copilot

A guide for running the pr-reviewer code-review process from GitHub Copilot, including its command-line tool, chat, or Workspace.

In plain words
What is it for?
Use it to review GitHub or GitLab pull requests from Copilot, fetch commits and changed files, clone the repository, and run several review rounds.
Why use it?
It explains how Copilot can gather pull-request details and repeat reviews even though Copilot CLI has no built-in repeating command.

Agent

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add agents/mdelapenya/coding-skills/copilot
Clone the repo
git clone --depth 1 https://github.com/mdelapenya/coding-skills
Per session 0 Only the description is in the session, so the agent can decide to use it. The body loads when it is invoked.
When invoked 552 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00000 $0.00552
Opus 5 $0.00000 $0.00276
Sonnet 5 $0.00000 $0.00110
Haiku 4.5 $0.00000 $0.00055

Measured 2d ago against content hash b31a6cafa604, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

copilot scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

skills/pr-reviewer/references/agents/copilot.md · 41 lines

How it starts

The opening of the file, as written. The whole thing — 41 lines — stays where its author put it; the contents beside it link to each section on GitHub.

GitHub Copilot

Topic file for running pr-reviewer from inside GitHub Copilot (CLI agent mode, IDE chat, or Copilot Workspace).

Fetch tooling

The skill drives its own fetch. Copilot can satisfy it through any of:

  • Native GitHub awareness (Copilot Workspace) — confirm PR context is fully loaded; request full commit bodies if Copilot truncated them.
  • GitHub MCP server — call get_pull_request, list_pull_request_commits, get_pull_request_diff, get_pull_request_files, get_issue.
  • Shell with gh (GitHub) or glab (GitLab).

For the clone step (Step 2c of the skill), shell access is required regardless — git clone is the universal path.

Looping primitive

As of writing, GitHub Copilot CLI does not have a /loop or /schedule command — a /schedule slash command is an open feature request (copilot-cli#2056). Copilot CLI does ship an autopilot mode that runs a single task autonomously through multiple steps, but autopilot is "complete one task end-to-end," not "repeat a prompt on an interval." Don't conflate them.

Until a real loop primitive ships, use one of:

  • Manual re-invocation — after each round, the skill reports whether convergence was reached. If not, type /pr-reviewer [<num>] again.
  • Multi-step task description (autopilot) — phrase the request as: "Run /pr-reviewer [<num>] up to 3 times, stopping when findings.md records converged: true." Copilot's autopilot will sequence the rounds itself.
  • External shell driver — wrap the agent invocation in a while loop that breaks on the convergence marker. Cap with --rounds=N.

The skill's --rounds argument is the universal safety net.

Posting the final report

If the GitHub MCP server is connected, use its review-creation resource. Otherwise:

gh pr review <pr-number> --comment --body-file <path-the-skill-printed>

Always confirm with the user before posting.

References

Read the full file on GitHub · 41 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 2d ago First seen · 41 lines · 0 tokens per session scan A b31a6cafa604

Subscribe to this mod's changes

copilot is an agent published in the GitHub repository mdelapenya/coding-skills (2 stars, last pushed 2mo ago), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 552 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.