[renovate]

This PR contains the following updates:

Package	Update	Change
microsoft/skills	digest	8850874 → 2130750

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[toolhive-release-app]

🛡️ Skill Security Scan Results

✅ applicationinsights-web-ts

• Status: Passed
• Findings: 2
• Allowed (not blocking): 1
  • PG_EXFIL_HTML_TAG (Allowed: FP: matched the static, first-party Microsoft Application Insights SDK loader URL at SKILL.md:89. It contains no dynamic data, credentials, or user content and is the documented SDK installation step.)

For review, not blocking: 1 file(s) the LLM judge only partly read

The LLM judge exceeded its context budget on: SKILL.md (instruction body). Review these files manually.

✅ microsoft-cloud-solution-architect

• Status: Passed
• Findings: 8
• Allowed (not blocking): 2
  • MANIFEST_MISSING_LICENSE (Allowed: Most upstream skill repositories declare their license at the repository root rather than in each SKILL.md's frontmatter. Packaging a skill already requires a maintainer to verify that the upstream license permits redistribution (see AGENTS.md), so the frontmatter field adds nothing to that check.)
  • PG_PII_CREDENTIAL_HARVESTING (Allowed: FP: matched a warning against building an identity store and storing passwords in the Federated Identity design-pattern explanation (references/design-patterns.md:364). It requests no credential and directs users toward external identity providers.)

For review, not blocking: 6 file(s) the LLM judge only partly read

The LLM judge exceeded its context budget on: ./references/best-practices.md, ./references/design-patterns.md, ./references/mission-critical.md, references/best-practices.md, references/design-patterns.md, references/mission-critical.md. Review these files manually.

✅ microsoft-copilot-sdk

• Status: Passed
• Findings: 2
• Allowed (not blocking): 1
  • MANIFEST_MISSING_LICENSE (Allowed: Most upstream skill repositories declare their license at the repository root rather than in each SKILL.md's frontmatter. Packaging a skill already requires a maintainer to verify that the upstream license permits redistribution (see AGENTS.md), so the frontmatter field adds nothing to that check.)

For review, not blocking: 1 file(s) the LLM judge only partly read

The LLM judge exceeded its context budget on: SKILL.md (instruction body). Review these files manually.

✅ microsoft-docs

• Status: Passed
• Findings: 1
• Allowed (not blocking): 1
  • MANIFEST_MISSING_LICENSE (Allowed: Most upstream skill repositories declare their license at the repository root rather than in each SKILL.md's frontmatter. Packaging a skill already requires a maintainer to verify that the upstream license permits redistribution (see AGENTS.md), so the frontmatter field adds nothing to that check.)

✅ microsoft-github-issue-creator

• Status: Passed
• Findings: 1
• Allowed (not blocking): 1
  • MANIFEST_MISSING_LICENSE (Allowed: Most upstream skill repositories declare their license at the repository root rather than in each SKILL.md's frontmatter. Packaging a skill already requires a maintainer to verify that the upstream license permits redistribution (see AGENTS.md), so the frontmatter field adds nothing to that check.)

✅ microsoft-kql

• Status: Passed
• Findings: 3
• Allowed (not blocking): 1
  • MANIFEST_MISSING_LICENSE (Allowed: Most upstream skill repositories declare their license at the repository root rather than in each SKILL.md's frontmatter. Packaging a skill already requires a maintainer to verify that the upstream license permits redistribution (see AGENTS.md), so the frontmatter field adds nothing to that check.)

For review, not blocking: 1 file(s) the LLM judge only partly read

The LLM judge exceeded its context budget on: references/advanced-patterns.md. Review these files manually.

✅ microsoft-mcp-builder

• Status: Passed
• Findings: 8
• Allowed (not blocking): 1
  • MANIFEST_MISSING_LICENSE (Allowed: Most upstream skill repositories declare their license at the repository root rather than in each SKILL.md's frontmatter. Packaging a skill already requires a maintainer to verify that the upstream license permits redistribution (see AGENTS.md), so the frontmatter field adds nothing to that check.)

For review, not blocking: 5 file(s) the LLM judge only partly read

The LLM judge exceeded its context budget on: ./reference/evaluation.md, ./reference/mcp_best_practices.md, ./reference/microsoft_mcp_patterns.md, ./reference/node_mcp_server.md, ./reference/python_mcp_server.md. Review these files manually.

✅ microsoft-skill-creator

• Status: Passed
• Findings: 3
• Allowed (not blocking): 1
  • MANIFEST_MISSING_LICENSE (Allowed: Most upstream skill repositories declare their license at the repository root rather than in each SKILL.md's frontmatter. Packaging a skill already requires a maintainer to verify that the upstream license permits redistribution (see AGENTS.md), so the frontmatter field adds nothing to that check.)

For review, not blocking: 2 file(s) the LLM judge only partly read

The LLM judge exceeded its context budget on: SKILL.md (instruction body), references/azure-sdk-patterns.md. Review these files manually.

---

Summary: Completed 8 of 8 skill scan(s), all passed security checks. ✅

[renovate]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.

[danbarr]

LGTM