SkillBridge installs and manages portable Agent Skills (SKILL.md) from GitHub for VS Code GitHub Copilot Chat / Agent Mode.

It is designed for both simple skills and complex Claude Code-style skill packs such as repositories with:

.claude-plugin/
skills/<skill>/SKILL.md
agents/*.md
scripts/*.py
schema/
pdf/
extensions/

What it does

Install a skill or whole skill pack from a GitHub URL.
Detect SKILL.md files under common layouts:
- skills/<name>/SKILL.md
- .github/skills/<name>/SKILL.md
- .claude/skills/<name>/SKILL.md
- .agents/skills/<name>/SKILL.md
- direct SKILL.md
Validate required frontmatter (name, description).
Install to either:
- Workspace: .github/skills/<name>
- User/global: ~/.copilot/skills/<name>
Show installed skills in a VS Code activity-bar tree view.
Activate skills by opening/copying /skill-name ... for VS Code Chat.
Remove and update installed skills.
Maintain a .skillbridge-lock.json with source URL and commit metadata.
Run a basic security scan before copying files.
For complex packs, copy shared root resources into .github/skills/.skillbridge/packs/<owner>__<repo>/ and adapt bare paths like scripts/foo.py to the installed path.
Optionally copy Claude-format agents/*.md into workspace .claude/agents so VS Code can discover them as custom agents.

Usage

Open a workspace in VS Code.
Run SkillBridge: Install Skill from GitHub.

Paste a GitHub URL, for example:

https://github.com/AgriciDaniel/claude-seo

Choose install scope:
- Workspace: .github/skills
- User: ~/.copilot/skills
Review validation and security warnings.
Install.
In VS Code Chat / Agent Mode, type:
```
/seo audit https://example.com
```
or right-click an installed skill in the SkillBridge tree and choose Activate Skill in Chat.

Security model

SkillBridge does not run remote install.sh, install.ps1, npm install, pip install, or any bundled scripts automatically.

It only clones/copies files after confirmation. You still must review community skills before allowing Copilot/agent tools to run terminal commands, because a skill can instruct an agent to execute scripts.

The scanner flags common risky patterns such as:

curl ... | sh
Invoke-WebRequest ... | iex
rm -rf /
sudo
package installs
credential references
script files

This is a basic safety net, not a full security audit.

Important limitations

SkillBridge manages files that VS Code/Copilot can discover. It does not modify Copilot's hidden system prompt and cannot force an agent to use a skill if the host agent does not support Agent Skills.

Some Claude Code plugins rely on Claude-specific runtime features. SkillBridge adapts common filesystem layouts and script paths for VS Code, but hooks, MCP servers, and Claude-only plugin behavior may still require Claude Code.