SkillWright: a Copilot Studio agent that goes shopping for skills on GitHub and installs them into Dataverse

There’s a quiet split forming in the AI agent world.

On one side, an open ecosystem is forming around Agent Skills — small SKILL.md files published on GitHub that teach an agent how to do something specific. Anyone can write one. Anyone can fork one. It’s the README, but for behavior.

On the other side, enterprises are standing up governed skill layers inside platforms like Microsoft Dataverse — “business skills” that live behind identity, policy, and admin approval, and that any connected agent can pick up at runtime.

Both sides are growing fast. Neither side talks to the other. The open community ships skills daily that never make it past the firewall. The enterprise side hand-authors skills from scratch that someone, somewhere, has already written better.

That gap is what I wanted to close. So I built SkillWright — a Copilot Studio agent whose entire job is to source, vet, and install skills for other agents.

Repo (open source, swagger + agent assets included): 👉 https://github.com/dvsRCalejo/SkillWright

What it is

SkillWright is not a chatbot. Think of it as a procurement function — but for behavior, not software.

Give it a topic. It goes out to public GitHub, finds candidate skills, reads them, judges whether each one is actually useful, and — for the ones I approve — installs them as business skills in Dataverse. From that moment on, every agent connected to the Dataverse MCP server can discover and use them. No rebuild. No redeploy. Update the skill once, and every agent that picks it up next gets the new version.

It’s authored entirely in Copilot Studio, source-controlled with the skills-for-copilot-studio VS Code tooling, and shipped as a normal solution. No custom hosting, no glue code.

What it needs to run

I want to be honest about the platform floor here, because SkillWright leans on it:

• A Managed Environment in Power Platform (for governance and policy).
• Dataverse Intelligence enabled — this is what unlocks business skills as a first-class concept.
• Dataverse MCP Server (preview) available in the environment.
• A GitHub custom connector (the one in the repo, defined by a Swagger file), authenticated with a fine-grained PAT scoped to read public repo contents.

If any of those are missing, the agent will still load, but creation calls will fail — and rightly so. The governance layer is the point.

How it works

There are three moving parts, and I deliberately kept each one boring.

Discovery is a custom GitHub connector with a small, surgical set of operations: search code, search repos, get a repo, get a tree, get a blob. The agent’s go-to query is filename:SKILL.md — every result whose path ends in /SKILL.md is, by convention, one skill. For folder-based skills it walks the tree recursively and pulls each file as a base64 blob.

Vetting is where the agent earns its keep. It fetches the candidate SKILL.md, decodes it, parses the name and description (which can live in YAML frontmatter or a markdown table — both are out there in the wild), and judges it against the bar I care about for business skills: clear trigger phrases, numbered step-by-step instructions, concrete examples, troubleshooting notes. Skills that turn out to be developer tasks in disguise — a scripts/ folder, a tool wrapper, something that only makes sense if you also have a shell and three CLIs installed — get flagged with a reason before I commit.

Install is one call to the Dataverse MCP server, which creates the approved skill as a business skill — name, description, instructions, and any references/ files attached as Resources. No custom storage layer, no bespoke schema, no form to fill in. Honestly, it’s easier for the agent to create a well-formed business skill than it is for me to do it by hand in the maker portal — it already has the parsed content in front of it, knows the shape Dataverse expects, and just submits it. And critically: nothing is installed without an explicit confirmation from me.

The bit I find genuinely interesting

Here’s the insight that made the whole thing click: Agent Skills and Dataverse business skills use the same format. Same shape. Same semantics. Same SKILL.md.

That sounds like a small technical detail. It isn’t. It means the open skill ecosystem on GitHub and the governed enterprise skill layer in Dataverse aren’t two different worlds that need translation between them — they’re the same world with a border crossing in the middle. SkillWright is the border crossing.

There’s a second, weirder consequence — and this is the one I keep coming back to. The Dataverse MCP server doesn’t just write business skills; it also reads them. So the moment SkillWright finishes installing one, any other Copilot Studio agent connected to that same MCP server can see it, pick it up, and act on it on its next turn. No re-publish. No “add a skill to this agent” step. No coordination between maker and consumer. One agent installs, every other agent benefits — automatically.

That includes SkillWright itself. The very same agent that just installed a skill can immediately turn around and use it. The first time I watched it install a skill and then, in the next turn, behave according to that skill, I felt like I’d quietly crossed a line.

Why I think this matters

Reuse. Most of the skills any given business needs have already been written by someone on the internet. Hand-authoring them again is wasteful. Sourcing them — with judgment — is not.

Governance without lock-in. The enterprise gets approval, audit, identity, and a single place to manage what agents are allowed to know. The community gets the open SKILL.md format, no proprietary fork. Nobody has to give anything up.

Runtime discovery beats redeployment. Once a skill lives in Dataverse, every connected agent finds it on its own — no code change, no release, no per-agent wiring. That’s a very different operating model from “ship a new agent.”

Where this goes next

I’m now thinking less about SkillWright itself and more about what changes when skill curation becomes a job an agent can do. If sourcing skills is cheap and governed, the constraint on agent capability stops being “what did we build” and starts being “what did we choose to admit.” That’s a much more interesting constraint.

If you want to poke at it, fork it, or break it — the repo is here: https://github.com/dvsRCalejo/SkillWright

Which makes me wonder — and this is the real question I’d love your take on:

If your agents could quietly pick up new skills from the public internet, vetted but not authored by you, would you let them? And where exactly would you draw the line?

#CopilotStudio #PowerPlatform #Dataverse #MCP #AgentSkills