GitHub Copilot Skills: cómo crear Agent Skills con SKILL.md

.github/skills/

.agents/skills/

.claude/skills/

~/.copilot/skills/

~/.agents/skills/

.github/
└── skills/
    └── security-review/
        └── SKILL.md

---
name: security-review
description: Review code changes for security vulnerabilities. Use when asked to audit authentication, authorization, input validation, secrets, SQL, APIs, or security-sensitive code.
---

# Security Review

When reviewing security-sensitive code:

1. understand the trust boundaries
2. identify attacker-controlled input
3. inspect authentication
4. inspect authorization
5. inspect data validation
6. inspect persistence
7. inspect output encoding
8. inspect secret handling

Report findings with:

- severity
- file
- affected code
- exploit scenario
- recommended fix

Do not report speculative issues
without explaining
a realistic failure path.

Correcto:

security-review

wordpress-debugging

woocommerce-api-testing


Evita:

Security Review

security/review

company:security-review

security.review

description: Audit WordPress PHP code for authentication, authorization, nonce, capability, SQL injection, XSS, CSRF, sanitization, escaping, and unsafe REST or AJAX handlers. Use when asked for a WordPress security review.

---
name: production-release
description: Run the production release verification workflow.
user-invocable: true
disable-model-invocation: true
argument-hint: "[version]"
---

# Production Release

Only run this workflow
when explicitly invoked by the user.

Never deploy automatically.

1. verify working tree
2. run tests
3. run build
4. inspect changelog
5. verify version
6. prepare release summary
7. stop before deployment

/production-release 2.4.0

---
name: api-conventions
description: Internal knowledge for working with this project's API conventions and response formats.
user-invocable: false
---

# API conventions

...

.github/
└── skills/
    └── wordpress-security/
        │
        ├── SKILL.md
        │
        ├── checklist.md
        │
        ├── examples/
        │   ├── secure-ajax.php
        │   └── secure-rest.php
        │
        └── scripts/
            └── scan-php.sh

# Security Review

Before reviewing:

1. Read the [security checklist](./checklist.md).
2. Compare WordPress AJAX handlers with
   [secure AJAX example](./examples/secure-ajax.php).
3. Compare REST routes with
   [secure REST example](./examples/secure-rest.php).

If static analysis is useful,
run:

[scripts/scan-php.sh](./scripts/scan-php.sh)

name: wordpress-security

/wordpress-security

Review the current plugin changes.

/wordpress-security

Review only:

includes/class-rest-api.php

Focus on authorization
and ownership checks.

Prompt:

Audit the WordPress REST endpoints
for authorization vulnerabilities.

Available skill:

wordpress-security

↓

Copilot detects relevance

↓

Loads SKILL.md

↓

Executes specialized procedure

/skills

/create-skill

Create a reusable skill
for debugging WordPress AJAX failures.

It should check:

- request payload
- action name
- nonce
- authentication
- capabilities
- PHP errors
- wp_send_json_* responses
- browser network response

Do not automatically modify code
until the root cause is identified.

Create an Agent Skill
from the debugging workflow
we just followed.

Keep only
the reusable procedure.

Do not include
details specific
to this one bug.

---
name: architecture-audit
description: Analyze a repository architecture and return a concise architecture risk report.
context: fork
---

# Architecture Audit

Inspect:

- module boundaries
- dependency direction
- data flow
- duplicated abstractions
- coupling
- test boundaries

Return only:

- findings
- evidence
- risks
- recommended next steps

/skills

/skills list

/skills info wordpress-security

/skills reload

copilot skill list

copilot skill add ./wordpress-security/SKILL.md

copilot skill add --project ./wordpress-security/SKILL.md

copilot skill enable wordpress-security

copilot skill disable wordpress-security

copilot skill remove wordpress-security

copilot skill add ~/my-agent-skills

---
name: test-runner
description: Run and diagnose the project's automated test suite.
allowed-tools:
  - shell
---

# Test runner

Run the narrowest relevant test first.

If it fails:

1. capture the failure
2. identify the failed assertion
3. inspect related code
4. explain the hypothesis
5. rerun after the fix

gh skill search testing

gh skill preview OWNER/REPOSITORY SKILL

gh skill install github/awesome-copilot documentation-writer

gh skill install \
  github/awesome-copilot \
  documentation-writer \
  --pin v1.2.0

gh skill update

gh skill update wordpress-security

gh skill update --all

---
name: root-cause-debugging
description: Diagnose software failures systematically before editing code. Use for bugs, exceptions, failed tests, broken APIs, regressions, and unexpected behavior.
---

# Root Cause Debugging

Do not begin by editing code.

## Step 1 — Reproduce

Identify the smallest
reliable reproduction.

## Step 2 — Observe

Collect:

- exact error
- stack trace
- request
- response
- logs
- failing assertion

## Step 3 — Trace

Follow the execution path
from input
to failure.

## Step 4 — Hypothesis

State the likely root cause
and evidence.

## Step 5 — Prove

Use a targeted check
or regression test.

## Step 6 — Fix

Apply the smallest safe change.

## Step 7 — Verify

Run:

- regression test
- related tests
- lint
- build when relevant

## Final report

Return:

- root cause
- evidence
- change
- verification
- remaining uncertainty

---
name: high-signal-pr-review
description: Review a pull request for real correctness, security, data-loss, API-contract, concurrency, and regression risks. Use when asked to review a PR or diff.
context: fork
---

# High Signal Pull Request Review

Focus on defects
that can change behavior.

Prioritize:

1. correctness
2. security
3. authorization
4. data integrity
5. API compatibility
6. race conditions
7. missing regression tests

For every finding include:

- severity
- file
- line or code area
- failure scenario
- why it matters
- recommended fix

Do not report
purely stylistic preferences
unless they cause
a concrete defect.

---
name: wordpress-security
description: Audit WordPress plugins and themes for authentication, authorization, nonce, capability, CSRF, SQL injection, XSS, sanitization, escaping, REST API, AJAX, file handling, and WooCommerce security issues. Use for WordPress security reviews.
---

# WordPress Security Review

## 1. Map attack surface

Find:

- admin actions
- AJAX handlers
- REST routes
- form handlers
- shortcodes
- upload handlers
- cron callbacks
- WooCommerce hooks
- database writes

## 2. Authentication

Check whether actions
that require a user
actually enforce authentication.

## 3. Authorization

For every state-changing action:

- check capabilities
- check ownership
- validate resource access

Authentication alone
is not authorization.

## 4. CSRF

Check nonces
for browser-originated
state-changing actions
where appropriate.

## 5. Input

For every external value:

- determine expected type
- validate
- normalize
- sanitize before storage

## 6. SQL

Review:

- $wpdb queries
- dynamic table names
- dynamic WHERE clauses
- ORDER BY
- LIKE
- LIMIT

Use $wpdb->prepare()
for untrusted dynamic values.

## 7. Output

Check escaping
at the final output context:

- esc_html()
- esc_attr()
- esc_url()
- wp_kses()

as appropriate.

## 8. REST API

Inspect:

- register_rest_route()
- permission_callback
- ownership
- validation
- response data

## 9. AJAX

Inspect:

- wp_ajax_*
- wp_ajax_nopriv_*
- nonce
- capability
- ownership
- validation
- response

## 10. WooCommerce

Prefer public APIs.

Avoid direct dependence
on undocumented internals.

## Findings

Report only concrete issues.

For each finding:

- severity
- affected file
- vulnerable flow
- attacker requirements
- impact
- recommended fix

Do not modify code
unless explicitly requested.

---
name: woocommerce-order-debugging
description: Diagnose WooCommerce order, checkout, payment, status-transition, webhook, and order-meta bugs. Use when investigating WooCommerce order flows.
---

# WooCommerce Order Debugging

First map:

checkout
↓
order creation
↓
payment
↓
status transition
↓
hooks
↓
email/webhooks
↓
custom integrations

Prefer WooCommerce public APIs.

Inspect:

- order notes
- status transitions
- hook priority
- duplicate callbacks
- idempotency
- payment callbacks
- webhook retries
- custom metadata

Do not directly update
WooCommerce internal tables
unless the project
explicitly requires it.

GitHub MCP
provides:

- workflow runs
- job logs
- pull requests
- issues

Skill provides:

- order of operations
- failure diagnosis
- decision rules
- verification process

↓

Specialized workflow

copilot-instructions.md
│
├── architecture
├── coding standards
└── project rules


wordpress-security/
└── SKILL.md
    │
    ├── audit workflow
    ├── security checklist
    └── validation procedure


Prompt
↓
Project rules
+
Relevant Skill
↓
Specialized execution

chat.useCustomizationsInParentRepositories

Plugin
│
├── Agent Skills
├── Custom Agents
├── MCP
└── Hooks

---
name: skill-name
description: Explain what this skill does and exactly when Copilot should use it.
argument-hint: "[target]"
---

# Purpose

Explain the result
this skill helps produce.


# When to use

Use this skill when:

- condition 1
- condition 2
- condition 3


# Inputs

Before starting,
identify:

- target
- relevant context
- constraints


# Procedure

## Step 1 — Inspect

...

## Step 2 — Analyze

...

## Step 3 — Execute

...

## Step 4 — Verify

...


# Decision rules

If X:

do Y.

If Z:

stop and report.


# Safety

Never:

- expose secrets
- run destructive operations without need
- bypass authorization
- claim tests passed without running them


# Completion criteria

The task is complete when:

- criterion 1
- criterion 2
- criterion 3


# Final response

Report:

- actions performed
- files changed
- verification
- remaining risks