mirror of https://github.com/dotnet/skills.git synced 2026-09-20 09:49:54 +08:00

Files

T

Dan Moseley 64464e87e3 Add external reference scanner for skill/agent content (#336 )

* Add external reference scanner for skill/agent content

- PowerShell scanner (eng/reference-scanner/scan.ps1) checks for:
  - http:// URLs (blocked except localhost and XML namespace URIs)
  - External <script> tags without SRI integrity attribute
  - Pipe-to-shell patterns (except dotnet install scripts)
  - URLs referencing domains not in .github/known-domains.txt
- CI workflow runs on PRs and pushes touching skill/agent paths
- CONTRIBUTING.md updated with external references policy
- README.md: fixed http:// to https:// for agentskills.io

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Move known-domains.txt to eng/reference-scanner/, fix comments, add ollama.com

- Moved from .github/ to eng/reference-scanner/ (co-located with scanner)
- Updated header comments: errors not informational notices, removed misleading org-scoping language
- Added ollama.com (pre-existing reference in dotnet-ai skill)
- Updated all references in scan.ps1, CI workflow, CONTRIBUTING.md

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Address PR review feedback

- Add ? and # as valid URL terminators in path-scoped domain matching
- Strip # from host extraction in Test-KnownDomain and Test-HttpNotHttps
- Make script/SRI regex patterns case-insensitive
- Emit error finding on file read failure instead of silent skip
- Fix help comment (two levels up, not three)
- Unify CONTRIBUTING.md error language (all checks are CI-blocking)
- Add eng/reference-scanner/** to workflow path triggers

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Add cdn.jsdelivr.net to known-domains (used by dashboard after #331 adds SRI)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Remove cdn.jsdelivr.net from known-domains

jsdelivr serves arbitrary npm packages -- keeping it off the allowlist
means any use requires both SRI and reviewer approval (two gates).

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Skip domain check for scripts with SRI, fix single-line file handling

Scripts with integrity attributes are secured by hash -- the domain
is irrelevant. This means cdn.jsdelivr.net does not need to be in
known-domains.txt as long as SRI is present.

Also wrap Get-Content in @() to handle single-line files correctly.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Address round-2 review feedback

- Multi-line <script> tag detection: join file content so SRI attributes
  spanning lines are correctly detected
- Safe relative path: use GetRelativePath() with fallback instead of
  bare Substring that throws for out-of-repo files
- Remove dead notice plumbing: all findings are errors now

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Scan only changed files on PRs, full scan on push to main

PRs scan only changed .md/.html files so pre-existing issues on main
don't block unrelated PRs. Push to main runs the full -All scan.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

---------

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

2026-03-12 10:43:19 -06:00

2.8 KiB

Raw Permalink Blame History

.NET Agent Skills

This repository contains the .NET team's curated set of core skills and custom agents for coding agents. For information about the Agent Skills standard, see agentskills.io.

What's Included

Plugin	Description
dotnet	Collection of core .NET skills for handling common .NET coding tasks.
dotnet-data	Skills for .NET data access and Entity Framework related tasks.
dotnet-diag	Skills for .NET performance investigations, debugging, and incident analysis.
dotnet-msbuild	Comprehensive MSBuild and .NET build skills: failure diagnosis, performance optimization, code quality, and modernization.
dotnet-upgrade	Skills for migrating and upgrading .NET projects across framework versions, language features, and compatibility targets.
dotnet-maui	Skills for .NET MAUI development: environment setup, diagnostics, and troubleshooting.
dotnet-ai	AI and ML skills for .NET: technology selection, LLM integration, agentic workflows, RAG pipelines, MCP, and classic ML with ML.NET.

Installation

🚀 Plugins - Copilot CLI / Claude Code

Launch Copilot CLI or Claude Code
Add the marketplace:
```
/plugin marketplace add dotnet/skills
```

Install a plugin:

/plugin install <plugin>@dotnet-agent-skills

Restart to load the new plugins
View available skills:
```
/skills
```
View available agents:
```
/agents
```

Update plugin (on demand):

/plugin update <plugin>@dotnet-agent-skills

VS Code / VS Code Insiders (Preview)

Important

VS Code plugin support is a preview feature and subject to change. You may need to enable it first.

// settings.json
{
  "chat.plugins.enabled": true,
  "chat.plugins.marketplaces": ["dotnet/skills"]
}

Once configured, type /plugins in Copilot Chat or use the @agentPlugins filter in Extensions to browse and install plugins from the marketplace.

⚡ Agentic Workflows

Some plugins include GitHub Agentic Workflow templates for CI/CD automation:

Install the gh aw CLI extension
Copy the desired workflow .md files and the shared/ directory to your repository's .github/workflows/
Compile and commit:
```
gh aw compile
```
Commit both the .md and generated .lock.yml files

Contributing

See CONTRIBUTING.md for contribution guidelines and how to add a new plugin.

License

See LICENSE for details.

2.8 KiB Raw Permalink Blame History