Canonical Copilot Collections is a repository for organizing and distributing GitHub Copilot instructions, prompts, agents, and skills across Canonical repositories. Teams configure repositories to subscribe to shared collections, such as Python, documentation, or Juju development guidance, and keep those assets synchronized.
Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add canonical/copilot-collections --skill ubuntu-write-srugit clone --depth 1 https://github.com/canonical/copilot-collectionsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/canonical/copilot-collections/ubuntu-write-sru)<a href="https://agentmods.dev/skills/canonical/copilot-collections/ubuntu-write-sru"><img src="https://agentmods.dev/badge/skills/canonical/copilot-collections/ubuntu-write-sru/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/canonical/copilot-collections/ubuntu-write-sru"><img src="https://agentmods.dev/badge/skills/canonical/copilot-collections/ubuntu-write-sru.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium Privilege Escalation · line 51 Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.Fix: Avoid sudo/root unless strictly required. Prefer least-privilege patterns. If elevation is needed, document the justification and scope.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00057 | $0.00899 |
| Opus 5 | $0.00028 | $0.00449 |
| Sonnet 5 | $0.00011 | $0.00180 |
| Haiku 4.5 | $0.00006 | $0.00090 |
Grade B, and why
ubuntu-write-sru scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Asks for rootmediumPrivilege escalation
A mod that escalates privileges can change anything on the machine, not only the project.
- Write commands explicitly (e.g., use `sudo apt install ...` rather than "install the package"). How it starts
The opening of the file, as written. The whole thing — 80 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Full Ubuntu SRU Bug Description Builder
Persona & Role
- Role: You are a veteran Ubuntu Developer and an expert SRU Reviewer.
- Tone: Professional, highly technical, concise, and paranoid about regressions.
Use this skill when you need to write or update a Launchpad bug description to comply with the official Ubuntu Stable Release Update (SRU) workflow.
Strict Interaction Rules
Step 1: Pause and Gather Context (Mandatory)
Do not attempt to guess the bug details or output the template immediately. Start the session by asking the user for:
- The Launchpad Bug URL or raw bug report text.
- The user's personal summary/nuance of the fix (e.g., "The bug happens because of a typo in the systemd unit file; ignore the comments about the kernel regression").
- Any specific PPA testing or local debdiff validation the user has already performed, so it can be included in the test plan.
Stop and wait for the user to reply before moving to Step 2. Criterion: The user has provided the bug context and you have paused execution to wait for it.
Step 2: Fetch and Process the Raw Text
Once the URL is provided:
Ensure the URL points to the text variant: If the user provides a standard Launchpad URL (e.g., .../+bug/1234567), append /+text to the end of it (e.g., .../+bug/1234567/+text) before retrieving or reading the content.
Criterion: The raw text of the bug has been successfully fetched and loaded into context.
Step 3: Noise Filtering & Extraction
Once the user provides the context:
- Filter the entire bug history through the lens of the user's input.
- Isolate the true technical root cause, the user-facing symptoms, and the exact code paths or configurations involved.
- Assess potential regression risks based on what the fix changes.
Criterion: You have an isolated, clear understanding of the root cause and regression risks, completely separated from the noise of the bug comments.
Step 4: Output Generation
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 80 lines · 57 tokens per session scan B d4d6f4f62372
ubuntu-write-sru is a skill published in the GitHub repository canonical/copilot-collections (29 stars, last pushed 6d ago), licensed Apache-2.0. It adds 57 tokens to every session and 899 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it B with 1 finding (asks for root). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
incident-investigation
Correlate PagerDuty incidents with Jira tickets and recent ArgoCD deployments to accelerate root cause analysis. Orchestrates multiple agents to build a timeline of events. Use when investigating active incidents, performing post-mortems, or correlating alerts with changes.
extend-skill
/neat extend is a set of six MCP surgical tools for long-tail instrumentation — three diagnostic (read-only), three operative (file-scope-restricted, idempotent, reversible, observable). The user's MCP agent reasons; NEAT operates. NEAT holds no LLM key and never auto-applies. No standalone CLI variant. Discovery is…
claude-skill
This skill exposes NEAT's live semantic graph to Claude Code over MCP. Once installed, Claude can ask the running NEAT daemon (neatd) about a project's services, dependencies, recent errors, and policy violations — same as any other agent NEAT supports.
backstage-incident-debug
Diagnose a failing production or staging Backstage instance — collect evidence, narrow to one layer, read backend logs and health endpoints, and correlate with recent deploys and config changes.
graph-first
Query NEAT's live semantic graph — structure, dependencies, runtime (OBSERVED) behaviour, and divergence between declared and observed — before grepping. Use for architecture-level questions on this codebase.
debug-optimize-lcp
Guides debugging and optimizing Largest Contentful Paint (LCP) using Chrome DevTools MCP tools. Use this skill whenever the user asks about LCP performance, slow page loads, Core Web Vitals optimization, or wants to understand why their page's main content takes too long to appear. Also use when the user mentions…