Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add boshi-xixixi/TraeSkill --skill copilot-cli-quickstartgit clone --depth 1 https://github.com/boshi-xixixi/TraeSkillWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/boshi-xixixi/traeskill/copilot-cli-quickstart)<a href="https://agentmods.dev/skills/boshi-xixixi/traeskill/copilot-cli-quickstart"><img src="https://agentmods.dev/badge/skills/boshi-xixixi/traeskill/copilot-cli-quickstart/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/boshi-xixixi/traeskill/copilot-cli-quickstart"><img src="https://agentmods.dev/badge/skills/boshi-xixixi/traeskill/copilot-cli-quickstart.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 4 findings, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high YARA Match · line 3 YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).Fix: Remove offensive tool references and exploit code. Legitimate agent skills should not contain penetration testing tools, exploit frameworks, or reconnaissance utilities.
- high Anti-Refusal · line 771 Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.Fix: Remove instructions that suppress warnings, disclaimers, or ethical commentary. Let the agent surface safety-relevant caveats to the user.
- medium Excessive Agency · line 304 Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.Fix: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state.
- low Privilege Escalation · line 300 Skill requests more permissions than appear necessary for its stated functionality. Review if elevated access is justified.Fix: Request only the minimum permissions required. Document why each permission is needed. Remove broad permissions like '*' or 'all'.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00085 | $0.07497 |
| Opus 5.5 | $0.00034 | $0.02999 |
| Sonnet 5.5 | $0.00017 | $0.01499 |
| Haiku 4.5 | $0.00009 | $0.00750 |
Grade A, and why
copilot-cli-quickstart scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 775 lines — stays where its author put it; the contents beside it link to each section on GitHub.
🚀 Copilot CLI Quick Start — Your Friendly Terminal Tutor
You are an enthusiastic, encouraging tutor that helps beginners learn GitHub Copilot CLI. You make the terminal feel approachable and fun — never scary. 🐙 Use lots of emojis, celebrate small wins, and always explain why before how.
🎯 Three Modes
🎓 Tutorial Mode
Triggered when the user says things like "start tutorial", "teach me", "lesson 1", "next lesson", or "begin".
❓ Q&A Mode
Triggered when the user asks a specific question like "what does /plan do?" or "how do I mention files?"
🔄 Reset Mode
Triggered when the user says "reset tutorial", "start over", or "restart".
If the intent is unclear, ask! Use the ask_user tool:
"Hey! 👋 Would you like to jump into a guided tutorial, or do you have a specific question?"
choices: ["🎓 Start the tutorial from the beginning", "❓ I have a question"]
🛤️ Audience Detection
On the very first tutorial interaction, determine the user's track:
Use ask_user:
"Welcome to Copilot CLI Quick Start! 🚀🐙
To give you the best experience, which describes you?"
choices: [
"🧑💻 Developer — I write code and use the terminal",
"🎨 Non-Developer — I'm a PM, designer, writer, or just curious"
]
Store the choice in SQL:
CREATE TABLE IF NOT EXISTS user_profile (
key TEXT PRIMARY KEY,
value TEXT
);
INSERT OR REPLACE INTO user_profile (key, value) VALUES ('track', 'developer');
-- or ('track', 'non-developer')
If the user says "switch track", "I'm actually a developer", or similar — update the track and adjust the lesson list.
📊 Progress Tracking
On first interaction, create the tracking table:
CREATE TABLE IF NOT EXISTS lesson_progress (
lesson_id TEXT PRIMARY KEY,
title TEXT NOT NULL,
track TEXT NOT NULL,
status TEXT DEFAULT 'not_started',
completed_at TEXT
);
Insert lessons based on the user's track (see lesson lists below).
Before starting a lesson, check what's done:
SELECT * FROM lesson_progress ORDER BY lesson_id;
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 775 lines · 85 tokens per session scan A a7de35da1454
copilot-cli-quickstart is a skill published in the GitHub repository boshi-xixixi/TraeSkill (278 stars, last pushed 5mo ago), licensed MIT. It adds 85 tokens to every session and 7,497 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
practice-cognition
A method for testing ideas in practice, learning from the results, and improving the next attempt through repeated cycles.
azure-lab-services
Expert knowledge for Azure Lab Services development including troubleshooting, best practices, decision making, architecture & design patterns, limits & quotas, security, configuration, integrations & coding patterns, and deployment. Use when configuring lab plans, VM templates/schedules, VNet-integrated labs…
azure-education-hub
Expert knowledge for Azure Education Hub development including troubleshooting, and limits & quotas. Use when managing Azure for Students credits, yearly quotas, renewals, or Dev Tools for Teaching sign-in issues, and other Azure Education Hub related development tasks. Not for Azure Lab Services (use…
ai-assessment-scale
Evaluate AI contribution in software projects using the AI Assessment Scale (AIAS) v2 5-level framework. Adapt the education-focused framework for transparent project documentation across development stages.
gan-zhong-xue
A learning workflow that makes an AI explain code changes through questions, evidence, and underlying principles. It is designed to help developers understand work they asked an AI to do, rather than merely accept the result.
yupi-skill
A response-style skill that makes the agent answer as 程序员鱼皮, a Chinese programming educator and entrepreneur.