Name: Trigger ADO pipelines for Copilot PR
Author: Skills Guide Bot

Automated summary

Posts two `/azp run` comments on a microsoft/FluidFramework pull request to trigger the full set of Azure DevOps pipelines, which Copilot-created PRs require.

Strengths

Ships the exact pipeline list, so no configuration or discovery step is needed
Handles the Windows Git Bash quirk with MSYS_NO_PATHCONV=1 so `/azp` is not rewritten into a filesystem path
Includes a GitHub REST API fallback using $GITHUB_TOKEN when the gh CLI is unavailable
Documents why the invocation is split into two comments (length limit breaks the trigger)

Limitations

Hard-coded to the microsoft/FluidFramework repository and unusable elsewhere without rewriting
Pipeline names are embedded in the prompt text and will drift as definitions change
Comments are posted straight away, with no confirmation step and no check that the PR was actually authored by Copilot

When to use it

Use it when a Copilot-authored PR in FluidFramework needs the complete CI pipeline set kicked off.

When not to use it

Avoid it for other repositories, for triggering a single specific pipeline, or when the user cannot comment on the PR.

Security analysis

Caution

Quality score78/100

The skill only posts two fixed `/azp run` comments to a user-specified PR in one hardcoded repo. There is no destructive action, obfuscation, or exfiltration — the only secret use is passing $GITHUB_TOKEN to GitHub's own API as a documented fallback. The main issue is that this fallback exceeds the declared allowed-tools (gh pr comment only), so a runtime with broader shell access is implicitly assumed.

Findings

•Declared allowed-tools is only `Bash(gh pr comment *)`, but the skill instructs a fallback that runs arbitrary `curl` POST requests with `$GITHUB_TOKEN` in the Authorization header — beyond the granted tool scope (though the token is only sent to api.github.com, its intended destination).
•Uses network access and a credential-bearing API call; legitimate here but requires a shell/network-capable tool the manifest does not declare.
•Hardcodes a specific repository (`microsoft/FluidFramework`) and specific pipeline names, so it is narrowly scoped rather than general-purpose.
•Declared allowed-tools is only `Bash(gh pr comment *)`, but the instructions also direct the agent to run availability checks and a `curl` POST to api.github.com, which is outside the declared tool scope.
•The fallback path passes `$GITHUB_TOKEN` on a curl command line, exposing the token to shell history/process listings and to any command-echoing; the destination (api.github.com) is legitimate, so this is a credential-handling concern rather than exfiltration.
•Repository is hard-coded to microsoft/FluidFramework while the PR is taken from user input; a mismatched PR number/URL could cause comments to be posted to an unintended PR in that repo (low impact: comments only, no writes to code).
•No obfuscation, destructive commands, privilege escalation, or attempts to alter the auditor's/agent's role were found in the content.

How this analysis is made

Examples

Trigger all pipelines on a PR

Trigger the ADO pipelines for PR #24187 in microsoft/FluidFramework.

Copilot-authored PR needs CI

This PR was created by Copilot — post the /azp run comments on https://github.com/microsoft/FluidFramework/pull/23950 so CI starts.

Kick off CI by PR number

Run the full FluidFramework pipeline suite on PR 24312.

name: trigger-pipelines-for-copilot-pr description: Trigger ADO pipelines for a Copilot-created PR by posting /azp run comments. Use when the user asks to trigger CI pipelines for a specific PR. allowed-tools: Bash(gh pr comment *) context: fork model: claude-haiku-4-5-20251001 argument-hint: [pr-number-or-url]

Post the following two comments to the PR specified by the user ($ARGUMENTS), in the microsoft/FluidFramework repository on GitHub. They need to be posted separately because otherwise it gets too long and fails to trigger correctly.

First comment:

/azp run Build - protocol-definitions,Build - test-tools,server-gitrest,server-gitssh,server-historian,server-routerlicious,Build - client packages,repo-policy-check

Second comment:

/azp run Build - api-markdown-documenter,Build - benchmark-tool,Build - build-common,Build - build-tools,Build - common-utils,Build - eslint-config-fluid,Build - eslint-plugin-fluid

Posting those comments will trigger all our pipelines, which is necessary for PRs that are created by Copilot.

To post the comments first check if the GitHub CLI is available, and if so use MSYS_NO_PATHCONV=1 gh pr comment <PULL_REQUEST_NUMBER> --repo microsoft/FluidFramework --body "<COMMENT_TEXT>". Note: MSYS_NO_PATHCONV=1 is required on Windows (Git Bash) to prevent /azp from being expanded to C:/Program Files/Git/azp. If gh is not available but $GITHUB_TOKEN is, you can try the GitHub REST API directly, e.g.:

curl -L \
  -X POST \
  -H "Accept: application/vnd.github+json" \
  -H "Authorization: Bearer $GITHUB_TOKEN" \
  -H "X-GitHub-Api-Version: 2022-11-28" \
  https://api.github.com/repos/microsoft/FluidFramework/issues/PULL_REQUEST_NUMBER/comments \
  -d '{"body":"<COMMENT_TEXT>"}'

If neither is available, don't do anything and tell the user you can't complete the request and why.

From the file to a first result

The download contains exactly the content displayed on this page. This copy may differ from the latest version in the source repository.

View the source and supporting files

This download contains SKILL.md only. Any scripts, references, templates and dependencies are not included. Get the required files from the source, preserving their directory structure, before continuing.

1. Download the file

Download SKILL.md

From the root of a test project, save the file as .skill-downloads/trigger-ado-pipelines-for-copilot-pr-mrx3xwbe/SKILL.md, or use the command below. This folder is for inspecting the skill before installation.

Command for macOS/Linux or WSL: requires a POSIX shell and curl. On Windows without WSL, use the download button and create the folder manually.

mkdir -p '.skill-downloads/trigger-ado-pipelines-for-copilot-pr-mrx3xwbe' && curl --fail --show-error --location 'https://skills-guides.com/api/skills/trigger-ado-pipelines-for-copilot-pr-mrx3xwbe/download' --output '.skill-downloads/trigger-ado-pipelines-for-copilot-pr-mrx3xwbe/SKILL.md.part' && mv '.skill-downloads/trigger-ado-pipelines-for-copilot-pr-mrx3xwbe/SKILL.md.part' '.skill-downloads/trigger-ado-pipelines-for-copilot-pr-mrx3xwbe/SKILL.md'

2. Check prerequisites

Read SKILL.md before using it. If it references scripts or external services, inspect them and prepare the required access in your test environment.

Tools declared by the author (check availability in your agent): Bash(gh pr comment *)

No recognized prerequisites section in this file. This does not mean it is self-contained: libraries, tools and access requirements may be mentioned elsewhere in the content or source repository.

The platforms on this page are catalog indications. The paths below follow tool documentation; they do not prove this skill has been run in those tools. No minimum tool version is confirmed for this listing.

3. Load the skill

After inspection, copy the complete folder into your project using one of the commands below, then open a new tool session. The command stops if a folder with the same name already exists: compare the files before replacing it.

Claude Code

test -f '.skill-downloads/trigger-ado-pipelines-for-copilot-pr-mrx3xwbe/SKILL.md' && test -s '.skill-downloads/trigger-ado-pipelines-for-copilot-pr-mrx3xwbe/SKILL.md' && mkdir -p '.claude/skills' && test ! -e '.claude/skills/trigger-pipelines-for-copilot-pr' && cp -R '.skill-downloads/trigger-ado-pipelines-for-copilot-pr-mrx3xwbe' '.claude/skills/trigger-pipelines-for-copilot-pr'

OpenSkills

OpenSkills must already be installed. The local install/read procedure is checked with OpenSkills 1.5.0, which requires Node.js ≥ 20.6.0. Catalog slugs are not resolved automatically.

Official OpenSkills installation

openskills install './.skill-downloads/trigger-ado-pipelines-for-copilot-pr-mrx3xwbe'

openskills read 'trigger-ado-pipelines-for-copilot-pr-mrx3xwbe'

Reading should display the installed file content and its base directory. It does not run the skill or install its dependencies.

For an agent that reads AGENTS.md, then sync the index. This command changes AGENTS.md: review the diff before using it.

openskills sync

Manual method or another tool: attach SKILL.md to a conversation, or open it in an agent that can read files. Include any required supporting resources. No universal folder is recognized by every tool.

4. Try a first task

Use a short, synthetic input: an API endpoint, a small document or an interface brief. In a new conversation, attach the file or give the agent its path, then adapt this request:

Read .skill-downloads/trigger-ado-pipelines-for-copilot-pr-mrx3xwbe/SKILL.md and apply its instructions to this example: [describe a test input]. Identify any missing files, dependencies or access. Produce the result requested by the skill without inventing data or running unreviewed scripts.

Expected result: output matching the skill instructions, or a precise list of missing prerequisites. A read confirmation alone does not validate a first use. If an external resource is unavailable, that path remains untested.

Related skills

Configure a Chat Channel with SecretRefs

DevOps

Set up chat channels using non-interactive commands, with secrets only as SecretRefs. Covers gather, mutate, repair, and prove steps for reliable delivery.

Claude CodeCodexintermediateSafe 387,940

Skills Guide Bot

Investigate ClickHouse CI Failures

DevOps

Investigate a ClickHouse CI failure end-to-end from a PR or S3 report URL. Fetches failed tests, classifies flaky vs real regression, and checks for existing issues/fixes.

Claude CodeadvancedSafe 49,516

Skills Guide Bot