This directory contains 91 skill packages that teach GitHub Copilot how to approach specific domains when working in Riksdagsmonitor. Skills are strategic, reusable, rule-based instruction sets — not step-by-step runbooks. They load automatically when a Copilot agent determines a task touches the relevant domain.
Canonical long-form skill catalog with detailed mappings: see SKILLS.md at the repository root.
Agent → skill recommendations: see AGENTS.md §"Skills Mapping by Agent" and .github/agents/README.md.
Each skill is a directory containing a SKILL.md file (and optional supporting assets). When Copilot begins a task, skills are matched against the request. If relevant, they are loaded into the agent's context alongside the persona and repository-wide copilot-instructions.md.
| Property | Value |
|---|
| Scope | Repository-local (.github/skills/) + implicit project-level skills listed in copilot-instructions.md <available_skills> |
| Invocation | Automatic (when relevant) or explicit via skill tool |
| Governance | CEO approval for material changes per Change_Management.md |
| Attribution | AI-assisted edits require human review + DCO sign-off per AI_Policy.md |
Skills are grouped into 12 functional categories that mirror the Riksdagsmonitor capability areas. Each row links to the skill's SKILL.md.
| Skill | Purpose |
|---|
| political-science-analysis | Comparative politics, policy analysis, frameworks |
| osint-methodologies | Open-source intelligence collection and verification |
| intelligence-analysis-techniques | ACH, SWOT, Devil's Advocate, Red Team, key assumptions check |
| swedish-political-system | Riksdag structure, 8 parties, electoral system, coalition dynamics |
| electoral-analysis | Election forecasting, coalition prediction, voter behaviour |
| behavioral-analysis | Political psychology, cognitive biases, leadership analysis |
| strategic-communication-analysis | Narrative analysis, media monitoring, messaging detection |
| legislative-monitoring | Voting patterns, committee effectiveness, bill tracking |
| risk-assessment-frameworks | Political risk and corruption-indicator taxonomies |
| data-science-for-intelligence | Statistics, ML, NLP, time series, network analysis |
| gdpr-compliance | GDPR for political-data processing and public-official data |
| Skill | Purpose |
|---|
| iso-27001-controls | ISO 27001:2022 Annex A controls for static sites |
| nist-csf-mapping | NIST CSF 2.0 function / category / subcategory mapping |
| cis-controls | CIS Controls v8.1 implementation for static sites |
| threat-modeling | STRIDE, MITRE ATT&CK, attack-tree methodology |
| secure-code-review | HTML / CSS / JS / TS security-focused review |
| security-documentation | ISMS documentation standards |
| incident-response | NIST + ISO 27001 incident-response lifecycle |
| input-validation | XSS/injection prevention, safe output encoding |
| vulnerability-management | SLA-driven remediation (Critical 24h / High 7d / Med 30d / Low 90d) |
| data-protection | Classification, privacy-by-design, encryption |
| ai-governance | EU AI Act, OWASP LLM security, responsible AI |
| information-security-strategy | Program-level security strategy and risk management |
| compliance-checklist | Unified mapping across ISO/NIST/CIS/GDPR/NIS2/EU CRA/SOC 2/PCI DSS/HIPAA |
| secrets-management | GitHub secrets, PATs, OIDC, token rotation |
| Skill | Purpose |
|---|
| c4-architecture-documentation | C4 (Context/Container/Component) + Mermaid diagrams |
| github-actions-workflows | Workflow patterns, reusable workflows, caching |
| code-quality-checks | HTMLHint, linkinator, ESLint, JSON validation |
| code-review-practices | Review quality gates and constructive feedback |
| testing-strategy | Unit / integration / E2E strategy (Vitest + Cypress) |
| performance-optimization | Core Web Vitals, bundle size, caching |
| api-integration | REST / GraphQL clients, rate limiting, auth |
| data-pipeline-engineering | ETL, scheduling, versioned caching, freshness monitoring |
| change-management | ITIL-aligned change flow (Normal/Standard/Emergency) |
| contribution-guidelines | PR workflows, DCO/CLA, community engagement |
| open-source-governance | OSS licensing, SBOM, supply-chain posture |
| secure-development-policy | Hack23 Secure Development Policy enforcement |
| secure-development-lifecycle | SDL phases from requirement to retirement |
| product-management-patterns | Roadmapping, issue hygiene, prioritization |
| Skill | Purpose |
|---|
| responsive-design | Mobile-first CSS Grid/Flexbox, 320-1440px breakpoints |
| design-system-management | Cyberpunk theme, CSS custom properties, component library |
| political-data-visualization | CSS-only charts, heat maps, dashboards |
| advanced-data-visualization | Chart.js / D3.js interactive dashboards |
| data-visualization-principles | Chart selection, colour theory, storytelling |
| ui-ux-design | UX heuristics, information architecture |
| seo-optimization | Schema.org, OpenGraph, Twitter Cards, hreflang |
| seo-best-practices | Canonical URLs, sitemap, robots.txt |
Note: the UI/UX category lists 8 rows; seo-best-practices and seo-optimization are two distinct skills — one content/strategy-focused, one technical.
| Skill | Purpose |
|---|
| language-expertise | Linguistic and cultural expertise for all 14 supported languages (EN, SV, DA, NB, FI, DE, FR, ES, NL, AR, HE, JA, KO, ZH) |
These skills encode the gh-aw framework's upstream rules. They underpin every .github/workflows/news-*.md workflow and the prompt modules in .github/prompts/. The index lives in gh-aw-README.md.
| Skill | Purpose |
|---|
| github-agentic-workflows | Root skill: v0.69.1 overview, five-layer security, safe outputs, MCP |
| gh-aw-workflow-authoring | Markdown syntax, YAML frontmatter, compilation to .lock.yml |
| gh-aw-mcp-configuration | MCP server setup, transport protocols, lifecycle, tool discovery |
| gh-aw-mcp-gateway | Expert-level MCP gateway: routing, Docker, security, deployment |
| gh-aw-safe-outputs | Sanitisation, controlled AI actions, write-operation patterns |
| gh-aw-security-architecture | Defense-in-depth, threat model, sandboxing, attack vectors |
| gh-aw-firewall | Squid proxy domain allow-listing, iptables, credential management |
| gh-aw-containerization | Docker isolation, multi-stage builds, image optimisation |
| gh-aw-github-actions-integration | Workflow triggers, env config, secrets, matrix, deployment |
| gh-aw-authentication-credentials | Token types, rotation, least-privilege, MCP auth, API keys |
| gh-aw-logging-monitoring | Structured logging, metrics, alerting, debugging |
| gh-aw-tools-ecosystem | Tool capabilities, limits, integration patterns, custom tools |
| gh-aw-continuous-ai-patterns | Continuous-AI triage / review / maintenance patterns |
The news-generation pipeline (scripts/aggregate-analysis.ts → scripts/render-articles.ts → scripts/render-lib/) derives every published article from three static inputs: analysis/methodologies/, analysis/templates/, and the per-day artifacts in analysis/daily/$DATE/$SUB/. Skills shape how each of those inputs is authored:
| Skill | Role in the pipeline |
|---|
automated-content-generation | Defines the 9-artifact section schema every per-type analysis run must hit (executive-brief → synthesis → significance → stakeholders → SWOT → scenarios → comparative → intel-assessment → classification). An artifact authored with this skill can be dropped into analysis/daily/$DATE/$SUB/ and the aggregator will process it without modification. |
editorial-standards | Governs tone (inverted-pyramid structure, AP/Reuters attribution, balanced reporting), source-citation density, and the rule that every factual claim must link to a specific Riksdag/Regering source. Artifacts that violate these rules will fail the analysis gate in .github/prompts/05-analysis-gate.md. |
data-pipeline-engineering | Provides the contract for how MCP query results are cached, deduplicated, and inlined into artifacts so the aggregator's SHA-256 manifest remains reproducible: same source data → same article.md. |
Because these three skills are primary for the aggregator flow, any workflow that produces news artifacts MUST load them. The per-type .lock.yml workflows implicitly do so via tools: ["*"]; if you author an artifact manually, invoke these skills explicitly.
| Category | Count |
|---|
| Core Infrastructure & Governance | 9 |
| Political Intelligence | 11 |
| ISMS & Security | 14 |
| Development & Operations | 14 |
| Testing & Quality Assurance | 2 |
| UI/UX & Design | 8 |
| Data Integration | 6 |
| Journalism & Media | 5 |
| Government, Regulatory & Economics | 7 |
| Language & Localization | 1 |
| GitHub Agentic Workflows | 13 |
| Copilot Patterns | 1 |
| Total | 91 |
Source of truth: ls .github/skills/ | grep -v '^gh-aw-README\.md$' | wc -l → 91.
- Create a directory
<skill-name>/ in this folder (kebab-case).
- Add a
SKILL.md describing: When to use, Rules to follow, Examples.
- Keep it strategic — principles and rules, not runbooks.
- Cross-link to any related skills under "See also".
- Open a PR; CEO approval required per Change_Management.md.
- Update this README's catalog table and the total in
SKILLS.md.
📋 Document owner: CEO | 🏷️ Classification: Public | 🔄 Review cycle: Quarterly