How skill checks work
How MCP for Copilot checks Agent Skills against Microsoft's documented load rules. Rules version 2026-10-22. 2,257 skills checked; skills data built 2026-10-23.
What we do
- We download each source repo at one commit (a GitHub tarball), find every
SKILL.md, and treat its folder as one skill. Files inside a nested skill folder count toward that nested skill, not the parent.node_modulesis ignored. IdenticalSKILL.mdcopies inside one repo are listed once. - We parse the YAML frontmatter, measure the instructions, list every file with its size, and read small script files as text to look for network or install calls. Nothing is executed.
- Each rule below is tied to the Microsoft Learn page (or the Agent Skills specification) it comes from. A failed Fail rule gives Needs changes for that target. Warnings are shown but don't change the verdict. If we can't read
SKILL.mdor the file list, the verdict is Can't check. - We publish names, descriptions, paths, links and results only. We never republish skill instructions or files, whatever the license.
- Verdict labels mean exactly what they say. “Passes documented load rules” isn't a promise the skill works in your agent, and it says nothing about whether the skill is safe.
Copilot Studio rules
Copilot Studio agents built with the GitHub Copilot harness accept a SKILL.md file or a ZIP with one. Copilot Studio skips a skill that fails a load-time check.
| Rule | Effect | What we check (and the doc wording) | Source |
|---|---|---|---|
CS-ENCODING | Fail | SKILL.md is UTF-8 without a byte-order mark “Unreadable SKILL.md … Save SKILL.md as UTF-8 without a byte-order mark” | Copilot Studio: Troubleshoot skills that don't load |
CS-FRONTMATTER | Fail | Frontmatter is a valid YAML mapping “Invalid YAML frontmatter: The --- block at the top of SKILL.md isn't valid YAML … Verify the frontmatter is a mapping of key: value pairs.” | Copilot Studio: Troubleshoot skills that don't load |
CS-NAME | Fail | Frontmatter has a non-empty name “Missing name: The frontmatter doesn't have a non-empty name: value.” | Copilot Studio: Troubleshoot skills that don't load |
CS-DESCRIPTION | Fail | Frontmatter has a non-empty description “Missing description: The frontmatter doesn't have a non-empty description: value.” | Copilot Studio: Troubleshoot skills that don't load |
CS-DESC-LENGTH | Fail | Description is at most 1,024 characters “Description too long: The effective description is longer than the model-facing catalog can accept. Microsoft doesn't publish the number; we use the Agent Skills spec maximum of 1,024 characters.” | Copilot Studio: Troubleshoot skills that don't load (limit value from the Agent Skills specification) |
CS-DESC-ONELINE | Warning | Description is a single line “Shorten the description to a single line that summarizes the skill's purpose.” | Copilot Studio: Troubleshoot skills that don't load |
CS-NAME-FORMAT | Fail | Name uses only lowercase letters, numbers and hyphens, and doesn't start or end with a hyphen “Use only lowercase letters, numbers, and hyphens. Don't start or end the name with a hyphen.” | Copilot Studio: Create a skill |
CS-DUPLICATE | Warning | Name is unique among the skills in this repo “Duplicate skill name: Two skills in the same agent use the same folder name.” | Copilot Studio: Troubleshoot skills that don't load |
Not checkable from files: “Resource file wasn't written” and “Skill package rejected” happen while Copilot Studio installs the package.
Microsoft 365 Copilot rules Preview, Frontier tenants only
Custom skills in declarative agents (Agent Builder and Microsoft 365 Agents Toolkit). Limits like 350 files and 25 MB apply per package across all of an agent's skills, so we check one skill on its own. An agent can have at most 8 skills. Skills aren't available in tenants that use Microsoft Purview Information Barriers, and can't be combined with embedded files yet.
| Rule | Effect | What we check (and the doc wording) | Source |
|---|---|---|---|
M365-FRONTMATTER | Fail | SKILL.md has a name and description in YAML front matter “A required SKILL.md file that contains: A skill name and description in the YAML front matter.” | Microsoft 365 Copilot: What is a skill |
M365-INSTRUCTIONS | Fail | Instructions are under 20,000 characters “Skill instructions, which must be under 20,000 characters.” | Microsoft 365 Copilot: What is a skill |
M365-FILE-COUNT | Fail | At most 350 files “Maximum files per package: 350 files across all skills” | Microsoft 365 Copilot: Support matrix |
M365-DEPTH | Fail | Directory depth is at most 3 “Directory hierarchy: Maximum directory depth is 3. (We count folders below the skill folder; SKILL.md is at depth 0.)” | Microsoft 365 Copilot: Support matrix |
M365-FILE-TYPES | Fail | Every file has a supported file type “A skill can include the following file types: .json, .xml, .yaml, .yml, .ini, .config, .utf8, .docx, .doc, .docm, .pdf, .txt, .rtf, .md, .ppt, .pptx, .ppsm, .xlsx, .xls, .xlsm, .csv, .tsv, .html, .htm, .png, .jpg, .jpeg, .gif, .bmp, .log, .py, .js, .mjs, .cjs, .ts, .mts, .sh, .bash” | Microsoft 365 Copilot: Supported file and script types |
M365-FILE-SIZE | Fail | No file is larger than 25 MB “Maximum file size: 25 MB per file (Agent Builder)” | Microsoft 365 Copilot: Support matrix |
M365-PACKAGE-SIZE | Warning | Skill stays within the package limits (50 MB zip in Agent Builder, 10 MB app package in Agents Toolkit) “Skill package: Compressed .zip, maximum 50 MB … the complete app package is limited to 10 MB” | Microsoft 365 Copilot: Support matrix |
M365-SANDBOX | Warning | No sign of network access, package installs or authenticated calls “The sandbox has no network access at runtime. A skill can't install packages at runtime. Authenticated network calls from scripts: Not supported.” | Microsoft 365 Copilot: Script execution sandbox |
The sandbox rule is a text heuristic: it looks for things like import requests, fetch(, curl, pip install, npm install and credential headers in scripts and in SKILL.md, and for dependency files such as requirements.txt. A match is a warning to review, not proof of a problem.
Agent Skills specification notes
Shown as warnings for portability; Microsoft doesn't list these as load failures.
| Rule | Effect | What we check (and the doc wording) | Source |
|---|---|---|---|
SPEC-NAME | Warning | Name is at most 64 characters with no consecutive hyphens “Max 64 characters … Must not contain consecutive hyphens (--)” | Agent Skills specification |
SPEC-NAME-DIR | Warning | Name matches the skill's folder name “Must match the parent directory name” | Agent Skills specification |
SPEC-COMPAT | Warning | compatibility is at most 500 characters “compatibility: Max 500 characters” | Agent Skills specification |
SPEC-ALLOWED-TOOLS | Warning | No experimental allowed-tools field “allowed-tools: Experimental. Support for this field may vary between agent implementations.” | Agent Skills specification |
Results
Copilot Studio: 2,172 pass, 85 need changes, 0 can't check. Microsoft 365 Copilot: 1,879 pass, 378 need changes, 0 can't check.
Sources
Public GitHub repos: official vendor repos and well-known collections, plus install counts from the public skills.sh search where available. The license is read from the repo's root license file. Repos without a permissive repo-wide license are listed as metadata only.
| Repo | License | Skills | Commit |
|---|---|---|---|
| github/awesome-copilot | MIT | 445 | d85f762d6e |
| anthropics/knowledge-work-plugins | Apache-2.0 | 225 | 33d3dea41a |
| microsoft/skills | MIT | 200 | a779d00cf3 |
| wshobson/agents | MIT | 185 | 0874a27b17 |
| aws/agent-toolkit-for-aws | Apache-2.0 | 150 | 9ab50636d1 |
| claude-office-skills/skills | MIT | 137 | 9c4c7d5cd2 |
| microsoft/cat-agent-skills | MIT | 102 | a9bc9b236b |
| trailofbits/skills | CC (metadata only) | 97 | 1e0cb77d07 |
| googleworkspace/cli | Apache-2.0 | 95 | a3768d0e82 |
| microsoft/github-copilot-for-azure | other (metadata only) | 56 | b274aa6d03 |
| coreyhaines31/marketingskills | MIT | 52 | e85f3cbc2e |
| samber/cc-skills-golang | MIT | 46 | 246b6c4c1a |
| microsoft/azure-skills | MIT | 45 | 3e15ebee59 |
| openai/skills | none (metadata only) | 44 | 49f948faa9 |
| mattpocock/skills | MIT | 38 | 5beb35b040 |
| convex/agent-skills | Apache-2.0 | 33 | 191a5c33a7 |
| microsoft/skills-for-copilot-studio | MIT | 31 | fd9653d0ec |
| getsentry/skills | Apache-2.0 | 29 | f57ada2d0b |
| huggingface/skills | Apache-2.0 | 26 | c3ff942be3 |
| expo/skills | MIT | 25 | 0d035556e3 |
| addyosmani/agent-skills | MIT | 25 | aeac41d4d0 |
| pbakaus/impeccable | Apache-2.0 | 23 | 5cb95eea9c |
| anthropics/skills | none (metadata only) | 20 | dbd4588f9e |
| hashicorp/agent-skills | MPL-2.0 (metadata only) | 20 | f706481af9 |
| cloudflare/skills | Apache-2.0 | 19 | 86505e44f8 |
| obra/superpowers | MIT | 15 | 2ce8aa15d0 |
| firebase/agent-skills | Apache-2.0 | 13 | 92eed24c09 |
| remotion-dev/skills | none (metadata only) | 12 | 6c67adcd9c |
| prisma/skills | MIT | 10 | ba3f9d7320 |
| neondatabase/agent-skills | Apache-2.0 | 10 | d814689cbb |
| stripe/ai | MIT | 10 | 8a8818e856 |
| vercel-labs/agent-skills | none (metadata only) | 9 | 063bee94c3 |
| google/agents-cli | Apache-2.0 | 8 | bea5875e38 |
| supabase/agent-skills | MIT | 2 | c9be0e931b |
Check any repo
The checker runs the same rules on a public GitHub repo you paste. It only fetches files from github.com (via raw.githubusercontent.com and the jsDelivr file listing). It checks up to 20 skills, skips SKILL.md files over 256 KB, never runs code, and caches results per commit for a day.
Corrections or takedown requests: hello@mcp4copilot.dev.
Rule-based checks of public files against Microsoft's documented load rules, not tested in Copilot Studio or Microsoft 365 Copilot. Independent project, not affiliated with Microsoft.