TFSUG.JP Agent Skills

Personal plugins for Azure DevOps, GitHub, .NET package maintenance, Relaypublisher, Windows shell-safe command execution, Azure managed identity review, native container workflows on Windows and macOS, and recurrence-prevention rules for .NET, Azure, and PowerShell work (skills + agents). The repository is structured so the same plugin content can be tested with Claude Code, GitHub Copilot, and Codex.

Plugins

Plugin	Included skills and agents
azure-devops-toolkit	Skills: Azure DevOps Foundation, Boards, Repos, Pipelines, Artifacts, Test Plans, Wikis, Advanced Security, CLI, security triage. Boards uses native PowerShell on Windows, writes body fields as Markdown, records the root cause and fix approach in a Bug's Repro Steps, links work items back to their Wiki pages, and Feature-equivalent Work Items and approved Bug fix plans require Wiki traceability. Wikis publishes plans and bug fix plans under a repository-rooted hierarchy (/<repo> overall design, /<repo>/plan and /<repo>/bug indexes) with bundled page templates and validators. Agents: Azure DevOps Agent, Azure DevOps Work Item Agent
nuget-validate	NuGet vulnerability, deprecation, listing, freshness, and project-audit validation
dependabot-safe-merge	Safe Dependabot refresh, release-age policy, merge gates, and major-upgrade planning
github-plan-wiki	Skills: GitHub Plan Issues (template-aware issue hierarchy), GitHub Issue Artifacts (long or rich issue records), GitHub Wiki Plan (bilingual wiki plans), GitHub Pull Request (acceptance tracking and per-issue closing keywords)
relaypublisher-manifest	Relaypublisher manifest creation, updates, and static validation for v1.1.0, including Windows Win32 script/file-system detection and multi-bundle macOS PKG/LOB detection
repository-init	Explicit repository initialization for license, security, language rules, and AGENTS.md guidance
azure-managed-identity-review	Read-only review of Azure managed identities: finds every resource, app setting, code path, and federated credential that shares an identity, and reports missing grants for each consumer's audience, grants leaked to other consumers, identity selection mistakes, and IaC drift (msi_review.py, rules MIR000-MIR008)
windows-shell-safety	Windows-safe Azure CLI, JSON, and pipe execution: rules against cmd.exe argument loss, a pre-execution lint (Test-NativeCommand.ps1), and a PowerShell 7 helper that sends JSON through UTF-8 @<file>
native-container-cli	Prefer WSL Containers on Windows and Apple container on macOS; translate supported Docker commands and ask before Docker fallback, including unsupported Compose or Docker API integrations
dotnet-azure-lessons	Skills: .NET Architecture Design, .NET Coding, VS Extension Remote UI, PowerShell Scripting, .NET Debugging, .NET Testing, .NET Documentation, .NET CI/CD, PR and Issue Workflow, .NET Development on macOS, Agent Sandbox Troubleshooting, each with rules, checks, and reasons learned from past corrections. Agent: .NET Lessons Reviewer (read-only diff review against those checks)

All plugins are distributed under the MIT License. The plugin bundles contain no credentials and do not configure an MCP server automatically. Azure DevOps authentication and permissions remain the responsibility of the user.

Install from the Claude Code marketplace

Add the repository as a marketplace, then install the plugin you need:

claude plugin marketplace add tfsugjp/skills
claude plugin install azure-devops-toolkit@tfsugjp-agent-skills
claude plugin install nuget-validate@tfsugjp-agent-skills
claude plugin install dependabot-safe-merge@tfsugjp-agent-skills
claude plugin install github-plan-wiki@tfsugjp-agent-skills
claude plugin install relaypublisher-manifest@tfsugjp-agent-skills
claude plugin install repository-init@tfsugjp-agent-skills
claude plugin install windows-shell-safety@tfsugjp-agent-skills
claude plugin install azure-managed-identity-review@tfsugjp-agent-skills
claude plugin install native-container-cli@tfsugjp-agent-skills
claude plugin install dotnet-azure-lessons@tfsugjp-agent-skills

Install from the GitHub Copilot marketplace

The Copilot CLI reads the shared Claude marketplace catalog in this repository:

copilot plugin marketplace add tfsugjp/skills
copilot plugin install azure-devops-toolkit@tfsugjp-agent-skills
copilot plugin install nuget-validate@tfsugjp-agent-skills
copilot plugin install dependabot-safe-merge@tfsugjp-agent-skills
copilot plugin install github-plan-wiki@tfsugjp-agent-skills
copilot plugin install relaypublisher-manifest@tfsugjp-agent-skills
copilot plugin install repository-init@tfsugjp-agent-skills
copilot plugin install windows-shell-safety@tfsugjp-agent-skills
copilot plugin install azure-managed-identity-review@tfsugjp-agent-skills
copilot plugin install native-container-cli@tfsugjp-agent-skills
copilot plugin install dotnet-azure-lessons@tfsugjp-agent-skills

Install from the Codex repository-local marketplace

Set REPO_ROOT to the checked-out repository directory. Codex uses the repository-local catalog under .agents/plugins/:

codex plugin marketplace add "$REPO_ROOT"
codex plugin add azure-devops-toolkit@tfsugjp-agent-skills
codex plugin add nuget-validate@tfsugjp-agent-skills
codex plugin add dependabot-safe-merge@tfsugjp-agent-skills
codex plugin add github-plan-wiki@tfsugjp-agent-skills
codex plugin add relaypublisher-manifest@tfsugjp-agent-skills
codex plugin add repository-init@tfsugjp-agent-skills
codex plugin add windows-shell-safety@tfsugjp-agent-skills
codex plugin add azure-managed-identity-review@tfsugjp-agent-skills
codex plugin add native-container-cli@tfsugjp-agent-skills
codex plugin add dotnet-azure-lessons@tfsugjp-agent-skills

Use repository-init only with an explicit $repository-init request. It initializes missing governance files in a new or existing repository, records the resolved license and language profile in .repository-init.json, and leaves a completed repository unchanged on later invocations. It does not initialize Git, create remotes, create issues or work items, publish Wiki pages, commit, or push.

The Codex local marketplace is intended for development and team distribution. Public Codex listing submission is a separate release step after the plugins pass validation.

GitHub Pull Requests and Issue Templates

Use github-pull-request to create a GitHub PR or update its description. It follows the repository's PR template and requires a separate Fixed #number line for each completed bug issue or Close #number line for each other completed issue. Grouped references such as Close #10, #11 fail the mandatory body preflight. Reference-only issues and unfinished parent issues stay open. Automatic closure occurs after a merge into the default branch; a PR targeting another branch reports that limitation.

The github-plan-issues skill also follows repository Issue templates and required form fields. Both workflows preserve template requirements before submitting a UTF-8 body and verify the stored body after writing. Use $github-pull-request explicitly when needed; installing the plugin makes the skill available for automatic discovery, but the client controls invocation. The validator is a required skill step, not a GitHub server-side enforcement rule.

When creating or updating PRs, the GitHub and Azure Repos workflows assess related acceptance criteria against implementation and verification evidence, update supported checklist items only when verified, and verify the resulting tracking links. Unverified criteria stay open; updating a checklist does not itself close the tracked item.

For lengthy GitHub Issue details or richer records, github-issue-artifacts requires an Issue Artifact for supporting material while keeping the summary and acceptance criteria in the Issue. The approved Wiki plan remains part of the workflow. Artifact operations are in public preview; if an artifact cannot be created or verified, the workflow reports the outstanding work.

Windows Shell Safety

windows-shell-safety is for agents (and people) running Azure CLI and other native commands on Windows. az is the batch file az.cmd, so its arguments are parsed by PowerShell and then by cmd.exe: unquoted |, &, <, >, ^ are consumed, %VAR% is expanded, and double quotes inside inline JSON are stripped. Retrying with different escaping wastes time; the skill prescribes one safe path instead.

• Rules: use pwsh only, run scripts with pwsh -File instead of -Command strings, pass JSON through a UTF-8 file as '@<file>', filter az output with ConvertFrom-Json (or load --query from '@<file>'), and set UTF-8 console encoding before parsing native output.
• Lint before running: Test-NativeCommand.ps1 reports rules WSS001-WSS009 (for example cmd.exe, nested -Command, cmd metacharacters or inline JSON passed to az, unquoted @file) with the reason and the safe rewrite, and exits with 1 when it finds anything.
• Helper: dot-source Invoke-NativeJson.ps1 for Invoke-AzJson / Invoke-NativeJson (UTF-8 body file, parsed JSON output, -Raw for text output, refusal of arguments cmd.exe would rewrite) and -EchoArgs / Show-NativeArgs to see the argv a .cmd target actually receives.

$skill = 'plugins/windows-shell-safety/skills/windows-shell-safety'
pwsh -NoProfile -File "$skill/scripts/Test-NativeCommand.ps1" -Command 'az version --query "keys(@)|[0]" -o tsv'
. "$skill/scripts/Invoke-NativeJson.ps1"
(Invoke-AzJson -Arguments 'version').'azure-cli'

The skill is advisory: it ships no hook, so lint findings never block a tool call on their own.

Native Container CLI

native-container-cli selects wslc.exe on Windows and Apple's container on macOS for local Linux-container operations. It adapts Docker examples using the installed CLI's supported commands and flags, preserving mounts, ports, platforms, lifecycle, and output parsing. Linux and remote execution targets retain their selected runtime.

When a faithful native equivalent is unavailable, the skill asks before invoking Docker, including Compose, diagnostic probes, and integrations that call Docker internally. Installing the plugin enables normal skill discovery; it does not install container software or enforce a shell hook. See the Japanese guide.

Azure Managed Identity Review

azure-managed-identity-review is for changes that give a resource a managed identity. A user-assigned identity created for one resource (for example a storage account's customer-managed key) is often reused by others (a Function App, a GitHub Actions workflow through a federated credential). Grants made for the first purpose then miss the other consumers' audiences (Service Bus, SQL, Cosmos DB data plane, custom APIs), or leak to consumers that should not have them. Local E2E runs as the developer, so missing grants only appear after deployment.

• msi_review.py static reads Bicep (compiled with the Bicep CLI), ARM JSON, Terraform (*.tf or terraform show -json), app settings, and source code; --resource <name> reviews the identities that resource uses and every other consumer of them.
• msi_review.py live reads the subscription with read-only az calls (Resource Graph, role assignments, federated credentials, masked app settings); with --static it also reports drift from IaC.
• The report shows, per identity, its consumers and what each uses it for, its grants and which consumer needs each one, and its federated credentials, followed by findings MIR000-MIR008 with fixes. The skill never creates role assignments or credentials.

python3 plugins/azure-managed-identity-review/skills/azure-managed-identity-review/scripts/msi_review.py static plugins/azure-managed-identity-review/skills/azure-managed-identity-review/tests/fixtures/terraform-canonical --resource stshared001

$skill = 'plugins/azure-managed-identity-review/skills/azure-managed-identity-review'
python3 "$skill/scripts/msi_review.py" static "$skill/tests/fixtures/terraform-canonical" --resource stshared001

On Windows, run the same script with python.

.NET / Azure Lessons

dotnet-azure-lessons provides eleven focused skills drawn from recurring corrections in agent sessions. Each non-obvious rule has a check and a reason. Apply only the rules relevant to the request; the skills do not grant permission for unrelated changes, external writes, installations, or settings changes. Shared procedures have one owner, with references to specialized skills when needed.

Skill	Loads when
dotnet-architecture-design	Designing or revising .NET / Azure architecture, ADRs, or version support
dotnet-coding	Writing C# for async RPC, notifications, collections, parsing, or CLIs
vs-extension-remote-ui	Editing VisualStudio.Extensibility Remote UI view models or XAML
powershell-scripting	Writing PowerShell scripts that filter, write files, or locate tools
dotnet-debugging	Investigating a failure, a CI break, or behavior that differs from tests
dotnet-testing	Writing tests or deciding whether a change is verified
dotnet-documentation	Editing README, setup guides, XML docs, or Wiki content alongside code
dotnet-ci-cd	Editing GitHub Actions or Azure Pipelines definitions and packaging
pr-issue-workflow	Handling review threads, commits, pushes, merges, and issue closure
dotnet-macos-development	Building, testing, packaging, or debugging .NET and Azure projects on macOS or Apple silicon
agent-sandbox-troubleshooting	A command fails inside the agent session with a permission, sandbox, or credential error

Use dotnet-lessons-reviewer for an independent read-only review when appropriate. Supply the in-scope diff and verification report; the agent has read/search tools but no shell or Git-state access. It selects applicable checks and separates actionable defects from missing verification evidence. Actual skill discovery in each client must be verified separately.

Project Documentation

The project-documentation skill creates English project records organized under docs/adr/, docs/architecture/, docs/infra/, docs/test/e2e/, and docs/setup/. It requires explicit approval before changing existing records, retains reasons and history for in-place decision updates, and records architecture rationale URLs and actual E2E evidence.

Installation and Use

This repository already places the English skill in the project discovery directory. To use it in another repository, copy the entire .github/skills/project-documentation/ folder, including its MIT license and templates, into that repository's .github/skills/ directory. Use a compatible agent client and request project documentation; the client determines discovery and activation.

Example requests:

• “Document the current architecture and its decision rationale under docs/.”
• “Draft an update to ADR 0001, show the exact diff and reason, and wait for my approval.”
• “Document the checkout E2E scenario, distinguishing the test plan from actual run evidence.”

Resources

• English skill
• ADR template
• Architecture template
• Infrastructure template
• Test strategy template
• E2E template
• Setup template

The Japanese reference translation is for human readers only. It has no skill frontmatter, is not registered, and must not be copied into any skill discovery directory or used as authoritative agent input. English instructions are authoritative. Templates are scaffolds, not evidence that project decisions or tests already exist.

Development validation

Run the repository validator from the repository root:

python scripts/validate_marketplaces.py
python -m unittest discover -s plugins/github-plan-wiki/skills/github-wiki-plan/tests -p 'test_*.py'

The validators check JSON syntax, matching plugin names and versions, skill frontmatter, source paths, relative links, plugin-root boundaries, and flattened GitHub Wiki template routes. The same checks run in GitHub Actions for pushes to main and pull requests. The tests job also runs every plugin's tests/test_*.py (the windows-shell-safety tests need pwsh), and the windows-shell-safety job on windows-latest reproduces the cmd.exe argument loss and verifies the safe patterns.

When editing a plugin during local Codex development, refresh the local installation after changing the manifest and start a new conversation to pick up the updated skills.

License

MIT. See LICENSE and the copy included in each plugin bundle.

The project-documentation skill includes its own MIT license copy. See SECURITY.md for vulnerability reporting guidance.

Japanese overview