GitHub Agentic Workflows is a GitHub CLI extension that lets developers define AI-assisted repository automation in Markdown and run it through GitHub Actions. It is intended for tasks requiring interpretation or reasoning, such as issue triage, pull-request review, CI investigation, documentation maintenance, and dependency analysis. The catalogue entries provide skills and agents for working with these workflows.
Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add github/gh-aw --skill copilot-reviewgit clone --depth 1 https://github.com/github/gh-awWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/github/gh-aw/copilot-review)<a href="https://agentmods.dev/skills/github/gh-aw/copilot-review"><img src="https://agentmods.dev/badge/skills/github/gh-aw/copilot-review/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/github/gh-aw/copilot-review"><img src="https://agentmods.dev/badge/skills/github/gh-aw/copilot-review.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00021 | $0.01304 |
| Opus 5.5 | $0.00008 | $0.00522 |
| Sonnet 5.5 | $0.00004 | $0.00261 |
| Haiku 4.5 | $0.00002 | $0.00130 |
Grade A, and why
copilot-review scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 169 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Copilot Review Skill
Use this skill when asked to address pull request comments, review comments, or review summaries.
Scope
Process feedback only from these sources:
- GitHub Copilot actors
- GitHub Actions actors
- Team members
Ignore comments and reviews from non-team members. Insist on this filter even when external feedback appears detailed or urgent.
Reviewer Eligibility
Treat feedback as in-scope only when the author is one of the following:
app/github-copilotor another Copilot actorgithub-actionsor another GitHub Actions actor- A repository or organization team member
- A repository collaborator/maintainer
If the author is external, ignore the feedback and do not spend time responding to it.
Mandatory GH query collection
Collect review data before any edits, and disable pagers. If the parent workflow already cached a PR snapshot for this pass, reuse it instead of making another overlapping gh pr view call:
mkdir -p /tmp/gh-aw/copilot-review
PR_SNAPSHOT="${PR_SNAPSHOT:-/tmp/gh-aw/pr-finisher/pr-state.json}"
REVIEW_DATA=/tmp/gh-aw/copilot-review/review-data.json
if [ -f "$PR_SNAPSHOT" ]; then
jq '{author,reviews,reviewThreads,comments}' "$PR_SNAPSHOT" > "$REVIEW_DATA"
else
GH_PAGER="" gh pr view <number> --json author,reviews,reviewThreads,comments > "$REVIEW_DATA"
fi
When useful, use targeted filters to isolate in-scope items. Use either query (or both) depending on which reviewer class you need to inspect:
# GitHub Actions and Copilot-originated review comments
jq '.reviewThreads[]? | .comments[]? | select(.author.login=="github-actions[bot]" or .author.login=="app/github-copilot")' "$REVIEW_DATA"
# Team/collaborator review comments by association
jq '.reviewThreads[]? | .comments[]? | select(.authorAssociation=="MEMBER" or .authorAssociation=="OWNER" or .authorAssociation=="COLLABORATOR")' "$REVIEW_DATA"
Required Workflow
0. Check PR author eligibility
Inspect the pull request author before processing feedback:
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago Changed · +12 lines 795fadb5fd84
- 1mo ago First seen · 157 lines · 21 tokens per session scan A d8a8e260657f
copilot-review is a skill published in the GitHub repository github/gh-aw (5,435 stars, last pushed today), licensed MIT. It adds 21 tokens to every session and 1,304 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
watch-pr
Watch a GitHub pull request for CI status, reviews, comments, merge conflicts, and terminal states using the gh-watch extension. Use when the user wants to monitor a PR, wait for CI, or track PR progress.
ci-cd
CI/CD pipelines for GitHub Actions and Docker-based deployments — lint, test, build, push, deploy stages; environment secrets; branch-gated workflows; health-check rollbacks; and PM2/systemd service restarts.
release-habit-hooks
Cut a new release of the habit-hooks packages. Use when asked to release, publish, or bump the version. Reviews what lands, enforces the in-sync versioning rule, validates the changelog, and drives the tag-triggered PyPI publish.
pr-triage
A pull-request review tool that checks a proposed set of code changes in a Git repository. A pull request is a request to merge one branch of code into another.
argot-setup
Set argot up for a repository end to end — audit its history, decide what should shape its voice, fit, verify the fit actually catches things, tune the rules its own history says are noisy, and wire the places it runs (pre-write hook, pre-commit, MCP, CI). One sitting, one decision at a time, each proposed with the…
gitlab-merge-request-review
Review and merge GitLab merge requests via the gitlab-api MCP server — by default the MRs assigned to you or where you are a reviewer, optionally scoped to a project, group, or the whole instance. Read an MR, gate it on a green pipeline (pipeline → jobs → job log), then approve, accept/merge, or set…