[vystartasv]

Summary

• Add a focused Agent Skill for SharePoint Framework development with SPFx Fast.
• Cover authenticated SPFx client use, schema inspection, safe writes, and common app starters.
• Add the skill to the generated skills catalog.

The skill is also installable directly from vystartasv/spfx-fast with:

npx skills add https://github.com/vystartasv/spfx-fast/tree/main/skills/spfx-fast

Validation

• npm run skill:validate
• npm start

🤖🤖🤖

[github-actions]

🚦 Submission status: 👀 Ready for review

Risk tier: merge-risk:high — Privileged execution, automation, or review-policy change
Required to merge: passing submission-gate checks plus 1 approval from reviewers with write access, including a maintainer with admin or maintain permission.

Why this tier

• Label needs-review:HIGH flags a high contributor-risk signal

Automated checks

Check	Status	Details
Line endings	✅ Passed	Passed · logs
Spelling	✅ Passed	Passed · logs
Generated README consistency	✅ Passed	Passed · logs
Skill validation	✅ Passed	Passed · logs
Skill lint (vally)	✅ Passed	Passed · logs
Risk scan	✅ Passed	Passed · logs
Contributor reputation	✅ Passed	Passed · logs
Duplicate resource scan	✅ Passed	Passed · logs
PR quality signal	⏭️ Skipped	Skipped by its workflow · logs

Review

• Approvals: 0/1
• Assigned reviewer: not assigned yet — comment /request-review to ask for one
• Review target date: not set
• Still needed: 1 more approval(s); an approval from a maintainer with admin or maintain permission
• The core-maintainers pool is not staffed yet; an approver with admin or maintain permission is required instead.

Commands

Command	Who	What it does
/rerun-checks	PR author, maintainers	Re-runs failed or incomplete checks and re-evaluates this gate
/request-review	PR author, maintainers	Asks the review rotation to assign a reviewer (adds needs-reviewer)

_{Updated for d5640be · gate run · This comment is maintained automatically — see submission gate docs.}

[github-actions]

🔒 PR Risk Scan Results

Scanned 1 changed file(s).

Severity	Count
🔴 High	0
🟠 Medium	3
ℹ️ Info	0

Severity	Rule	File	Line	Match
🟠	package-exec-command	skills/spfx-fast/SKILL.md	14	3. Choose a starter with `pnpm exec spfx-fast use-cases` or `pnpm exec spfx-fast scenarios`. With npm, use `npx --no-install spfx-fast`. Generate only after inspecting the target s
🟠	package-exec-command	skills/spfx-fast/SKILL.md	20	With npm, replace `pnpm exec` with `npx --no-install`.
🟠	package-exec-command	skills/spfx-fast/SKILL.md	21	4. Run `pnpm exec spfx-fast agent init` and `pnpm exec spfx-fast agent doctor`. With npm, use `npx --no-install spfx-fast`. Doctor checks local setup, not tenant permissions.

This is an automated soft-gate report. Findings indicate review targets and do not block merge by themselves.

[github-actions]

🔴 Contributor Reputation Check: HIGH risk

Check	Risk
Profile	HIGH
Credential audit	NONE

Maintainers: please review this contributor before merging.
See the workflow run for full details.
Automated check powered by AGT.

[github-actions]

🔍 Vally Lint Results

✅ All checks passed

Scope	Checked
Skills	1
Agents	0
Total	1

Severity	Count
❌ Errors	0
⚠️ Warnings	0
ℹ️ Advisories	0

Summary

Level	Finding
ℹ️	✅ spfx-fast (2/2 checks passed)
ℹ️	✓ [spec-compliance] All 1 skill(s) are spec-compliant.
ℹ️	✓ spec-compliance: All spec checks passed.
ℹ️	✓ [valid-refs] All file references across 1 skill(s) are valid.
ℹ️	✓ valid-refs: All file references resolve to existing files within the skill directory.
ℹ️	1 skill(s) linted, 1 passed

Full linter output

### Linting skills/spfx-fast
✅ spfx-fast (2/2 checks passed)
    ✓ [spec-compliance] All 1 skill(s) are spec-compliant.
        ✓ spec-compliance: All spec checks passed.
    ✓ [valid-refs] All file references across 1 skill(s) are valid.
        ✓ valid-refs: All file references resolve to existing files within the skill directory.

1 skill(s) linted, 1 passed

[Copilot]

🟡 Changes recommended

The documented bare CLI commands fail without a global installation because the project-local executable is not on the shell PATH; they need a project-local runner.

1 open issue

• Use a project-local runner for spfx-fast CLI commands · New

What changed in this PR

Adds an SPFx Fast skill to help GitHub Copilot build SharePoint Framework apps and makes it discoverable in the skills catalog.

Changes:

• Defines a workflow for schema inspection, starter generation, authenticated clients, and safe writes.
• Maps common SharePoint app requests to starters and links supporting documentation.
• Registers the skill in the generated catalog.

File	Description
skills/​spfx-fast/​SKILL.md	Adds SPFx Fast development guidance and reference links.
docs/​README.skills.md	Adds the skill’s description and installation command.

_{Review effort: Balanced (auto)}

[vystartasv]

/request-review

[github-actions]

🙋 Added needs-reviewer. Reviewer routing is assigning a reviewer now.

[Copilot]

🔵 Needs a closer look

The instructions reference an incorrect project-root path for the installed package’s capabilities file, which can cause setup to fail or load the wrong file and must be corrected.

No open issues 🎉

1 previously missed issue

In code that hasn't changed since last review

Resolve capabilities.json from the installed package

skills/​spfx-fast/​SKILL.md:13

After @spfx-fast/core is installed in an SPFx project, agent/capabilities.json is not a project-root path; the package ships this file under node_modules/@spfx-fast/core/agent/capabilities.json. Following this instruction can fail or load an unrelated local file before coding. Use the package-qualified path for both files (or otherwise resolve the installed package root).

This issue also appears in the following locations of the same file:

• line 14
• line 22
• line 22
• line 38

1 resolved since last review

• Use a project-local runner for spfx-fast CLI commands

_{Review effort: Lite (auto)}

[Copilot]

🔵 Needs a closer look

The guide still needs corrections for awaiting and initializing createSPFxServices and for documenting the required Graph delegated scopes and admin consent, since otherwise generated code may fail at runtime or receive 403 responses.

No open issues 🎉

2 previously missed issues

In code that hasn't changed since last review

Await createSPFxServices before accessing service clients

skills/​spfx-fast/​SKILL.md:22

createSPFxServices is asynchronous (it awaits the SPFx Graph client), so omitting await here can cause generated code to use a Promise as services and fail at runtime. State that the services must be awaited and initialized once per web part before accessing client, sharepoint, or rest.

Add Graph scope and admin consent setup

skills/​spfx-fast/​SKILL.md:23

The generated dashboard's list helpers use Graph, but SPFx still requires the corresponding delegated scopes in config/package-solution.json and admin consent; otherwise the advertised Graph reads/writes fail with 403 even though createSPFxServices is authenticated. The current steps only say to preserve permission checks, so add an explicit scope/consent step before telling the agent to test or ship the generated app.

_{Review effort: Lite (auto)}

[vystartasv]

/request-review

[github-actions]

🙋 Added needs-reviewer. Reviewer routing is assigning a reviewer now.

[Copilot]

🔵 Needs a closer look

Human assessment is needed because the review uncovered a moderate path-documentation issue in the SPFx setup instructions that could prevent agents from loading the package capability and scope limits.

No open issues 🎉

_{Review effort: Lite (auto)}

[Copilot]

🔵 Needs a closer look

Human assessment is needed to evaluate the missing end-to-end usage evidence and the accuracy of the Microsoft Graph approval-role guidance.

No open issues 🎉

_{Review effort: Balanced (auto)}

[aaronpowell]

This skill is just a wrapper around skill sourced externally, which we don't support in this repo as it poses a security supply chain risk.