Skill Catalogue

Every skill in this repo, grouped by whether it ships in the public catalogue (Public) or stays inside the repo as a tool for working on the repo itself (Meta). Both are validated against the same SKILL.md spec.

The catalogue is intentionally short. Skills live here only when they are BC Gov–specific. Before adding a new skill, contributors check the upstream catalogues first. See Contribute a Skill.

Public skills

Public skills live under skills/ in the repo. Each card below is hand-listed from the skill's SKILL.md frontmatter so the catalogue reads at a glance; the live source is always the linked file. List the skills available from the CLI itself with:

npx skills add bcgov/agent-skills --list

azure-networking

public

Azure subnet, NSG, and private-endpoint patterns for adding subnets inside an existing VNet — atomic NSG-at-creation, per-service delegation, PE subnet layout, ARM write serialization, and reference NSG layouts for PE, APIM, App Gateway, and Container Apps subnets. Tool-agnostic guidance with Terraform (azapi_resource), Bicep, and az CLI examples.

Use when adding subnets, debugging delegation or PE errors, or sizing a PE subnet.

Read skills/azure-networking/SKILL.md →

github-actions

public

BC Gov hardening patterns for GitHub Actions workflows — deny-all permissions: {} baseline with per-job step-ups, first-party tag vs third-party SHA pinning, fork-gate, single results-aggregator required check, pinned ubuntu-24.04 runners, script-injection-safe env handling, and signed-commit ruleset interaction. Covers .github/workflows/*.yml, dependabot.yml, and the branch-protection / repository-ruleset settings that pair with them.

Use when authoring or reviewing a workflow in a BC Gov repo, debugging permission-denied errors, or onboarding Dependabot.

Read skills/github-actions/SKILL.md →

openshift-deployment

public

BC Gov Private Cloud OpenShift workload-manifest guidance: picking the right controller (Deployment, StatefulSet, DaemonSet, Job, CronJob) and shaping it for the platform — container resources and QoS, namespace LimitRange defaults, liveness/readiness/startup probes, terminationGracePeriod and SIGTERM handling, PID-1 reaping with tini or dumb-init, PodDisruptionBudgets, horizontal scaling (HPA, VPA), and CronJob admission rules.

Use when authoring or reviewing a workload manifest bound for a license-plate runtime namespace. Out of scope: NetworkPolicies, Vault/ESO, Argo CD/GitOps, Artifactory image pulls, Porter TCP exposure, storage class choice, Sysdig, ACS, security assessment.

Read skills/openshift-deployment/SKILL.md →

Meta-skills

Skills the repo uses on itself: scaffolding a new skill and validating the spec. They live under .github/skills/ and are validated by the same PR check, but they aren't part of the public catalogue; they're picked up by agents working in a checkout of this repo.

skill-author

skill-validator

Don't see what you need?

Check the upstream catalogues first

Generic skills (Azure SDKs, Microsoft Foundry, document formats, language workflows) are usually already published elsewhere. The catalogues we check first are listed on the contribute page.

Then add yours here

If your use case is BC Gov–specific — a Landing Zone constraint, an internal service, a policy-driven workflow — open a PR. The contribute guide walks through it.