Need to add skills using a link to another repo

[jimbobbennett]

We have some skills in our own repo that we'd love to submit here. The problem is we update these on a regular basis, so would need to set up a job to continuously raise PRs with the updates, potentially multiple a day when active development is happening.

What I'd really like is to be able to link to our skills repo, and have this repo pull from there. I spoke to @digitarald yesterday, and he said that there is a way to do this with a plugin, and to raise this issue and tag him here!

Please let me know the right way to do this.

[aaronpowell]

Right now, we're being very restrictive on external plugins being surfaced through the awesome-copilot marketplace, focusing primarily on GitHub/Microsoft owned repos and a few select GitHub partners. The reason for this is that external plugins pose a risk through the marketplace - we have no visibility or guardrails in place in which to ensure nothing malicious is being surfaced through the external plugin. After all, Copilot just sees our marketplace, sees the source, and follows it, so if something malicious did get entered we are the delivery mechanism for that.

The most trusted way to delivery something via awesome-copilot is to have it in the repo because that way it has been "vetted" by us before merging it in, and thus, the trust chain is maintained. This does result in a maintenance burden for someone such as yourself - as you mention there could be multiple updates needing to be sync'ed in short time periods, but automation should be able to address some of the overhead that would have.

[jimbobbennett]

OK, thanks @aaronpowell. Will create a job our side to push updates on our repo as a PR to this repo. Then will look at how we can become trusted over time.