* Add external reference scanner for skill/agent content
- PowerShell scanner (eng/reference-scanner/scan.ps1) checks for:
- http:// URLs (blocked except localhost and XML namespace URIs)
- External <script> tags without SRI integrity attribute
- Pipe-to-shell patterns (except dotnet install scripts)
- URLs referencing domains not in .github/known-domains.txt
- CI workflow runs on PRs and pushes touching skill/agent paths
- CONTRIBUTING.md updated with external references policy
- README.md: fixed http:// to https:// for agentskills.io
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Move known-domains.txt to eng/reference-scanner/, fix comments, add ollama.com
- Moved from .github/ to eng/reference-scanner/ (co-located with scanner)
- Updated header comments: errors not informational notices, removed misleading org-scoping language
- Added ollama.com (pre-existing reference in dotnet-ai skill)
- Updated all references in scan.ps1, CI workflow, CONTRIBUTING.md
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Address PR review feedback
- Add ? and # as valid URL terminators in path-scoped domain matching
- Strip # from host extraction in Test-KnownDomain and Test-HttpNotHttps
- Make script/SRI regex patterns case-insensitive
- Emit error finding on file read failure instead of silent skip
- Fix help comment (two levels up, not three)
- Unify CONTRIBUTING.md error language (all checks are CI-blocking)
- Add eng/reference-scanner/** to workflow path triggers
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Add cdn.jsdelivr.net to known-domains (used by dashboard after #331 adds SRI)
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Remove cdn.jsdelivr.net from known-domains
jsdelivr serves arbitrary npm packages -- keeping it off the allowlist
means any use requires both SRI and reviewer approval (two gates).
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Skip domain check for scripts with SRI, fix single-line file handling
Scripts with integrity attributes are secured by hash -- the domain
is irrelevant. This means cdn.jsdelivr.net does not need to be in
known-domains.txt as long as SRI is present.
Also wrap Get-Content in @() to handle single-line files correctly.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Address round-2 review feedback
- Multi-line <script> tag detection: join file content so SRI attributes
spanning lines are correctly detected
- Safe relative path: use GetRelativePath() with fallback instead of
bare Substring that throws for out-of-repo files
- Remove dead notice plumbing: all findings are errors now
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Scan only changed files on PRs, full scan on push to main
PRs scan only changed .md/.html files so pre-existing issues on main
don't block unrelated PRs. Push to main runs the full -All scan.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---------
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Add dotnet-maui-doctor skill and refs
Add a new .agents/skills/dotnet-maui-doctor skill bundle. Includes SKILL.md describing an autonomous workflow to detect and remediate .NET MAUI environment issues and platform-specific reference docs for installation commands, platform requirements, troubleshooting, Microsoft OpenJDK guidance, and a WorkloadDependencies discovery guide that pulls authoritative versions from NuGet. Documents validation/remediation steps for .NET SDK, workloads, JDK, Android SDK, Xcode, and Windows SDK (macOS/Windows/Linux) and includes a temporary recommendation to prefer Microsoft OpenJDK (JDK 21) until manifests are updated.
* MAUI doesn't quite yet support dotnet run
* Add dotnet-maui plugin and dotnet-maui-doctor skill
Introduce the dotnet-maui plugin and move the dotnet-maui-doctor skill under plugins/ layout. Update marketplace, CODEOWNERS, and README accordingly.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Add comprehensive eval scenarios for dotnet-maui-doctor
10 scenarios covering: macOS/Linux/Windows setup, JDK vendor enforcement,
workload update/repair guardrails, dynamic version discovery, JAVA_HOME
misconception, Android SDK diagnosis, out-of-scope decline, and stale
workload remediation.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Refine eval scenarios: remove weak scenarios, fix overfitting
Remove 'Resist hardcoding' (penalizes skill — baseline gives more useful
direct answer) and 'Decline runtime bug' (skill makes agent refuse to
help). Rework Android SDK scenario to test CI-oriented package discovery
where baseline lacks knowledge. Replace vocabulary-level NuGet/API
assertions with outcome-focused rubric items across all scenarios.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Remove hardcoded JDK version workarounds in favor of dynamic discovery
Replace temporary JDK 21 workaround notes with guidance to use the
version from WorkloadDependencies.json. Replace hardcoded JDK paths
in troubleshooting.md with {VERSION} placeholders.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Improve eval scenarios: fix JAVA_HOME timeout, macOS tie, reduce overfitting
- JAVA_HOME: rewrite prompt to request conceptual answer (prevents tool timeout)
- macOS Xcode: add installation source guidance, remove equal-penalty assertion
- Remove irrelevant workload update/repair assertions from 3 off-topic scenarios
- Keep workload assertions in 5 scenarios where workload management is the topic
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Reframe JAVA_HOME scenario as prevent-harmful-action pattern
Rewrite prompt from conceptual yes/no question (which the agent answered
from wrong general knowledge without activating the skill) to a scenario
where the user is about to apply incorrect Stack Overflow advice. This
mirrors the successful workload guardrail pattern.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Reduce overfitting: rephrase assertions and rubric to be outcome-focused
- Replace literal '--version' assertions with broader 'version|pin' pattern
- Rephrase Xcode rubric from skill-specific source to version control risk
- Rephrase version discovery rubric from 'NuGet API' to outcome-focused
- Rephrase workload install rubric from '--version flag' to 'pinned version'
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Inline critical JAVA_HOME auto-detection guidance into SKILL.md
The JAVA_HOME eval scenario scored poorly because the agent couldn't read
the reference file (references/microsoft-openjdk.md) and fell back on
general knowledge, which incorrectly says JAVA_HOME must be set.
Changes:
- Task 5: Add inline JAVA_HOME guidance with decision table showing that
JAVA_HOME is NOT required and MAUI auto-detects JDK installations
- Common Pitfalls: Add 'Unnecessary JAVA_HOME' entry with unset commands
This ensures the agent knows JAVA_HOME is unnecessary even when reference
files can't be loaded. File stays at 210 lines (limit: 500).
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Inline JAVA_HOME auto-detection knowledge into SKILL.md
Add JAVA_HOME guidance directly to Task 5, Task 9, and Common Pitfalls
so the agent knows JAVA_HOME is not required even when reference files
can't be read. Based on Redth's original microsoft-openjdk.md reference.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Address code review feedback from Copilot
- Fix cmd.exe syntax in installation-commands.md (use PowerShell $env:)
- Replace hardcoded simulator device/runtime with placeholders
- Add System.IO.Compression.FileSystem assembly load for PS 5.1 compat
- Clarify workload reinstall example is macOS-specific (omit ios on Linux)
- Replace hardcoded android-35 with $API_LEVEL placeholder
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Address jonathanpeppers review feedback
- Add Apple Developer login/2FA note for Xcode downloads
- Fix Windows SDK detection: extract KitsRoot10 and version subkeys
instead of dumping full registry (was outputting noise)
- Replace manual NuGet API approach with dotnet workload search version
CLI command for discovering workload versions
- Reframe JAVA_HOME guidance: report as anomaly rather than prescribing
unset/set commands (per jonathanpeppers recommendation)
- Use $env:ProgramFiles instead of hardcoded C:\Program Files paths
in PowerShell commands
- Update SKILL.md to match: softer JAVA_HOME guidance, improved
Windows SDK detection command
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Address Redth review feedback
- Remove Windows SDK detection commands — installed automatically
via MAUI workload/VS Installer (per Redth recommendation)
- Use dotnet workload search version --format json --take 1 for
workload version discovery instead of NuGet search API (per both
Redth and jonathanpeppers)
- Update workload-dependencies-discovery.md Step 2 to match
- Expand Android SDK detection with known filesystem paths
instead of relying solely on environment variables
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Align eval rubric with reviewer feedback to reduce overfitting
Replace technique-specific rubric items with outcome-focused criteria:
- Replace PowerShell API query check with dotnet CLI discovery check
- Replace manifest extraction check with workload-version-based discovery
- Replace prescriptive version discovery with CLI/docs verification
- Convert workload update/repair regex assertions to rubric criteria
- Remove Invoke-RestMethod assertion (no longer using API queries)
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Align JAVA_HOME guidance with reviewer consensus, add Xcode download expectations
- Consistently use ⚠️ anomaly approach for non-Microsoft JAVA_HOME across
microsoft-openjdk.md and troubleshooting.md (matching SKILL.md)
- Remove contradictory Note in microsoft-openjdk.md that conflicted with table
- Reframe unset commands as user's choice, not automatic action
- Add Xcode download size (~12GB) and time expectations per Redth's feedback
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Update plugins/dotnet-maui/skills/dotnet-maui-doctor/references/workload-dependencies-discovery.md
Co-authored-by: Jonathan Peppers <jonathan.peppers@gmail.com>
* Update JDK example to version 21 per jonathanpeppers feedback
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---------
Co-authored-by: redth <jondick@gmail.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Jonathan Peppers <jonathan.peppers@gmail.com>
* Update README with VS Code plugin instructions
Added instructions for enabling VS Code plugin support and using agent plugins.
* Update README.md
---------
Co-authored-by: Larry Ewing <lewing@microsoft.com>
* Enhance README with new plugin and workflow sections
Added new sections for distribution templates, agentic workflows, and Copilot extension in the README.
* Add MIT License to the project
* Add LICENSE file
* Update README.md
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
---------
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Dan Moseley