给你的 AI 助手 装上 专业技能

supply-chain-security

Activate when reviewing or modifying dependency resolution, lockfile schema, package downloaders, signature/integrity checks, file integration cleanup, or anything that could expose APM to dependency confusion, typosquatting, malicious packages, or token leakage.

python-architecture

Activate when creating new modules, refactoring class hierarchies, introducing design patterns, or making changes spanning 3+ files in the APM CLI codebase.

oss-growth

Activate for OSS adoption work -- README conversion surfaces, quickstart, templates, release announcements, contributor funnel, story angles -- and any update to the maintained growth strategy at WIP/growth-strategy.md.

docs-sync

Use this skill whenever a pull request is opened, reopened, or synchronized in microsoft/apm to assess whether and how the documentation corpus must change to stay truthful with the proposed code change. Activate even when the PR title or body says nothing about docs -- the skill must run on every PR to detect silent drift between code and docs. Classifies impact as no-change, in-place edit (one to a few paragraphs), or structural change (new page or TOC reshape), then orchestrates a CDO + doc-writer + python-architect + editorial-owner + growth-hacker loop to produce a patch-ready advisory. Does NOT review code quality, security, or test coverage. Does NOT auto-merge or auto-push doc edits.

docs-impact-localizer

Use this skill to translate a classifier's in-place verdict into a precise, page-by-page work plan for the docs-sync panel. Activate after docs-impact-classifier returns verdict in_place; reads the candidate page list, fetches the actual page contents, narrows scope to specific sections within each page, and emits the per-page task brief the panel fans out against.

docs-impact-classifier

Use this skill to classify the documentation impact of a pull request diff, returning one of three verdicts -- no-change, in-place edit, or structural change -- with bounded LLM cost. Activate as a sibling skill of docs-sync; the orchestrator calls this first, before any panel spawn, to keep cost floor at 1 LLM call when no docs work is needed. Reads .apm/docs-index.yml as the corpus map; never reads the full corpus.

docs-impact-architect

Use this skill when the docs-impact-classifier returns a structural verdict, signalling that the documentation TOC must change to accommodate the PR. Proposes TOC deltas (new pages, moves, merges) and emits new-page outline stubs that the doc-sync panel later fleshes out. Holds the 3-promise narrative (consume / produce / govern) and the persona ramps as hard constraints.

docs-corpus-audit

Use this skill to run a holistic regrounding pass on the entire microsoft/apm documentation corpus against current source code, page-by-page, and emit surgical fixes for stale claims. Activate when the maintainer wants a WHOLE-CORPUS audit (not per-PR review) -- typical triggers include "audit the docs", "reground the corpus", "check every page against code", "pre-release docs sweep", "the docs have drifted everywhere", or "we just reshaped the TOC, find dead links". Wave-batched and S7-verified; scales to the full ~112-page corpus in ~10 minutes wall-time. This is a SIBLING to docs-sync, not a replacement: docs-sync is per-PR (triggered by a diff); this skill is per-corpus (triggered by a maintainer ask). They share agent personas, schemas, and the docs index, but their triggers MUST NOT collide. Does NOT auto-merge, does NOT push without maintainer review, and does NOT replace per-PR drift detection.

devx-ux

Activate when designing or modifying CLI command surfaces, command help text, install/init/run flows, error wording, or first-run experience in the APM CLI -- even when the user does not say "UX" explicitly.

设计师

cut-release

Use this skill to cut an APM release from the current worktree: assess whether the cycle since the last tag warrants a patch or minor bump (semver discipline against the merged-since-last-tag diff), sanitize the [Unreleased] CHANGELOG block into a dated version block with one concise "so what" entry per merged PR (drop internal-only churn, consolidate duplicates), bump pyproject.toml + uv.lock, run the CI-mirror lint chain, and open the release PR. Activate on "ship a release", "cut v0.x", "release prep", "bump and PR", "open release PR", "what kind of release do we need", or any phrasing that ends in opening a release PR -- even when the user does not say "skill". Stops BEFORE tagging; tagging stays a human gate that triggers the release workflow. Refuses to bump to a major (>= 1.0.0) version without explicit operator confirmation.

代码审查Skill与智能体开发

cli-logging-ux

Use this skill when editing or creating CLI output, logging, warnings, error messages, progress indicators, or diagnostic summaries in the APM codebase. Activate whenever code touches console helpers (_rich_success, _rich_warning, _rich_error, _rich_info, _rich_echo), DiagnosticCollector, STATUS_SYMBOLS, CommandLogger, or any user-facing terminal output — even if the user doesn't mention "logging" or "UX" explicitly.

开发工程师设计师

autopilot-pr-triage-scheduler

Queue open microsoft/apm pull requests (community fixes, PRs without an issue, or PRs that close an issue) and fan them out through an isolated pool (default 2) of autopilot-pr-triage-worker sessions. Advisory only. Never merges, never assigns, never requests reviewers, never runs autopilot-pr-review-worker. Activate on a mixed PR list or queue-open when the job is PR triage. Works in a local session, Copilot App automation, Cloud Agent, Remote Agent, or Agentic Workflow.

autopilot-pr-review-scheduler

Queue microsoft/apm pull requests labelled `panel-review` (or an explicit named list) and fan them out through an isolated pool (default 2) of autopilot-pr-review-worker sessions. Advisory only. Never implements. Never composes autopilot-pr-merge-worker. Never review every open PR. Works in a local session, Copilot App automation, Cloud Agent, Remote Agent, or Agentic Workflow. Does not triage issues or open greenfield PRs.

autopilot-pr-merge-worker

Drive ONE already selected open pull request in microsoft/apm to mergeable. Classifies copilot-pull-request-reviewer[bot] inline review, runs autopilot-pr-review-worker, folds (by default) every recommendation inside the PR's stated scope, pushes to the head branch or a superseding PR that preserves authorship via commit trailers, watches CI to green (`agent-merge` when that skill or `<agent_merge_state>` is present; otherwise `gh pr checks --watch`), and iterates under fixed caps until ready-to-merge, advisory-with-deferred, superseded, or blocked. Plan before any fold, push, or reviewer request. Never spawned by autopilot-pr-review-scheduler. That scheduler is advisory only. Invoke this skill by name when the caller asked to drive a PR to merge.

autopilot-issue-triage-scheduler

Queue open microsoft/apm issues and fan them out through an isolated pool (default 2) of autopilot-issue-triage-worker sessions. Advisory only. Never implements, never assigns, never requests reviewers. Activate on a mixed issue list or queue-all when the job is triage. Works in a local session, Copilot App automation, Cloud Agent, Remote Agent, or Agentic Workflow.

autopilot-comment

Use this skill to post or patch ONE GitHub comment for a microsoft/apm autopilot run. It owns public vs debug body assembly and the AI disclaimer footer. Never labels, assigns, requests reviewers, or merges. Autopilot skills that write comments must load this skill and must not call gh comment APIs themselves.

auth

Activate when code touches token management, credential resolution, git auth flows, GITHUB_APM_PAT, ADO_APM_PAT, AuthResolver, HostInfo, AuthContext, or any remote host authentication -- even if 'auth' isn't mentioned explicitly.

apm-strategy

Activate for changes to project positioning, release communication, community-facing artifacts, or breaking-change decisions in microsoft/apm. Triggers on README, MANIFESTO, PRD, CHANGELOG, release workflows, and issue templates.