Board or committee paper
Turns approved facts into a decision-ready paper, with the recommendation on page one and every claim sourced.
Skills written for banks and government agencies
Ten ready-to-adapt skills for the paperwork these places run on, and a maker for your own templates. Plain text and no code. They ask for no web access and tell the assistant not to invent facts. Each one is written so a person signs off the output.
Tested so far: we followed the instructions by hand on invented cases, and checked the packages against Microsoft's published schema. They have not been run in real GitHub Copilot or Microsoft 365 Copilot. Run your own trial on invented material first. See what was and was not checked
Ministerial or executive brief
One page a minister or chief executive can act on in three minutes, with handling risks and clearance shown.
Policy plain-language summary
A one-page summary staff or the public can follow, with each line tied to its clause and "must" still meaning must.
Regulatory change impact note
What the new rule says, whether it touches you, the gaps, and who owns each action. From the text you supply, not from memory.
Risk register entry
One risk, written as cause, event and consequence, rated on your matrix, with control evidence shown or marked as untested.
Audit evidence checklist
Turns an audit request list into who brings what, for which period, and what is missing. It will not create evidence.
Procurement evaluation summary
Writes up what the panel decided against the approved plan, checks the arithmetic, and will not move a score.
Meeting minutes and action log
Records what was decided, not who said what. Nothing counts as decided unless the notes say so.
Complaint or public enquiry reply
A clear, human reply plus a cover note for the approver. It flags vulnerable people and admits nothing without authority.
Sensitive-information check before sending
A second pair of eyes before you press send. It lists what it found and what it could not see, and never says "safe".
Make your own
Make your own: corporate skill maker
Answer ten questions. Get a text-only skill from your own template, in both forms, plus a review sheet for IT.
Open
"Copilot" can mean two different products. Every skill here comes in both forms.
GitHub Copilot
Inside VS Code and other editors.
A skill is a folder with a SKILL.md file in it.
Microsoft 365 Copilot
Inside Word, Teams and Outlook.
A skill becomes a declarative agent: a manifest and an instructions file.
Not sure? If your Copilot sits in Word or Teams, it is the second one.
How
From download to daily use
Download
One zip per skill, safe to carry to an offline machine. It holds both forms and a review sheet.
Fill in
Search for [FILL IN] in the text. Add your template, sign-off chain and classification scheme.
Get it approved
Give the review sheet to IT or risk. Most questions are already answered.
Install and try
Copy the folder, or paste the instructions into Agent Builder. Try it on invented material first.
Why general skills are not allowed in these places
They can run things
A general skill may come with scripts that run on your computer. VS Code's own documentation says: only reuse skills you trust. Source
They can reach outside
A general skill may tell the agent to open web pages or connect to other tools. Your document can travel with that request.
They write from memory
Asked for a commencement date or a figure, a general assistant gives a plausible one. In a board paper that is a serious error.
Nobody owns them
No owner, no version, no record of change. Audit asks who approved this and when, and there is no answer.
They do not know your rules
They have never seen your template, your sign-off chain or your classification scheme, so they make those up as well.
What makes a skill acceptable
Every skill here is built to these nine rules, and a script fails any pack that breaks one.
Text only
No scripts, no web addresses and no external tools. You can read every file in Notepad.
Adds no way out
The skill sends nothing anywhere and declares no connection. Your Copilot service still processes prompts under your agreement: ask IT where.
Named sources only
It uses what you paste and the documents IT has named. Nothing from general knowledge.
Every claim cited
Each fact carries a source tag. Anything without one is marked unverified, and its own suggestions are marked proposed.
A person signs off
Each output is a draft with a sign-off block. The skill never sends anything.
Version and owner
Each skill names its version and an owner role, which your organisation fills in.
A change log
Each skill keeps a dated record of changes for audit.
No personal data in examples
Examples use invented organisations and roles, and are labelled fictional. A script checks.
Classification notes
Each skill says how to treat its material, and stops if the material is above the level allowed.
These are design principles, not legal advice. Nothing here states that a skill meets a law, regulation or standard. Your own risk and legal teams decide.
What we checked and what we could not
Confirmed in official documentation on 1 November 2026
- GitHub Copilot in VS Code loads a SKILL.md folder from .github/skills/ or ~/.copilot/skills/. The folder name must match the name field, and an invalid name fails silently. Source
- GitHub's page lists the same locations and says support depends on the surface and IDE version. Source
- VS Code has an enterprise policy, ChatStrictPluginOnlyCustomization, that blocks standalone user and workspace skills. Others turn off agent mode or limit network access. Source
- A declarative agent is defined by a manifest with instructions and knowledge. Instructions have an 8,000-character limit. Source
- discourage_model_knowledge exists, and Microsoft says it is not a guarantee that answers use only your sources. Source
- Leaving out the item list on SharePoint knowledge lets the agent reach all SharePoint and OneDrive sources. Source
- Admins can upload a package at Agents > All agents > Upload custom agent, and control access, sharing and blocking. Source
- Government clouds: GCC has full declarative agent support. GCC High has pro-code agents and Agent Builder. DoD has pro-code agents only. Source
- Outside the EU, Copilot queries may be processed in the US, EU or other regions. Anthropic models are excluded from the EU Data Boundary. Source
Not confirmed. Ask your vendor or IT.
- That these skills run correctly in real GitHub Copilot or Microsoft 365 Copilot. They have never been run there.
- That a package upload succeeds. The schema check is local and cannot prove Microsoft's service accepts it. The placeholder web addresses must be replaced first.
- Whether a GitHub organisation can centrally publish or restrict skills. GitHub's policy page lists no skill-specific policy; the only control found is the VS Code device policy above.
- Whether VS Code ignores or warns about the extra version line in SKILL.md. The file format is otherwise as documented.
- How a declarative agent with no knowledge source behaves when discourage_model_knowledge is on and the person pastes or attaches a document. The skills depend on this. It is the first thing to test.
- Government cloud detail. Microsoft's overview and feature tables differ on GCC High, and manifest v1.9 may not be available everywhere. Check your tenant.
- Whether Copilot is offered in Microsoft 365 operated by 21Vianet in China. No direct statement found.
- Whether any of this satisfies a particular regulator. That is for your own risk and legal teams.
Open source used, with thanks
We searched first and used what fit. No government or bank has published an open prompt library that we could find with a clear permissive licence. The rest here is original.
- Minutes structure: awesome-copilot, meeting-minutes skill, by GitHub and contributors (MIT)
- Chinese plain-style rules: official-document-skill, by Xiangjian Liu (MIT)
- Chinese minutes attendance fields: official-document-writing-skill, by its contributors (MIT)
- Agent package layout: da-HRHelpdesk sample, Microsoft 365 & Power Platform Community (MIT)
- Risk names in the review sheet: AI Governance Framework, by FINOS (CC BY 4.0)
In short
Pick the skill closest to your paperwork, fill in your rules, and hand the review sheet to IT. If nothing fits, the maker turns your own template into a skill in about ten questions.
Start with the maker