copilot to refactor this service using GPT-5.2 and return only concrete code changes.
Command:
copilot -p "Refactor the payment service in src/services/payment.ts to reduce duplication. Keep public behavior unchanged, keep TypeScript strict typing, and output a patch-style response." \
--model gpt-5.2 \
--allow-all-tools \
--silent
Output:
Copilot proposes extracting three private helpers, consolidating error mapping, and provides a patch for payment.ts with unchanged API signatures.
Input:
Use Copilot CLI with Sonnet to review this module and share the session in markdown.
Command:
copilot -p "Review src/modules/auth for security and correctness. Report only high-confidence findings with severity and file references." \
--model claude-sonnet-4.6 \
--allow-all-tools \
--share
Output:
Review completed. Session exported to ./copilot-session-<id>.md.
Input:
Continue the previous Copilot analysis session.
Command:
copilot --resume <session-id> --allow-all-tools
Output:
Session resumed and continued from prior context.
--share when auditability matters--allow-all-tools, --allow-all-paths, --allow-all-urls, and --yolo increase risk; use only when justifiedFor additional option details, see references/cli-command-reference.md.
development
Provides security review capability for TypeScript/Node.js applications, validates code against XSS, injection, CSRF, JWT/OAuth2 flaws, dependency CVEs, and secrets exposure. Use when performing security audits, before deployment, reviewing authentication/authorization implementations, or ensuring OWASP compliance for Express, NestJS, and Next.js. Triggers on "security review", "check for security issues", "TypeScript security audit".
development
Provides final code cleanup after task review approval. Removes debug logs, temporary comments, dead code, optimizes imports, and improves readability. Use when asked to clean up code, polish, finalize, tidy up, remove technical debt, or prepare code for completion after review. Not for refactoring logic or fixing bugs—focused solely on cosmetic and hygiene cleanup.
tools
Ralph Wiggum-inspired automation loop for specification-driven development. Orchestrates task implementation, review, cleanup, and synchronization using a Python script. Use when: user runs /loop command, user asks to automate task implementation, user wants to iterate through spec tasks step-by-step, or user wants to run development workflow automation with context window management. One step per invocation. State machine: init → choose_task → implementation → review → fix → cleanup → sync → update_done. Supports --from-task and --to-task for task range filtering. State persisted in fix_plan.json.
testing
Creates, updates, validates, and displays the architectural DNA of a project through two shared documents: docs/specs/architecture.md (technology stack, architectural rules, security constraints, AI guardrails) and docs/specs/ontology.md (domain glossary / Ubiquitous Language). Use BEFORE brainstorm as a project setup step, or at any point in the SDD lifecycle to validate specs/tasks against architecture principles. Triggers on 'create constitution', 'update constitution', 'constitution check', 'validate against constitution', 'project principles', 'architectural guardrails', 'setup project architecture', 'define ontology'.