Extend secret-scanning skill with MCP pre-commit scanning support#1154
Extend secret-scanning skill with MCP pre-commit scanning support#1154felickz wants to merge 11 commits intogithub:mainfrom
Conversation
Co-authored-by: felickz <1760475+felickz@users.noreply.github.com>
Co-authored-by: felickz <1760475+felickz@users.noreply.github.com>
…ret-scanning skill Co-authored-by: felickz <1760475+felickz@users.noreply.github.com>
…-scanning-instructions Reference Advanced Security plugin for MCP pre-commit scanning in secret-scanning skill
Co-authored-by: felickz <1760475+felickz@users.noreply.github.com>
…ng-skill Extend secret-scanning skill with MCP pre-commit scanning support
# Conflicts: # docs/README.plugins.md # plugins/copilot-sdk/skills/copilot-sdk/SKILL.md # plugins/gem-team/agents/gem-browser-tester.md # plugins/gem-team/agents/gem-devops.md # plugins/gem-team/agents/gem-documentation-writer.md # plugins/gem-team/agents/gem-implementer.md # plugins/gem-team/agents/gem-orchestrator.md # plugins/gem-team/agents/gem-planner.md # plugins/gem-team/agents/gem-researcher.md # plugins/gem-team/agents/gem-reviewer.md # plugins/software-engineering-team/agents/se-gitops-ci-specialist.md
There was a problem hiding this comment.
Pull request overview
Updates the existing secret-scanning skill documentation to cover pre-commit secret scanning workflows for AI coding agents (via GitHub MCP Server) by pointing users to the Advanced Security plugin and its MCP tool.
Changes:
- Expands the
secret-scanningskill description and “When to use” list to include pre-commit scanning in AI coding agent contexts. - Adds a new section documenting how to use the Advanced Security plugin for agent-based pre-commit secret scanning.
- Updates the skills index entry to reflect the expanded scope and plugin reference.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
| skills/secret-scanning/SKILL.md | Adds documentation for MCP/agent pre-commit scanning and references the Advanced Security plugin. |
| docs/README.skills.md | Updates the secret-scanning table entry description to match the skill’s expanded scope. |
| - Install the `advanced-security` agent plugin | ||
| - Use `/secret-scanning` in Copilot Chat |
There was a problem hiding this comment.
The VS Code guidance is a bit ambiguous ("Install the advanced-security agent plugin"). In this repo’s plugin docs, VS Code discovery/install is described via @agentPlugins in Extensions search or the “Chat: Plugins” command palette entry. Consider updating these bullets to match that documented flow/terminology so readers can reliably find and install the plugin.
| - Install the `advanced-security` agent plugin | |
| - Use `/secret-scanning` in Copilot Chat | |
| - In the Extensions view, search for `@agentPlugins advanced-security` and install **Advanced Security** (`advanced-security@copilot-plugins`) | |
| - Or run the **“Chat: Plugins”** command from the Command Palette and enable the **Advanced Security** agent plugin | |
| - Then use `/secret-scanning` in Copilot Chat to scan changes for secrets before committing |
| **GitHub Copilot CLI:** | ||
| ``` |
There was a problem hiding this comment.
The “GitHub Copilot CLI” install instructions use the interactive /plugin install ... command but don’t mention that it must be run inside an interactive Copilot CLI session, and they omit the prerequisite to register the github/copilot-plugins marketplace (per website/src/content/docs/learning-hub/installing-and-using-plugins.md). Consider updating this section to either (a) show the non-interactive CLI command (copilot plugin install advanced-security@copilot-plugins) and include the marketplace add step when needed, or (b) explicitly label the snippet as “from an interactive session” and include /plugin marketplace add github/copilot-plugins if it isn’t already registered.
| **GitHub Copilot CLI:** | |
| ``` | |
| **GitHub Copilot CLI (interactive session):** | |
| ```text | |
| /plugin marketplace add github/copilot-plugins |
|
wrong branch - #1155 |
Pull Request Checklist
npm startand verified thatREADME.mdis up to date.stagedbranch for this pull request.Description
Type of Contribution
Additional Notes
By submitting this pull request, I confirm that my contribution abides by the Code of Conduct and will be licensed under the MIT License.