Add agentic workflows skill

[VeVarunSharma]

Pull Request Checklist

• I have read and followed the CONTRIBUTING.md guidelines.
• I have read and followed the Guidance for submissions involving paid services.
• My contribution adds a new instruction, prompt, agent, skill, workflow, or canvas extension file in the correct directory.
• The file follows the required naming convention.
• The content is clearly structured and follows the example format.
• I have tested my instructions, prompt, agent, skill, workflow, or canvas extension with GitHub Copilot.
• I have run npm start and verified that README.md is up to date.
• I am targeting the main branch for this pull request.

---

Description

Adds an installable agentic-workflows skill for designing, creating, updating, debugging, and upgrading GitHub Agentic Workflows (gh-aw).

The skill dynamically loads the current upstream create.md dispatcher and task-specific guidance, applies repository-local overlays, enforces read-only agent permissions with safe outputs, and documents a concrete issue-triage pattern for labeling, duplicate detection, clarification, and assignment.

Also repairs the PR Duplicate Check exposed by this fork contribution: fork pull_request tokens do not receive copilot-requests: write, so fork runs now skip the advisory AI job instead of failing authentication. Same-repository PRs retain the check, with the cached Copilot CLI exposed at the sandbox path expected by the current lock file.

---

Type of Contribution

• New instruction file.
• New prompt file.
• New agent file.
• New plugin.
• New skill file.
• New agentic workflow.
• New canvas extension.
• Update to existing instruction, prompt, agent, plugin, skill, workflow, or canvas extension.
• Other (please specify):

---

Additional Notes

The skill intentionally keeps version-specific gh-aw syntax dynamic by fetching official upstream guidance instead of bundling a stale local copy. It has no bundled assets.

The workflow repair was compiled with the lock file's existing gh-aw v0.85.4 compiler. The original failure was caused by the fork token lacking CopilotRequests: write; a newer runner image also moved the cached Copilot executable out of /usr/local/bin, so a deterministic pre-agent link preserves same-repository execution.

---

By submitting this pull request, I confirm that my contribution abides by the Code of Conduct and will be licensed under the MIT License.

[github-actions]

🔒 PR Risk Scan Results

Scanned 3 changed file(s).

Severity	Count
🔴 High	0
🟠 Medium	1
ℹ️ Info	0

Severity	Rule	File	Line	Match
🟠	unpinned-version-indicator	.github/workflows/pr-duplicate-check.lock.yml	688	"DEBUG": "*",

This is an automated soft-gate report. Findings indicate review targets and do not block merge by themselves.

[github-actions]

🔍 Vally Lint Results

✅ All checks passed

Scope	Checked
Skills	1
Agents	0
Total	1

Severity	Count
❌ Errors	0
⚠️ Warnings	0
ℹ️ Advisories	0

Summary

Level	Finding
ℹ️	✅ agentic-workflows (2/2 checks passed)
ℹ️	✓ [spec-compliance] All 1 skill(s) are spec-compliant.
ℹ️	✓ spec-compliance: All spec checks passed.
ℹ️	✓ [valid-refs] All file references across 1 skill(s) are valid.
ℹ️	✓ valid-refs: All file references resolve to existing files within the skill directory.
ℹ️	1 skill(s) linted, 1 passed

Full linter output

### Linting skills/agentic-workflows
✅ agentic-workflows (2/2 checks passed)
    ✓ [spec-compliance] All 1 skill(s) are spec-compliant.
        ✓ spec-compliance: All spec checks passed.
    ✓ [valid-refs] All file references across 1 skill(s) are valid.
        ✓ valid-refs: All file references resolve to existing files within the skill directory.

1 skill(s) linted, 1 passed

[Copilot]

Pull request overview

Adds an installable skill for creating and maintaining secure GitHub Agentic Workflows using current upstream guidance.

Changes:

• Adds workflow routing, security, validation, and issue-triage guidance.
• Registers the skill in generated documentation.

Show a summary per file

File	Description
skills/agentic-workflows/SKILL.md	Defines the new skill.
docs/README.skills.md	Adds the skill catalog entry.

Review details

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

• Files reviewed: 2/2 changed files
• Comments generated: 2
• Review effort level: Balanced

[Copilot]

Review details

• Files reviewed: 4/4 changed files
• Comments generated: 0 new
• Review effort level: Balanced

[Copilot]

Review details

• Files reviewed: 4/4 changed files
• Comments generated: 1
• Review effort level: Balanced

[Copilot]

Review details

Suppressed comments (1)

.github/workflows/pr-duplicate-check.md:12

• This changes the repository's live PR duplicate-check workflow even though the PR is described as adding only an installable skill. The model pin also propagates to the generated threat-detection job, while the adjacent pre-agent step changes runner setup; please either revert these source and lock-file changes or document and justify this separate operational change.

model: claude-sonnet-5

• Files reviewed: 4/4 changed files
• Comments generated: 0 new
• Review effort level: Balanced

[Copilot]

Review details

Suppressed comments (2)

Previously missed (1) — in code that hasn't changed since the last review.

.github/workflows/pr-duplicate-check.md:19

• This step fails on the installer's cache-miss path. In that path install_copilot_cli.sh installs the binary at /usr/local/bin/copilot, so command -v returns that same path and ln -sfn /usr/local/bin/copilot /usr/local/bin/copilot exits nonzero under the step's fail-fast shell. Only create the symlink when the resolved binary is elsewhere, then recompile the lock file.

      COPILOT_BIN="$(command -v copilot)"
      test -x "$COPILOT_BIN"
      sudo ln -sfn "$COPILOT_BIN" /usr/local/bin/copilot

.github/workflows/pr-duplicate-check.md:15

• This workaround is emitted only in the main agent job. The generated threat-detection job separately installs Copilot and invokes the same hard-coded /usr/local/bin/copilot path, so a tool-cache hit still leaves threat detection without that binary; its continue-on-error then masks the failure. Apply the shim through a runtime/compiler mechanism that covers every Copilot invocation, and regenerate the lock file.

pre-agent-steps:
  - name: Expose Copilot CLI to the sandbox

• Files reviewed: 4/4 changed files
• Comments generated: 1
• Review effort level: Balanced