From 325f172e1297f04ab16520c2a20624f3ef2549be Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Wed, 3 Jun 2026 23:09:20 +0000
Subject: [PATCH 01/14] Initial plan


From b55961bc65282feb6dffa1eeed44950df9b65b1b Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Wed, 3 Jun 2026 23:20:33 +0000
Subject: [PATCH 02/14] feat: add workflow-designer skill and route it in
 agentic-workflows router

Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>
---
 .github/aw/workflow-designer.md               | 225 ++++++++++++++++++
 .github/skills/agentic-workflows/SKILL.md     |   6 +-
 pkg/cli/copilot_agents_test.go                |   2 +
 .../agentic_workflows_fallback_aw_files.json  |   1 +
 pkg/cli/data/agentic_workflows_skill.md       |   5 +-
 5 files changed, 235 insertions(+), 4 deletions(-)
 create mode 100644 .github/aw/workflow-designer.md

diff --git a/.github/aw/workflow-designer.md b/.github/aw/workflow-designer.md
new file mode 100644
index 00000000000..1026a9d9b95
--- /dev/null
+++ b/.github/aw/workflow-designer.md
@@ -0,0 +1,225 @@
+---
+name: workflow-designer
+description: Conversational skill that interviews users to design new agentic workflows
+disable-model-invocation: true
+---
+
+# Workflow Designer
+
+Use this skill to run a structured interview with users who know their goal but not the workflow syntax yet, then generate one complete workflow `.md` file.
+
+## When to Use This Skill
+
+Use this before `create-agentic-workflow.md` when requirements are unclear or incomplete.
+
+- Use `workflow-designer.md` to discover and confirm requirements.
+- Use `create-agentic-workflow.md` once requirements are clear and ready for implementation.
+- Use `agentic-chat.md` when the user wants a specification/pseudo-code instead of a runnable workflow file.
+
+## Interview Framework
+
+Ask one question at a time. Move to the next phase only after the current phase is clear.
+
+### Phase 1: Goal
+
+Ask: **"What do you want to automate?"**
+
+Capture:
+- Workflow name (kebab-case candidate)
+- Brief description
+- Optional emoji
+
+### Phase 2: Trigger
+
+Ask: **"When should this run?"**
+
+Follow up only if needed:
+- Which event type(s)?
+- Any filters (labels, branches, commands)?
+- Scheduled cadence (daily/weekly/hourly)?
+
+Map to the `on:` block.
+
+### Phase 3: Scope (Read/Write)
+
+Ask:
+- **"What should it read?"** (issues, PRs, code, discussions, CI data)
+- **"What should it create or update?"** (comments, issues, PRs, labels)
+
+Map to:
+- `permissions:` (keep read-only for agent job)
+- `tools:`
+- `safe-outputs:`
+
+### Phase 4: Guardrails
+
+Ask: **"Should it block merging, just advise, or silently log?"**
+
+Capture:
+- Visibility expectations (comment, issue, no visible output)
+- No-op behavior expectation
+
+Guide toward safe output behavior and explicit `noop` instructions.
+
+### Phase 5: Context & Network
+
+Ask: **"Does it need external APIs, web access, or package installs?"**
+
+Follow up for exact external domains (FQDN/wildcard).
+
+Map to:
+- `network.allowed`
+- Optional MCP/GitHub tool usage in `tools:`
+
+### Phase 6: Engine (optional)
+
+Ask only if ambiguous: **"Any AI engine preference?"**
+
+If no preference, suggest default:
+- "I'd suggest Copilot since you haven't mentioned a preference. Sound good?"
+
+Map to `engine:` only when not default.
+
+### Phase 7: Confirmation
+
+Present a structured summary and ask for approval before generation.
+
+## Decision Heuristics
+
+### Trigger Mapping
+
+| User says... | Maps to |
+|---|---|
+| "when someone opens a PR" | `on: pull_request:` with `types: [opened]` |
+| "when a PR is updated" | `on: pull_request:` with `types: [opened, synchronize]` |
+| "every morning", "daily" | fuzzy `on: schedule: daily` |
+| "every Monday", "weekly" | fuzzy `on: schedule: weekly` |
+| "when I say /review" | `on: slash_command:` with `name: review` (or requested command) |
+| "when an issue is labeled bug" | `on: issues:` with `types: [labeled]` and label filter guidance |
+| "manually", "on demand" | `on: workflow_dispatch:` |
+| "when a deployment fails" | `on: deployment_status:` |
+| "when another workflow finishes" | `on: workflow_run:` |
+
+### Safe Output Mapping
+
+| User says... | Maps to |
+|---|---|
+| "post a comment" | `add-comment` |
+| "create an issue" | `create-issue` |
+| "open a PR", "submit changes" | `create-pull-request` |
+| "add labels" | `add-labels` |
+| "remove labels" | `remove-labels` |
+| "close the issue" | `close-issue` |
+| "assign someone" | `assign-to-user` |
+| "nothing visible", "just analyze" | no safe outputs required |
+
+### Network Mapping
+
+| User says... | Maps to |
+|---|---|
+| "calls an external API" | ask for exact FQDN/wildcard, then add to `network.allowed` |
+| "installs npm packages" | include `node` in `network.allowed` |
+| "runs pip install" | include `python` in `network.allowed` |
+| "builds Go code" | include `go` in `network.allowed` |
+| "no external access" | `network.allowed: [defaults]` (or `[]` if explicitly zero network) |
+
+### Tool Mapping
+
+| User says... | Maps to |
+|---|---|
+| "read GitHub issues/PRs/workflows" | `tools.github` with `mode: gh-proxy` and minimal `toolsets` |
+| "edit files" | `edit` tool (default unless restricted) |
+| "run commands/tests" | `bash` tool (default unless restricted) |
+| "browse web pages/docs" | `web-fetch` and/or `web-search` |
+| "test UI flows" | `playwright` |
+
+## Progressive Disclosure Rules
+
+1. Never dump all options at once; ask one targeted question at a time.
+2. Skip questions when answers are inferable from prior user statements.
+3. Offer smart defaults and request confirmation instead of over-questioning.
+4. Ask at most 5 questions before presenting a summary; then ask "anything else?" if needed.
+5. Detect done signals (`that's it`, `looks good`, `generate it`) and proceed to generation.
+
+## Confirmation Format
+
+Use this exact structure:
+
+```text
+📋 Proposed workflow:
+- Name: <workflow-id>
+- Trigger: <event + key options>
+- Engine: <engine or default>
+- Tools: <tool summary>
+- Safe outputs: <list or none>
+- Network: <allowed summary>
+- Intent: <one-sentence task>
+```
+
+Then ask: **"Ready to generate, or want to adjust anything?"**
+
+## Generation Template
+
+After confirmation, generate one workflow file using the same skeleton style as `create-agentic-workflow.md`.
+
+```markdown
+---
+emoji: <emoji>
+description: <brief description>
+on:
+  <trigger config>
+permissions:
+  contents: read
+  issues: read
+  pull-requests: read
+tools:
+  github:
+    mode: gh-proxy
+    toolsets: [default]
+safe-outputs:
+  <safe-output-types-if-needed>
+network:
+  allowed:
+    - defaults
+    - <additional entries if needed>
+---
+
+# <Workflow Name>
+
+## Task
+
+<clear instructions tied to trigger context>
+
+## Safe Outputs
+
+- Use configured safe outputs for all visible write actions.
+- Call `noop` with a short reason when no action is needed.
+```
+
+## Validation Checklist
+
+Before final output, verify:
+
+- [ ] Agent job permissions remain read-only (writes only via safe outputs)
+- [ ] `safe-outputs:` covers every write action mentioned in prompt/instructions
+- [ ] Network access is scoped; avoid blanket wildcard entries
+- [ ] Trigger matches the user's intended activation event
+- [ ] Prompt instructs agent to call `noop` when no action is needed
+- [ ] Unnecessary defaults are omitted (for example `engine: copilot`)
+
+## References (load only when needed)
+
+In-repo references:
+- `.github/aw/syntax.md`
+- `.github/aw/safe-outputs.md`
+- `.github/aw/network.md`
+- `.github/aw/patterns.md`
+- `.github/aw/triggers.md`
+- `.github/aw/create-agentic-workflow.md`
+
+Portable HTTPS references:
+- `https://github.com/github/gh-aw/blob/main/.github/aw/syntax.md`
+- `https://github.com/github/gh-aw/blob/main/.github/aw/safe-outputs.md`
+- `https://github.com/github/gh-aw/blob/main/.github/aw/network.md`
+- `https://github.com/github/gh-aw/blob/main/.github/aw/patterns.md`
+- `https://github.com/github/gh-aw/blob/main/.github/aw/triggers.md`
diff --git a/.github/skills/agentic-workflows/SKILL.md b/.github/skills/agentic-workflows/SKILL.md
index 623b3db448e..10fec7137bb 100644
--- a/.github/skills/agentic-workflows/SKILL.md
+++ b/.github/skills/agentic-workflows/SKILL.md
@@ -1,11 +1,11 @@
 ---
 name: agentic-workflows
-description: Route gh-aw workflow create/debug/upgrade requests to the right prompts.
+description: Route gh-aw workflow design/create/debug/upgrade requests to the right prompts.
 ---
 
 # Agentic Workflows Router
 
-Use this skill when a user asks to create, update, debug, or upgrade GitHub Agentic Workflows in this repository.
+Use this skill when a user asks to design, create, update, debug, or upgrade GitHub Agentic Workflows in this repository.
 
 This skill is a dispatcher: identify the task type, load the matching `.github/aw/*.md` file, and follow it directly. Keep responses concise and ask a clarifying question if the correct prompt is unclear.
 
@@ -55,10 +55,12 @@ Load these files from `github/gh-aw` (they are not available locally).
 - `.github/aw/upgrade-agentic-workflows.md`
 - `.github/aw/visual-regression.md`
 - `.github/aw/workflow-constraints.md`
+- `.github/aw/workflow-designer.md`
 - `.github/aw/workflow-editing.md`
 - `.github/aw/workflow-patterns.md`
 
 After loading the matching workflow prompt, follow it directly:
+- Design workflows from scratch via interview: `.github/aw/workflow-designer.md`
 - Create new workflows: `.github/aw/create-agentic-workflow.md`
 - Update existing workflows: `.github/aw/update-agentic-workflow.md`
 - Debug, audit, or investigate workflows: `.github/aw/debug-agentic-workflow.md`
diff --git a/pkg/cli/copilot_agents_test.go b/pkg/cli/copilot_agents_test.go
index 9f80098cdba..fb525079d54 100644
--- a/pkg/cli/copilot_agents_test.go
+++ b/pkg/cli/copilot_agents_test.go
@@ -339,6 +339,7 @@ func TestBuildAgenticWorkflowsSkillContent(t *testing.T) {
 	if strings.Contains(content, ".github/agents/agentic-workflows") {
 		t.Fatalf("expected generated skill content to avoid agent cross-references:\n%s", content)
 	}
+	assert.Contains(t, content, "Design workflows from scratch via interview: `.github/aw/workflow-designer.md`")
 }
 
 func TestBuildAgenticWorkflowsSkillContentWithoutAWDirectory(t *testing.T) {
@@ -369,6 +370,7 @@ func TestBuildAgenticWorkflowsSkillContentFallsBackToEmbeddedFileList(t *testing
 
 	assert.NotContains(t, content, agenticWorkflowsSkillFileListPlaceholder, "expected generated skill content to replace the file-list placeholder")
 	assert.Contains(t, content, "- `.github/aw/create-agentic-workflow.md`\n", "expected embedded fallback markdown file list to be used")
+	assert.Contains(t, content, "- `.github/aw/workflow-designer.md`\n", "expected embedded fallback markdown file list to include workflow-designer")
 }
 
 func TestCheckedInAgenticWorkflowsSkillMatchesGeneratedContent(t *testing.T) {
diff --git a/pkg/cli/data/agentic_workflows_fallback_aw_files.json b/pkg/cli/data/agentic_workflows_fallback_aw_files.json
index 0380769da71..d6d35dc3ff9 100644
--- a/pkg/cli/data/agentic_workflows_fallback_aw_files.json
+++ b/pkg/cli/data/agentic_workflows_fallback_aw_files.json
@@ -42,6 +42,7 @@
   "update-agentic-workflow.md",
   "upgrade-agentic-workflows.md",
   "visual-regression.md",
+  "workflow-designer.md",
   "workflow-constraints.md",
   "workflow-editing.md",
   "workflow-patterns.md"
diff --git a/pkg/cli/data/agentic_workflows_skill.md b/pkg/cli/data/agentic_workflows_skill.md
index 5159ad31e33..220155c1f49 100644
--- a/pkg/cli/data/agentic_workflows_skill.md
+++ b/pkg/cli/data/agentic_workflows_skill.md
@@ -1,11 +1,11 @@
 ---
 name: agentic-workflows
-description: Route gh-aw workflow create/debug/upgrade requests to the right prompts.
+description: Route gh-aw workflow design/create/debug/upgrade requests to the right prompts.
 ---
 
 # Agentic Workflows Router
 
-Use this skill when a user asks to create, update, debug, or upgrade GitHub Agentic Workflows in this repository.
+Use this skill when a user asks to design, create, update, debug, or upgrade GitHub Agentic Workflows in this repository.
 
 This skill is a dispatcher: identify the task type, load the matching `.github/aw/*.md` file, and follow it directly. Keep responses concise and ask a clarifying question if the correct prompt is unclear.
 
@@ -13,6 +13,7 @@ Read only the files you need:
 Load these files from `github/gh-aw` (they are not available locally).
 {{AW_FILE_LIST}}
 After loading the matching workflow prompt, follow it directly:
+- Design workflows from scratch via interview: `.github/aw/workflow-designer.md`
 - Create new workflows: `.github/aw/create-agentic-workflow.md`
 - Update existing workflows: `.github/aw/update-agentic-workflow.md`
 - Debug, audit, or investigate workflows: `.github/aw/debug-agentic-workflow.md`

From 8feaadf46b094aa5963afdb3dfc368c26602675a Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Wed, 3 Jun 2026 23:21:42 +0000
Subject: [PATCH 03/14] docs: clarify workflow-designer guidance wording

Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>
---
 .github/aw/workflow-designer.md | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/.github/aw/workflow-designer.md b/.github/aw/workflow-designer.md
index 1026a9d9b95..bee1658ccb1 100644
--- a/.github/aw/workflow-designer.md
+++ b/.github/aw/workflow-designer.md
@@ -14,7 +14,7 @@ Use this before `create-agentic-workflow.md` when requirements are unclear or in
 
 - Use `workflow-designer.md` to discover and confirm requirements.
 - Use `create-agentic-workflow.md` once requirements are clear and ready for implementation.
-- Use `agentic-chat.md` when the user wants a specification/pseudo-code instead of a runnable workflow file.
+- Use `.github/aw/agentic-chat.md` when the user wants a specification/pseudo-code instead of a runnable workflow file.
 
 ## Interview Framework
 
@@ -92,8 +92,8 @@ Present a structured summary and ask for approval before generation.
 |---|---|
 | "when someone opens a PR" | `on: pull_request:` with `types: [opened]` |
 | "when a PR is updated" | `on: pull_request:` with `types: [opened, synchronize]` |
-| "every morning", "daily" | fuzzy `on: schedule: daily` |
-| "every Monday", "weekly" | fuzzy `on: schedule: weekly` |
+| "every morning", "daily" | fuzzy schedule shorthand `on: schedule: daily` (compiler expands to cron) |
+| "every Monday", "weekly" | fuzzy schedule shorthand `on: schedule: weekly` (compiler expands to cron) |
 | "when I say /review" | `on: slash_command:` with `name: review` (or requested command) |
 | "when an issue is labeled bug" | `on: issues:` with `types: [labeled]` and label filter guidance |
 | "manually", "on demand" | `on: workflow_dispatch:` |
@@ -198,7 +198,7 @@ network:
 
 ## Validation Checklist
 
-Before final output, verify:
+Before final output, run this internal self-check:
 
 - [ ] Agent job permissions remain read-only (writes only via safe outputs)
 - [ ] `safe-outputs:` covers every write action mentioned in prompt/instructions

From a7670128c7cf102f9ada432c4120ac2d5a749b13 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Wed, 3 Jun 2026 23:42:38 +0000
Subject: [PATCH 04/14] Plan comment follow-up work

Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>
---
 .github/skills/agentic-workflows/SKILL.md | 1 -
 1 file changed, 1 deletion(-)

diff --git a/.github/skills/agentic-workflows/SKILL.md b/.github/skills/agentic-workflows/SKILL.md
index 10fec7137bb..7ec2802be8d 100644
--- a/.github/skills/agentic-workflows/SKILL.md
+++ b/.github/skills/agentic-workflows/SKILL.md
@@ -55,7 +55,6 @@ Load these files from `github/gh-aw` (they are not available locally).
 - `.github/aw/upgrade-agentic-workflows.md`
 - `.github/aw/visual-regression.md`
 - `.github/aw/workflow-constraints.md`
-- `.github/aw/workflow-designer.md`
 - `.github/aw/workflow-editing.md`
 - `.github/aw/workflow-patterns.md`
 

From 2029114de095396e547a23dc1e3f607a1667f5b3 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Wed, 3 Jun 2026 23:49:30 +0000
Subject: [PATCH 05/14] Integrate token-efficiency addendum into
 workflow-designer guidance

Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>
---
 .github/aw/workflow-designer.md           | 53 +++++++++++++++++++++--
 .github/skills/agentic-workflows/SKILL.md |  1 +
 2 files changed, 50 insertions(+), 4 deletions(-)

diff --git a/.github/aw/workflow-designer.md b/.github/aw/workflow-designer.md
index bee1658ccb1..059dae4e55a 100644
--- a/.github/aw/workflow-designer.md
+++ b/.github/aw/workflow-designer.md
@@ -51,7 +51,20 @@ Map to:
 - `tools:`
 - `safe-outputs:`
 
-### Phase 4: Guardrails
+### Phase 4: Data Strategy
+
+Ask: **"What data does the agent need to make decisions? Can we pre-fetch and aggregate it with shell commands so the agent only reads compact JSON?"**
+
+Capture:
+- Whether `steps:` should pre-fetch GitHub data with `gh` + `jq`
+- Output paths under `/tmp/gh-aw/data/`
+- Whether batch work should use sub-agents
+
+Map to:
+- `steps:`
+- Prompt references to pre-computed file paths
+
+### Phase 5: Guardrails
 
 Ask: **"Should it block merging, just advise, or silently log?"**
 
@@ -61,7 +74,7 @@ Capture:
 
 Guide toward safe output behavior and explicit `noop` instructions.
 
-### Phase 5: Context & Network
+### Phase 6: Context & Network
 
 Ask: **"Does it need external APIs, web access, or package installs?"**
 
@@ -71,7 +84,7 @@ Map to:
 - `network.allowed`
 - Optional MCP/GitHub tool usage in `tools:`
 
-### Phase 6: Engine (optional)
+### Phase 7: Engine (optional)
 
 Ask only if ambiguous: **"Any AI engine preference?"**
 
@@ -80,7 +93,7 @@ If no preference, suggest default:
 
 Map to `engine:` only when not default.
 
-### Phase 7: Confirmation
+### Phase 8: Confirmation
 
 Present a structured summary and ask for approval before generation.
 
@@ -133,6 +146,25 @@ Present a structured summary and ask for approval before generation.
 | "browse web pages/docs" | `web-fetch` and/or `web-search` |
 | "test UI flows" | `playwright` |
 
+### Data Strategy Mapping
+
+| User says... | Maps to |
+|---|---|
+| "analyze PRs", "review issues", "check status" | add `steps:` that pre-fetch with `gh` + `jq` |
+| "read the diff", "look at changed files" | add `steps:` using `gh pr diff` or `gh pr view --json files` |
+| "search for patterns across repos" | add `steps:` using `gh search` + `jq` filters |
+| "just respond to a comment" | no pre-fetch needed (event payload is enough) |
+| "process each item individually" | suggest sub-agent pattern with `model: small` |
+
+## Token Optimization Defaults
+
+Apply these defaults unless the user explicitly asks otherwise:
+
+1. Use DataOps by default for GitHub reads: pre-fetch with `gh` + `jq` in `steps:`, store compact JSON in `/tmp/gh-aw/data/`, and point the prompt to those files.
+2. Keep tool surface minimal: default to `tools.github.mode: gh-proxy`, include only required toolsets, and prefer `bash` + `gh` for simple reads.
+3. For batch workloads, split items into compact data and suggest sub-agent processing with `model: small`.
+4. Keep prompts compact: concise imperative instructions, explicit file paths, single-line `noop` guidance, and stable instructions before dynamic content.
+
 ## Progressive Disclosure Rules
 
 1. Never dump all options at once; ask one targeted question at a time.
@@ -176,6 +208,11 @@ tools:
   github:
     mode: gh-proxy
     toolsets: [default]
+steps:
+  - name: <optional data prefetch>
+    run: |
+      mkdir -p /tmp/gh-aw/data
+      <gh + jq commands that produce compact JSON>
 safe-outputs:
   <safe-output-types-if-needed>
 network:
@@ -189,6 +226,7 @@ network:
 ## Task
 
 <clear instructions tied to trigger context>
+Use pre-fetched data files from `/tmp/gh-aw/data/` when available instead of re-fetching broadly.
 
 ## Safe Outputs
 
@@ -206,6 +244,11 @@ Before final output, run this internal self-check:
 - [ ] Trigger matches the user's intended activation event
 - [ ] Prompt instructs agent to call `noop` when no action is needed
 - [ ] Unnecessary defaults are omitted (for example `engine: copilot`)
+- [ ] If reading GitHub data, `steps:` pre-fetches compact JSON (DataOps)
+- [ ] `tools.github.mode` is `gh-proxy` unless broader MCP toolsets are explicitly needed
+- [ ] Only required toolsets are listed (avoid blanket toolset lists)
+- [ ] Prompt references specific pre-computed file paths
+- [ ] For batch processing (>5 items), sub-agent pattern is suggested
 
 ## References (load only when needed)
 
@@ -214,6 +257,8 @@ In-repo references:
 - `.github/aw/safe-outputs.md`
 - `.github/aw/network.md`
 - `.github/aw/patterns.md`
+- `.github/aw/subagents.md`
+- `.github/aw/token-optimization.md`
 - `.github/aw/triggers.md`
 - `.github/aw/create-agentic-workflow.md`
 
diff --git a/.github/skills/agentic-workflows/SKILL.md b/.github/skills/agentic-workflows/SKILL.md
index 7ec2802be8d..10fec7137bb 100644
--- a/.github/skills/agentic-workflows/SKILL.md
+++ b/.github/skills/agentic-workflows/SKILL.md
@@ -55,6 +55,7 @@ Load these files from `github/gh-aw` (they are not available locally).
 - `.github/aw/upgrade-agentic-workflows.md`
 - `.github/aw/visual-regression.md`
 - `.github/aw/workflow-constraints.md`
+- `.github/aw/workflow-designer.md`
 - `.github/aw/workflow-editing.md`
 - `.github/aw/workflow-patterns.md`
 

From 9be219782fd0c9099af0f99318dccb12ef3a9a4d Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Wed, 3 Jun 2026 23:50:22 +0000
Subject: [PATCH 06/14] Refine workflow-designer token-efficiency guidance

Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>
---
 .github/aw/workflow-designer.md | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/.github/aw/workflow-designer.md b/.github/aw/workflow-designer.md
index 059dae4e55a..3e8ee1c0ba5 100644
--- a/.github/aw/workflow-designer.md
+++ b/.github/aw/workflow-designer.md
@@ -53,7 +53,9 @@ Map to:
 
 ### Phase 4: Data Strategy
 
-Ask: **"What data does the agent need to make decisions? Can we pre-fetch and aggregate it with shell commands so the agent only reads compact JSON?"**
+Ask:
+- **"What data does the agent need to make decisions?"**
+- Follow up: **"Can we pre-fetch and aggregate that data with shell commands so the agent only reads compact JSON?"**
 
 Capture:
 - Whether `steps:` should pre-fetch GitHub data with `gh` + `jq`
@@ -160,7 +162,7 @@ Present a structured summary and ask for approval before generation.
 
 Apply these defaults unless the user explicitly asks otherwise:
 
-1. Use DataOps by default for GitHub reads: pre-fetch with `gh` + `jq` in `steps:`, store compact JSON in `/tmp/gh-aw/data/`, and point the prompt to those files.
+1. Use DataOps by default for GitHub reads: pre-fetch/aggregate with `gh` + `jq` in `steps:`, store compact JSON in `/tmp/gh-aw/data/`, and point the prompt to those files (see `.github/aw/token-optimization.md` for details).
 2. Keep tool surface minimal: default to `tools.github.mode: gh-proxy`, include only required toolsets, and prefer `bash` + `gh` for simple reads.
 3. For batch workloads, split items into compact data and suggest sub-agent processing with `model: small`.
 4. Keep prompts compact: concise imperative instructions, explicit file paths, single-line `noop` guidance, and stable instructions before dynamic content.
@@ -226,7 +228,7 @@ network:
 ## Task
 
 <clear instructions tied to trigger context>
-Use pre-fetched data files from `/tmp/gh-aw/data/` when available instead of re-fetching broadly.
+If `steps:` includes pre-fetch commands, read the resulting `/tmp/gh-aw/data/*.json` files instead of broad live re-fetches.
 
 ## Safe Outputs
 

From a221c4833d7c3df7fe25ef6b9b823b2820d7067f Mon Sep 17 00:00:00 2001
From: Landon Cox <landon.cox@microsoft.com>
Date: Wed, 3 Jun 2026 16:51:17 -0700
Subject: [PATCH 07/14] Potential fix for pull request finding

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
---
 .github/skills/agentic-workflows/SKILL.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/skills/agentic-workflows/SKILL.md b/.github/skills/agentic-workflows/SKILL.md
index 10fec7137bb..08c0f7f8db2 100644
--- a/.github/skills/agentic-workflows/SKILL.md
+++ b/.github/skills/agentic-workflows/SKILL.md
@@ -56,6 +56,7 @@ Load these files from `github/gh-aw` (they are not available locally).
 - `.github/aw/visual-regression.md`
 - `.github/aw/workflow-constraints.md`
 - `.github/aw/workflow-designer.md`
+- `.github/aw/workflow-designer.md`
 - `.github/aw/workflow-editing.md`
 - `.github/aw/workflow-patterns.md`
 

From e19fee0e51551119331ebfcec03860fc7d6a2b40 Mon Sep 17 00:00:00 2001
From: Landon Cox <landon.cox@microsoft.com>
Date: Wed, 3 Jun 2026 16:51:34 -0700
Subject: [PATCH 08/14] Potential fix for pull request finding

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
---
 .github/aw/workflow-designer.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/aw/workflow-designer.md b/.github/aw/workflow-designer.md
index 3e8ee1c0ba5..5fe6bf3d0fd 100644
--- a/.github/aw/workflow-designer.md
+++ b/.github/aw/workflow-designer.md
@@ -107,7 +107,7 @@ Present a structured summary and ask for approval before generation.
 |---|---|
 | "when someone opens a PR" | `on: pull_request:` with `types: [opened]` |
 | "when a PR is updated" | `on: pull_request:` with `types: [opened, synchronize]` |
-| "every morning", "daily" | fuzzy schedule shorthand `on: schedule: daily` (compiler expands to cron) |
+| "every morning", "daily" | fuzzy schedule shorthand `on: schedule: daily on weekdays` (compiler expands to cron) |
 | "every Monday", "weekly" | fuzzy schedule shorthand `on: schedule: weekly` (compiler expands to cron) |
 | "when I say /review" | `on: slash_command:` with `name: review` (or requested command) |
 | "when an issue is labeled bug" | `on: issues:` with `types: [labeled]` and label filter guidance |

From 830e8500e68b50a0738e8d8a6c27163bfd4c251e Mon Sep 17 00:00:00 2001
From: Landon Cox <landon.cox@microsoft.com>
Date: Wed, 3 Jun 2026 16:51:45 -0700
Subject: [PATCH 09/14] Potential fix for pull request finding

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
---
 .github/aw/workflow-designer.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/aw/workflow-designer.md b/.github/aw/workflow-designer.md
index 5fe6bf3d0fd..3ee434a9122 100644
--- a/.github/aw/workflow-designer.md
+++ b/.github/aw/workflow-designer.md
@@ -270,3 +270,4 @@ Portable HTTPS references:
 - `https://github.com/github/gh-aw/blob/main/.github/aw/network.md`
 - `https://github.com/github/gh-aw/blob/main/.github/aw/patterns.md`
 - `https://github.com/github/gh-aw/blob/main/.github/aw/triggers.md`
+- `https://github.com/github/gh-aw/blob/main/.github/aw/create-agentic-workflow.md`

From 1aa09353106e0dfed79f601a993eea95be2cbfad Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Thu, 4 Jun 2026 00:16:04 +0000
Subject: [PATCH 10/14] Fix duplicate workflow-designer entry in checked-in
 skill

Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>
---
 .github/skills/agentic-workflows/SKILL.md | 1 -
 1 file changed, 1 deletion(-)

diff --git a/.github/skills/agentic-workflows/SKILL.md b/.github/skills/agentic-workflows/SKILL.md
index 08c0f7f8db2..10fec7137bb 100644
--- a/.github/skills/agentic-workflows/SKILL.md
+++ b/.github/skills/agentic-workflows/SKILL.md
@@ -56,7 +56,6 @@ Load these files from `github/gh-aw` (they are not available locally).
 - `.github/aw/visual-regression.md`
 - `.github/aw/workflow-constraints.md`
 - `.github/aw/workflow-designer.md`
-- `.github/aw/workflow-designer.md`
 - `.github/aw/workflow-editing.md`
 - `.github/aw/workflow-patterns.md`
 

From a9462c632abc63cbf22d46e2d258bee34c23d93f Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Thu, 4 Jun 2026 00:25:39 +0000
Subject: [PATCH 11/14] Move workflow-designer to .github/skills and update
 routing

---
 .github/skills/agentic-workflows/SKILL.md              | 10 +++++-----
 .../workflow-designer/SKILL.md}                        |  8 ++++----
 pkg/cli/copilot_agents_test.go                         |  4 ++--
 pkg/cli/data/agentic_workflows_fallback_aw_files.json  |  1 -
 pkg/cli/data/agentic_workflows_skill.md                |  9 +++++----
 5 files changed, 16 insertions(+), 16 deletions(-)
 rename .github/{aw/workflow-designer.md => skills/workflow-designer/SKILL.md} (96%)

diff --git a/.github/skills/agentic-workflows/SKILL.md b/.github/skills/agentic-workflows/SKILL.md
index 10fec7137bb..806a68e0fae 100644
--- a/.github/skills/agentic-workflows/SKILL.md
+++ b/.github/skills/agentic-workflows/SKILL.md
@@ -7,7 +7,7 @@ description: Route gh-aw workflow design/create/debug/upgrade requests to the ri
 
 Use this skill when a user asks to design, create, update, debug, or upgrade GitHub Agentic Workflows in this repository.
 
-This skill is a dispatcher: identify the task type, load the matching `.github/aw/*.md` file, and follow it directly. Keep responses concise and ask a clarifying question if the correct prompt is unclear.
+This skill is a dispatcher: identify the task type, load the matching workflow prompt/skill file, and follow it directly. Keep responses concise and ask a clarifying question if the correct prompt is unclear.
 
 Read only the files you need:
 Load these files from `github/gh-aw` (they are not available locally).
@@ -55,12 +55,12 @@ Load these files from `github/gh-aw` (they are not available locally).
 - `.github/aw/upgrade-agentic-workflows.md`
 - `.github/aw/visual-regression.md`
 - `.github/aw/workflow-constraints.md`
-- `.github/aw/workflow-designer.md`
 - `.github/aw/workflow-editing.md`
 - `.github/aw/workflow-patterns.md`
 
-After loading the matching workflow prompt, follow it directly:
-- Design workflows from scratch via interview: `.github/aw/workflow-designer.md`
+- `.github/skills/workflow-designer/SKILL.md`
+After loading the matching workflow prompt or skill, follow it directly:
+- Design workflows from scratch via interview: `skills/workflow-designer/SKILL.md`
 - Create new workflows: `.github/aw/create-agentic-workflow.md`
 - Update existing workflows: `.github/aw/update-agentic-workflow.md`
 - Debug, audit, or investigate workflows: `.github/aw/debug-agentic-workflow.md`
@@ -74,4 +74,4 @@ After loading the matching workflow prompt, follow it directly:
 - Choose workflow architecture and patterns: `.github/aw/patterns.md`
 - Optimize token usage and cost: `.github/aw/token-optimization.md`
 
-When the task involves OTEL, OTLP, traces, observability backends, or telemetry-driven analysis, also read and follow `skills/otel-queries/SKILL.md` after loading the matching workflow prompt.
+When the task involves OTEL, OTLP, traces, observability backends, or telemetry-driven analysis, also read and follow `skills/otel-queries/SKILL.md` after loading the matching workflow prompt or skill.
diff --git a/.github/aw/workflow-designer.md b/.github/skills/workflow-designer/SKILL.md
similarity index 96%
rename from .github/aw/workflow-designer.md
rename to .github/skills/workflow-designer/SKILL.md
index 3ee434a9122..23cf98896dc 100644
--- a/.github/aw/workflow-designer.md
+++ b/.github/skills/workflow-designer/SKILL.md
@@ -10,10 +10,10 @@ Use this skill to run a structured interview with users who know their goal but
 
 ## When to Use This Skill
 
-Use this before `create-agentic-workflow.md` when requirements are unclear or incomplete.
+Use this before `.github/aw/create-agentic-workflow.md` when requirements are unclear or incomplete.
 
-- Use `workflow-designer.md` to discover and confirm requirements.
-- Use `create-agentic-workflow.md` once requirements are clear and ready for implementation.
+- Use `skills/workflow-designer/SKILL.md` to discover and confirm requirements.
+- Use `.github/aw/create-agentic-workflow.md` once requirements are clear and ready for implementation.
 - Use `.github/aw/agentic-chat.md` when the user wants a specification/pseudo-code instead of a runnable workflow file.
 
 ## Interview Framework
@@ -194,7 +194,7 @@ Then ask: **"Ready to generate, or want to adjust anything?"**
 
 ## Generation Template
 
-After confirmation, generate one workflow file using the same skeleton style as `create-agentic-workflow.md`.
+After confirmation, generate one workflow file using the same skeleton style as `.github/aw/create-agentic-workflow.md`.
 
 ```markdown
 ---
diff --git a/pkg/cli/copilot_agents_test.go b/pkg/cli/copilot_agents_test.go
index fb525079d54..4ca35363c51 100644
--- a/pkg/cli/copilot_agents_test.go
+++ b/pkg/cli/copilot_agents_test.go
@@ -339,7 +339,7 @@ func TestBuildAgenticWorkflowsSkillContent(t *testing.T) {
 	if strings.Contains(content, ".github/agents/agentic-workflows") {
 		t.Fatalf("expected generated skill content to avoid agent cross-references:\n%s", content)
 	}
-	assert.Contains(t, content, "Design workflows from scratch via interview: `.github/aw/workflow-designer.md`")
+	assert.Contains(t, content, "Design workflows from scratch via interview: `skills/workflow-designer/SKILL.md`")
 }
 
 func TestBuildAgenticWorkflowsSkillContentWithoutAWDirectory(t *testing.T) {
@@ -370,7 +370,7 @@ func TestBuildAgenticWorkflowsSkillContentFallsBackToEmbeddedFileList(t *testing
 
 	assert.NotContains(t, content, agenticWorkflowsSkillFileListPlaceholder, "expected generated skill content to replace the file-list placeholder")
 	assert.Contains(t, content, "- `.github/aw/create-agentic-workflow.md`\n", "expected embedded fallback markdown file list to be used")
-	assert.Contains(t, content, "- `.github/aw/workflow-designer.md`\n", "expected embedded fallback markdown file list to include workflow-designer")
+	assert.Contains(t, content, "- `.github/skills/workflow-designer/SKILL.md`\n", "expected generated skill content to include workflow-designer skill")
 }
 
 func TestCheckedInAgenticWorkflowsSkillMatchesGeneratedContent(t *testing.T) {
diff --git a/pkg/cli/data/agentic_workflows_fallback_aw_files.json b/pkg/cli/data/agentic_workflows_fallback_aw_files.json
index d6d35dc3ff9..0380769da71 100644
--- a/pkg/cli/data/agentic_workflows_fallback_aw_files.json
+++ b/pkg/cli/data/agentic_workflows_fallback_aw_files.json
@@ -42,7 +42,6 @@
   "update-agentic-workflow.md",
   "upgrade-agentic-workflows.md",
   "visual-regression.md",
-  "workflow-designer.md",
   "workflow-constraints.md",
   "workflow-editing.md",
   "workflow-patterns.md"
diff --git a/pkg/cli/data/agentic_workflows_skill.md b/pkg/cli/data/agentic_workflows_skill.md
index 220155c1f49..f69ea7f3dde 100644
--- a/pkg/cli/data/agentic_workflows_skill.md
+++ b/pkg/cli/data/agentic_workflows_skill.md
@@ -7,13 +7,14 @@ description: Route gh-aw workflow design/create/debug/upgrade requests to the ri
 
 Use this skill when a user asks to design, create, update, debug, or upgrade GitHub Agentic Workflows in this repository.
 
-This skill is a dispatcher: identify the task type, load the matching `.github/aw/*.md` file, and follow it directly. Keep responses concise and ask a clarifying question if the correct prompt is unclear.
+This skill is a dispatcher: identify the task type, load the matching workflow prompt/skill file, and follow it directly. Keep responses concise and ask a clarifying question if the correct prompt is unclear.
 
 Read only the files you need:
 Load these files from `github/gh-aw` (they are not available locally).
 {{AW_FILE_LIST}}
-After loading the matching workflow prompt, follow it directly:
-- Design workflows from scratch via interview: `.github/aw/workflow-designer.md`
+- `.github/skills/workflow-designer/SKILL.md`
+After loading the matching workflow prompt or skill, follow it directly:
+- Design workflows from scratch via interview: `skills/workflow-designer/SKILL.md`
 - Create new workflows: `.github/aw/create-agentic-workflow.md`
 - Update existing workflows: `.github/aw/update-agentic-workflow.md`
 - Debug, audit, or investigate workflows: `.github/aw/debug-agentic-workflow.md`
@@ -27,4 +28,4 @@ After loading the matching workflow prompt, follow it directly:
 - Choose workflow architecture and patterns: `.github/aw/patterns.md`
 - Optimize token usage and cost: `.github/aw/token-optimization.md`
 
-When the task involves OTEL, OTLP, traces, observability backends, or telemetry-driven analysis, also read and follow `skills/otel-queries/SKILL.md` after loading the matching workflow prompt.
+When the task involves OTEL, OTLP, traces, observability backends, or telemetry-driven analysis, also read and follow `skills/otel-queries/SKILL.md` after loading the matching workflow prompt or skill.

From ebe29e58cdae0a1386b04b2979b4c859f0291dc4 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Thu, 4 Jun 2026 01:38:43 +0000
Subject: [PATCH 12/14] Rename workflow designer skill and include it in init
 output

Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>
---
 .../SKILL.md                                  |   4 +-
 .github/skills/agentic-workflows/SKILL.md     |   4 +-
 pkg/cli/copilot_agents.go                     |  60 ++++
 pkg/cli/copilot_agents_test.go                |  21 +-
 .../data/agentic_workflow_designer_skill.md   | 273 ++++++++++++++++++
 pkg/cli/data/agentic_workflows_skill.md       |   4 +-
 pkg/cli/init.go                               |   7 +-
 pkg/cli/init_command.go                       |   1 +
 pkg/cli/init_command_test.go                  |  23 ++
 9 files changed, 388 insertions(+), 9 deletions(-)
 rename .github/skills/{workflow-designer => agentic-workflow-designer}/SKILL.md (98%)
 create mode 100644 pkg/cli/data/agentic_workflow_designer_skill.md

diff --git a/.github/skills/workflow-designer/SKILL.md b/.github/skills/agentic-workflow-designer/SKILL.md
similarity index 98%
rename from .github/skills/workflow-designer/SKILL.md
rename to .github/skills/agentic-workflow-designer/SKILL.md
index 23cf98896dc..eda4113606e 100644
--- a/.github/skills/workflow-designer/SKILL.md
+++ b/.github/skills/agentic-workflow-designer/SKILL.md
@@ -1,5 +1,5 @@
 ---
-name: workflow-designer
+name: agentic-workflow-designer
 description: Conversational skill that interviews users to design new agentic workflows
 disable-model-invocation: true
 ---
@@ -12,7 +12,7 @@ Use this skill to run a structured interview with users who know their goal but
 
 Use this before `.github/aw/create-agentic-workflow.md` when requirements are unclear or incomplete.
 
-- Use `skills/workflow-designer/SKILL.md` to discover and confirm requirements.
+- Use `skills/agentic-workflow-designer/SKILL.md` to discover and confirm requirements.
 - Use `.github/aw/create-agentic-workflow.md` once requirements are clear and ready for implementation.
 - Use `.github/aw/agentic-chat.md` when the user wants a specification/pseudo-code instead of a runnable workflow file.
 
diff --git a/.github/skills/agentic-workflows/SKILL.md b/.github/skills/agentic-workflows/SKILL.md
index 806a68e0fae..6bba5fae3d6 100644
--- a/.github/skills/agentic-workflows/SKILL.md
+++ b/.github/skills/agentic-workflows/SKILL.md
@@ -58,9 +58,9 @@ Load these files from `github/gh-aw` (they are not available locally).
 - `.github/aw/workflow-editing.md`
 - `.github/aw/workflow-patterns.md`
 
-- `.github/skills/workflow-designer/SKILL.md`
+- `.github/skills/agentic-workflow-designer/SKILL.md`
 After loading the matching workflow prompt or skill, follow it directly:
-- Design workflows from scratch via interview: `skills/workflow-designer/SKILL.md`
+- Design workflows from scratch via interview: `skills/agentic-workflow-designer/SKILL.md`
 - Create new workflows: `.github/aw/create-agentic-workflow.md`
 - Update existing workflows: `.github/aw/update-agentic-workflow.md`
 - Debug, audit, or investigate workflows: `.github/aw/debug-agentic-workflow.md`
diff --git a/pkg/cli/copilot_agents.go b/pkg/cli/copilot_agents.go
index 1842e2fce3d..79f3323af1e 100644
--- a/pkg/cli/copilot_agents.go
+++ b/pkg/cli/copilot_agents.go
@@ -33,6 +33,9 @@ var agenticWorkflowsSkillTemplate string
 //go:embed data/agentic_workflows_fallback_aw_files.json
 var agenticWorkflowsFallbackAWFiles string
 
+//go:embed data/agentic_workflow_designer_skill.md
+var agenticWorkflowDesignerSkillTemplate string
+
 var listAgenticWorkflowsMarkdownFiles = fetchAgenticWorkflowsMarkdownFiles
 
 // ensureAgenticWorkflowsDispatcher ensures that .github/skills/agentic-workflows/SKILL.md
@@ -101,6 +104,63 @@ func ensureAgenticWorkflowsDispatcher(verbose bool, skipInstructions bool) error
 	return nil
 }
 
+// ensureAgenticWorkflowDesignerSkill ensures that
+// .github/skills/agentic-workflow-designer/SKILL.md exists and matches the
+// bundled workflow designer skill content.
+func ensureAgenticWorkflowDesignerSkill(verbose bool, skipInstructions bool) error {
+	copilotAgentsLog.Print("Ensuring agentic workflow designer skill")
+
+	if skipInstructions {
+		copilotAgentsLog.Print("Skipping skill creation: instructions disabled")
+		return nil
+	}
+
+	gitRoot, err := gitutil.FindGitRoot()
+	if err != nil {
+		return err // Not in a git repository, skip
+	}
+
+	targetDir := filepath.Join(gitRoot, ".github", "skills", "agentic-workflow-designer")
+	targetPath := filepath.Join(targetDir, "SKILL.md")
+
+	if err := os.MkdirAll(targetDir, constants.DirPermPublic); err != nil {
+		return fmt.Errorf("failed to create .github/skills/agentic-workflow-designer directory: %w", err)
+	}
+
+	existingContent := ""
+	if content, err := os.ReadFile(targetPath); err == nil {
+		existingContent = string(content)
+	}
+
+	expectedContent := strings.TrimSpace(agenticWorkflowDesignerSkillTemplate)
+	if strings.TrimSpace(existingContent) == expectedContent {
+		copilotAgentsLog.Printf("Agentic workflow designer skill is up-to-date: %s", targetPath)
+		if verbose {
+			fmt.Fprintln(os.Stderr, console.FormatInfoMessage("Agentic workflow designer skill is up-to-date: "+targetPath))
+		}
+		return nil
+	}
+
+	if err := os.WriteFile(targetPath, []byte(agenticWorkflowDesignerSkillTemplate), constants.FilePermPublic); err != nil {
+		copilotAgentsLog.Printf("Failed to write agentic workflow designer skill: %s, error: %v", targetPath, err)
+		return fmt.Errorf("failed to write agentic workflow designer skill: %w", err)
+	}
+
+	if existingContent == "" {
+		copilotAgentsLog.Printf("Created agentic workflow designer skill: %s", targetPath)
+		if verbose {
+			fmt.Fprintln(os.Stderr, console.FormatSuccessMessage("Created agentic workflow designer skill: "+targetPath))
+		}
+	} else {
+		copilotAgentsLog.Printf("Updated agentic workflow designer skill: %s", targetPath)
+		if verbose {
+			fmt.Fprintln(os.Stderr, console.FormatSuccessMessage("Updated agentic workflow designer skill: "+targetPath))
+		}
+	}
+
+	return nil
+}
+
 // ensureAgenticWorkflowsAgent ensures that .github/agents/agentic-workflows.md contains the custom agent.
 func ensureAgenticWorkflowsAgent(verbose bool) error {
 	copilotAgentsLog.Print("Ensuring agentic workflows custom agent")
diff --git a/pkg/cli/copilot_agents_test.go b/pkg/cli/copilot_agents_test.go
index 4ca35363c51..6db75a430b9 100644
--- a/pkg/cli/copilot_agents_test.go
+++ b/pkg/cli/copilot_agents_test.go
@@ -339,7 +339,7 @@ func TestBuildAgenticWorkflowsSkillContent(t *testing.T) {
 	if strings.Contains(content, ".github/agents/agentic-workflows") {
 		t.Fatalf("expected generated skill content to avoid agent cross-references:\n%s", content)
 	}
-	assert.Contains(t, content, "Design workflows from scratch via interview: `skills/workflow-designer/SKILL.md`")
+	assert.Contains(t, content, "Design workflows from scratch via interview: `skills/agentic-workflow-designer/SKILL.md`")
 }
 
 func TestBuildAgenticWorkflowsSkillContentWithoutAWDirectory(t *testing.T) {
@@ -370,7 +370,24 @@ func TestBuildAgenticWorkflowsSkillContentFallsBackToEmbeddedFileList(t *testing
 
 	assert.NotContains(t, content, agenticWorkflowsSkillFileListPlaceholder, "expected generated skill content to replace the file-list placeholder")
 	assert.Contains(t, content, "- `.github/aw/create-agentic-workflow.md`\n", "expected embedded fallback markdown file list to be used")
-	assert.Contains(t, content, "- `.github/skills/workflow-designer/SKILL.md`\n", "expected generated skill content to include workflow-designer skill")
+	assert.Contains(t, content, "- `.github/skills/agentic-workflow-designer/SKILL.md`\n", "expected generated skill content to include agentic-workflow-designer skill")
+}
+
+func TestCheckedInAgenticWorkflowDesignerSkillMatchesEmbeddedTemplate(t *testing.T) {
+	_, file, _, ok := runtime.Caller(0)
+	if !ok {
+		t.Fatal("Failed to locate test file")
+	}
+
+	gitRoot := filepath.Clean(filepath.Join(filepath.Dir(file), "..", ".."))
+	actual, err := os.ReadFile(filepath.Join(gitRoot, ".github", "skills", "agentic-workflow-designer", "SKILL.md"))
+	if err != nil {
+		t.Fatalf("Failed to read checked-in workflow designer skill file: %v", err)
+	}
+
+	if strings.TrimSpace(string(actual)) != strings.TrimSpace(agenticWorkflowDesignerSkillTemplate) {
+		t.Fatalf("Checked-in workflow designer skill file is out of sync with embedded template\nexpected:\n%s\nactual:\n%s", agenticWorkflowDesignerSkillTemplate, string(actual))
+	}
 }
 
 func TestCheckedInAgenticWorkflowsSkillMatchesGeneratedContent(t *testing.T) {
diff --git a/pkg/cli/data/agentic_workflow_designer_skill.md b/pkg/cli/data/agentic_workflow_designer_skill.md
new file mode 100644
index 00000000000..eda4113606e
--- /dev/null
+++ b/pkg/cli/data/agentic_workflow_designer_skill.md
@@ -0,0 +1,273 @@
+---
+name: agentic-workflow-designer
+description: Conversational skill that interviews users to design new agentic workflows
+disable-model-invocation: true
+---
+
+# Workflow Designer
+
+Use this skill to run a structured interview with users who know their goal but not the workflow syntax yet, then generate one complete workflow `.md` file.
+
+## When to Use This Skill
+
+Use this before `.github/aw/create-agentic-workflow.md` when requirements are unclear or incomplete.
+
+- Use `skills/agentic-workflow-designer/SKILL.md` to discover and confirm requirements.
+- Use `.github/aw/create-agentic-workflow.md` once requirements are clear and ready for implementation.
+- Use `.github/aw/agentic-chat.md` when the user wants a specification/pseudo-code instead of a runnable workflow file.
+
+## Interview Framework
+
+Ask one question at a time. Move to the next phase only after the current phase is clear.
+
+### Phase 1: Goal
+
+Ask: **"What do you want to automate?"**
+
+Capture:
+- Workflow name (kebab-case candidate)
+- Brief description
+- Optional emoji
+
+### Phase 2: Trigger
+
+Ask: **"When should this run?"**
+
+Follow up only if needed:
+- Which event type(s)?
+- Any filters (labels, branches, commands)?
+- Scheduled cadence (daily/weekly/hourly)?
+
+Map to the `on:` block.
+
+### Phase 3: Scope (Read/Write)
+
+Ask:
+- **"What should it read?"** (issues, PRs, code, discussions, CI data)
+- **"What should it create or update?"** (comments, issues, PRs, labels)
+
+Map to:
+- `permissions:` (keep read-only for agent job)
+- `tools:`
+- `safe-outputs:`
+
+### Phase 4: Data Strategy
+
+Ask:
+- **"What data does the agent need to make decisions?"**
+- Follow up: **"Can we pre-fetch and aggregate that data with shell commands so the agent only reads compact JSON?"**
+
+Capture:
+- Whether `steps:` should pre-fetch GitHub data with `gh` + `jq`
+- Output paths under `/tmp/gh-aw/data/`
+- Whether batch work should use sub-agents
+
+Map to:
+- `steps:`
+- Prompt references to pre-computed file paths
+
+### Phase 5: Guardrails
+
+Ask: **"Should it block merging, just advise, or silently log?"**
+
+Capture:
+- Visibility expectations (comment, issue, no visible output)
+- No-op behavior expectation
+
+Guide toward safe output behavior and explicit `noop` instructions.
+
+### Phase 6: Context & Network
+
+Ask: **"Does it need external APIs, web access, or package installs?"**
+
+Follow up for exact external domains (FQDN/wildcard).
+
+Map to:
+- `network.allowed`
+- Optional MCP/GitHub tool usage in `tools:`
+
+### Phase 7: Engine (optional)
+
+Ask only if ambiguous: **"Any AI engine preference?"**
+
+If no preference, suggest default:
+- "I'd suggest Copilot since you haven't mentioned a preference. Sound good?"
+
+Map to `engine:` only when not default.
+
+### Phase 8: Confirmation
+
+Present a structured summary and ask for approval before generation.
+
+## Decision Heuristics
+
+### Trigger Mapping
+
+| User says... | Maps to |
+|---|---|
+| "when someone opens a PR" | `on: pull_request:` with `types: [opened]` |
+| "when a PR is updated" | `on: pull_request:` with `types: [opened, synchronize]` |
+| "every morning", "daily" | fuzzy schedule shorthand `on: schedule: daily on weekdays` (compiler expands to cron) |
+| "every Monday", "weekly" | fuzzy schedule shorthand `on: schedule: weekly` (compiler expands to cron) |
+| "when I say /review" | `on: slash_command:` with `name: review` (or requested command) |
+| "when an issue is labeled bug" | `on: issues:` with `types: [labeled]` and label filter guidance |
+| "manually", "on demand" | `on: workflow_dispatch:` |
+| "when a deployment fails" | `on: deployment_status:` |
+| "when another workflow finishes" | `on: workflow_run:` |
+
+### Safe Output Mapping
+
+| User says... | Maps to |
+|---|---|
+| "post a comment" | `add-comment` |
+| "create an issue" | `create-issue` |
+| "open a PR", "submit changes" | `create-pull-request` |
+| "add labels" | `add-labels` |
+| "remove labels" | `remove-labels` |
+| "close the issue" | `close-issue` |
+| "assign someone" | `assign-to-user` |
+| "nothing visible", "just analyze" | no safe outputs required |
+
+### Network Mapping
+
+| User says... | Maps to |
+|---|---|
+| "calls an external API" | ask for exact FQDN/wildcard, then add to `network.allowed` |
+| "installs npm packages" | include `node` in `network.allowed` |
+| "runs pip install" | include `python` in `network.allowed` |
+| "builds Go code" | include `go` in `network.allowed` |
+| "no external access" | `network.allowed: [defaults]` (or `[]` if explicitly zero network) |
+
+### Tool Mapping
+
+| User says... | Maps to |
+|---|---|
+| "read GitHub issues/PRs/workflows" | `tools.github` with `mode: gh-proxy` and minimal `toolsets` |
+| "edit files" | `edit` tool (default unless restricted) |
+| "run commands/tests" | `bash` tool (default unless restricted) |
+| "browse web pages/docs" | `web-fetch` and/or `web-search` |
+| "test UI flows" | `playwright` |
+
+### Data Strategy Mapping
+
+| User says... | Maps to |
+|---|---|
+| "analyze PRs", "review issues", "check status" | add `steps:` that pre-fetch with `gh` + `jq` |
+| "read the diff", "look at changed files" | add `steps:` using `gh pr diff` or `gh pr view --json files` |
+| "search for patterns across repos" | add `steps:` using `gh search` + `jq` filters |
+| "just respond to a comment" | no pre-fetch needed (event payload is enough) |
+| "process each item individually" | suggest sub-agent pattern with `model: small` |
+
+## Token Optimization Defaults
+
+Apply these defaults unless the user explicitly asks otherwise:
+
+1. Use DataOps by default for GitHub reads: pre-fetch/aggregate with `gh` + `jq` in `steps:`, store compact JSON in `/tmp/gh-aw/data/`, and point the prompt to those files (see `.github/aw/token-optimization.md` for details).
+2. Keep tool surface minimal: default to `tools.github.mode: gh-proxy`, include only required toolsets, and prefer `bash` + `gh` for simple reads.
+3. For batch workloads, split items into compact data and suggest sub-agent processing with `model: small`.
+4. Keep prompts compact: concise imperative instructions, explicit file paths, single-line `noop` guidance, and stable instructions before dynamic content.
+
+## Progressive Disclosure Rules
+
+1. Never dump all options at once; ask one targeted question at a time.
+2. Skip questions when answers are inferable from prior user statements.
+3. Offer smart defaults and request confirmation instead of over-questioning.
+4. Ask at most 5 questions before presenting a summary; then ask "anything else?" if needed.
+5. Detect done signals (`that's it`, `looks good`, `generate it`) and proceed to generation.
+
+## Confirmation Format
+
+Use this exact structure:
+
+```text
+📋 Proposed workflow:
+- Name: <workflow-id>
+- Trigger: <event + key options>
+- Engine: <engine or default>
+- Tools: <tool summary>
+- Safe outputs: <list or none>
+- Network: <allowed summary>
+- Intent: <one-sentence task>
+```
+
+Then ask: **"Ready to generate, or want to adjust anything?"**
+
+## Generation Template
+
+After confirmation, generate one workflow file using the same skeleton style as `.github/aw/create-agentic-workflow.md`.
+
+```markdown
+---
+emoji: <emoji>
+description: <brief description>
+on:
+  <trigger config>
+permissions:
+  contents: read
+  issues: read
+  pull-requests: read
+tools:
+  github:
+    mode: gh-proxy
+    toolsets: [default]
+steps:
+  - name: <optional data prefetch>
+    run: |
+      mkdir -p /tmp/gh-aw/data
+      <gh + jq commands that produce compact JSON>
+safe-outputs:
+  <safe-output-types-if-needed>
+network:
+  allowed:
+    - defaults
+    - <additional entries if needed>
+---
+
+# <Workflow Name>
+
+## Task
+
+<clear instructions tied to trigger context>
+If `steps:` includes pre-fetch commands, read the resulting `/tmp/gh-aw/data/*.json` files instead of broad live re-fetches.
+
+## Safe Outputs
+
+- Use configured safe outputs for all visible write actions.
+- Call `noop` with a short reason when no action is needed.
+```
+
+## Validation Checklist
+
+Before final output, run this internal self-check:
+
+- [ ] Agent job permissions remain read-only (writes only via safe outputs)
+- [ ] `safe-outputs:` covers every write action mentioned in prompt/instructions
+- [ ] Network access is scoped; avoid blanket wildcard entries
+- [ ] Trigger matches the user's intended activation event
+- [ ] Prompt instructs agent to call `noop` when no action is needed
+- [ ] Unnecessary defaults are omitted (for example `engine: copilot`)
+- [ ] If reading GitHub data, `steps:` pre-fetches compact JSON (DataOps)
+- [ ] `tools.github.mode` is `gh-proxy` unless broader MCP toolsets are explicitly needed
+- [ ] Only required toolsets are listed (avoid blanket toolset lists)
+- [ ] Prompt references specific pre-computed file paths
+- [ ] For batch processing (>5 items), sub-agent pattern is suggested
+
+## References (load only when needed)
+
+In-repo references:
+- `.github/aw/syntax.md`
+- `.github/aw/safe-outputs.md`
+- `.github/aw/network.md`
+- `.github/aw/patterns.md`
+- `.github/aw/subagents.md`
+- `.github/aw/token-optimization.md`
+- `.github/aw/triggers.md`
+- `.github/aw/create-agentic-workflow.md`
+
+Portable HTTPS references:
+- `https://github.com/github/gh-aw/blob/main/.github/aw/syntax.md`
+- `https://github.com/github/gh-aw/blob/main/.github/aw/safe-outputs.md`
+- `https://github.com/github/gh-aw/blob/main/.github/aw/network.md`
+- `https://github.com/github/gh-aw/blob/main/.github/aw/patterns.md`
+- `https://github.com/github/gh-aw/blob/main/.github/aw/triggers.md`
+- `https://github.com/github/gh-aw/blob/main/.github/aw/create-agentic-workflow.md`
diff --git a/pkg/cli/data/agentic_workflows_skill.md b/pkg/cli/data/agentic_workflows_skill.md
index f69ea7f3dde..4e5d5d8395e 100644
--- a/pkg/cli/data/agentic_workflows_skill.md
+++ b/pkg/cli/data/agentic_workflows_skill.md
@@ -12,9 +12,9 @@ This skill is a dispatcher: identify the task type, load the matching workflow p
 Read only the files you need:
 Load these files from `github/gh-aw` (they are not available locally).
 {{AW_FILE_LIST}}
-- `.github/skills/workflow-designer/SKILL.md`
+- `.github/skills/agentic-workflow-designer/SKILL.md`
 After loading the matching workflow prompt or skill, follow it directly:
-- Design workflows from scratch via interview: `skills/workflow-designer/SKILL.md`
+- Design workflows from scratch via interview: `skills/agentic-workflow-designer/SKILL.md`
 - Create new workflows: `.github/aw/create-agentic-workflow.md`
 - Update existing workflows: `.github/aw/update-agentic-workflow.md`
 - Debug, audit, or investigate workflows: `.github/aw/debug-agentic-workflow.md`
diff --git a/pkg/cli/init.go b/pkg/cli/init.go
index 9e354b0fb32..b3fc4dda062 100644
--- a/pkg/cli/init.go
+++ b/pkg/cli/init.go
@@ -88,8 +88,13 @@ func InitRepository(opts InitOptions) error {
 				initLog.Printf("Failed to write dispatcher skill: %v", err)
 				return fmt.Errorf("failed to write dispatcher skill: %w", err)
 			}
+			initLog.Print("Writing agentic workflow designer skill")
+			if err := ensureAgenticWorkflowDesignerSkill(opts.Verbose, false); err != nil {
+				initLog.Printf("Failed to write agentic workflow designer skill: %v", err)
+				return fmt.Errorf("failed to write agentic workflow designer skill: %w", err)
+			}
 			if opts.Verbose {
-				fmt.Fprintln(os.Stderr, console.FormatSuccessMessage("Created dispatcher skill"))
+				fmt.Fprintln(os.Stderr, console.FormatSuccessMessage("Created dispatcher and designer skills"))
 			}
 		} else {
 			initLog.Print("Skipping agentic workflows dispatcher skill")
diff --git a/pkg/cli/init_command.go b/pkg/cli/init_command.go
index 0ed5a369e85..036a0fbdb08 100644
--- a/pkg/cli/init_command.go
+++ b/pkg/cli/init_command.go
@@ -26,6 +26,7 @@ engine selection or secret configuration.
 This command:
 - Configures .gitattributes to mark .lock.yml files as generated
 - Creates the dispatcher skill at .github/skills/agentic-workflows/SKILL.md
+- Creates the workflow designer skill at .github/skills/agentic-workflow-designer/SKILL.md
 - Creates the custom agent at .github/agents/agentic-workflows.md
 - Removes old prompt files from .github/prompts/ if they exist
 - Configures VSCode settings (.vscode/settings.json)
diff --git a/pkg/cli/init_command_test.go b/pkg/cli/init_command_test.go
index 8293924bfa8..60be811100a 100644
--- a/pkg/cli/init_command_test.go
+++ b/pkg/cli/init_command_test.go
@@ -144,6 +144,10 @@ func TestInitCommandHelp(t *testing.T) {
 		t.Error("Expected help text to mention the Agentic Workflows custom agent")
 	}
 
+	if !strings.Contains(helpText, ".github/skills/agentic-workflow-designer/SKILL.md") {
+		t.Error("Expected help text to mention the agentic workflow designer skill")
+	}
+
 	if !strings.Contains(helpText, "Copilot") {
 		t.Error("Expected help text to mention Copilot")
 	}
@@ -242,6 +246,10 @@ func TestInitRepositoryBasic(t *testing.T) {
 	if _, err := os.Stat(skillPath); os.IsNotExist(err) {
 		t.Errorf("Expected dispatcher skill file to be created at %s", skillPath)
 	}
+	designerSkillPath := filepath.Join(".github", "skills", "agentic-workflow-designer", "SKILL.md")
+	if _, err := os.Stat(designerSkillPath); os.IsNotExist(err) {
+		t.Errorf("Expected workflow designer skill file to be created at %s", designerSkillPath)
+	}
 
 	agentPath := filepath.Join(".github", "agents", "agentic-workflows.md")
 	agentContent, err := os.ReadFile(agentPath)
@@ -351,6 +359,9 @@ func TestInitRepositoryWithNoMCP(t *testing.T) {
 	if _, err := os.Stat(filepath.Join(".github", "skills", "agentic-workflows", "SKILL.md")); os.IsNotExist(err) {
 		t.Error("Expected dispatcher skill file to still be created with --no-mcp flag")
 	}
+	if _, err := os.Stat(filepath.Join(".github", "skills", "agentic-workflow-designer", "SKILL.md")); os.IsNotExist(err) {
+		t.Error("Expected workflow designer skill file to still be created with --no-mcp flag")
+	}
 	if _, err := os.Stat(filepath.Join(".github", "agents", "agentic-workflows.md")); os.IsNotExist(err) {
 		t.Error("Expected Agentic Workflows custom agent file to still be created with --no-mcp flag")
 	}
@@ -386,6 +397,9 @@ func TestInitRepositoryWithNoSkill(t *testing.T) {
 	if _, err := os.Stat(filepath.Join(".github", "skills", "agentic-workflows", "SKILL.md")); err == nil {
 		t.Error("Expected dispatcher skill file to NOT be created with skill disabled")
 	}
+	if _, err := os.Stat(filepath.Join(".github", "skills", "agentic-workflow-designer", "SKILL.md")); err == nil {
+		t.Error("Expected workflow designer skill file to NOT be created with skill disabled")
+	}
 	if _, err := os.Stat(filepath.Join(".github", "agents", "agentic-workflows.md")); os.IsNotExist(err) {
 		t.Error("Expected Agentic Workflows custom agent file to still be created with skill disabled")
 	}
@@ -421,6 +435,9 @@ func TestInitRepositoryWithNoAgent(t *testing.T) {
 	if _, err := os.Stat(filepath.Join(".github", "skills", "agentic-workflows", "SKILL.md")); os.IsNotExist(err) {
 		t.Error("Expected dispatcher skill file to still be created with agent disabled")
 	}
+	if _, err := os.Stat(filepath.Join(".github", "skills", "agentic-workflow-designer", "SKILL.md")); os.IsNotExist(err) {
+		t.Error("Expected workflow designer skill file to still be created with agent disabled")
+	}
 	if _, err := os.Stat(filepath.Join(".github", "agents", "agentic-workflows.md")); err == nil {
 		t.Error("Expected Agentic Workflows custom agent file to NOT be created with agent disabled")
 	}
@@ -456,6 +473,9 @@ func TestInitRepositoryWithNonCopilotEngineSkipsCopilotArtifacts(t *testing.T) {
 	if _, err := os.Stat(filepath.Join(".github", "skills", "agentic-workflows", "SKILL.md")); err == nil {
 		t.Error("Expected dispatcher skill file to NOT be created for non-Copilot engine")
 	}
+	if _, err := os.Stat(filepath.Join(".github", "skills", "agentic-workflow-designer", "SKILL.md")); err == nil {
+		t.Error("Expected workflow designer skill file to NOT be created for non-Copilot engine")
+	}
 	if _, err := os.Stat(filepath.Join(".github", "agents", "agentic-workflows.md")); err == nil {
 		t.Error("Expected Agentic Workflows custom agent file to NOT be created for non-Copilot engine")
 	}
@@ -513,6 +533,9 @@ func TestInitRepositoryRemovesLegacyDispatcherAgentFile(t *testing.T) {
 	if _, err := os.Stat(skillPath); os.IsNotExist(err) {
 		t.Fatalf("Expected dispatcher skill file to be created at %s", skillPath)
 	}
+	if _, err := os.Stat(filepath.Join(".github", "skills", "agentic-workflow-designer", "SKILL.md")); os.IsNotExist(err) {
+		t.Fatalf("Expected workflow designer skill file to be created")
+	}
 }
 
 func TestInitRepositoryWithMCPBackwardCompatibility(t *testing.T) {

From f68ff4ba54892d3ffb2ca5f0d69f0347c78cae04 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Thu, 4 Jun 2026 03:02:21 +0000
Subject: [PATCH 13/14] Plan for reviewer feedback updates

Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>
---
 .github/skills/agentic-workflows/SKILL.md | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.github/skills/agentic-workflows/SKILL.md b/.github/skills/agentic-workflows/SKILL.md
index 6bba5fae3d6..b4505045ca5 100644
--- a/.github/skills/agentic-workflows/SKILL.md
+++ b/.github/skills/agentic-workflows/SKILL.md
@@ -12,6 +12,7 @@ This skill is a dispatcher: identify the task type, load the matching workflow p
 Read only the files you need:
 Load these files from `github/gh-aw` (they are not available locally).
 - `.github/aw/agentic-chat.md`
+- `.github/aw/agentic-workflows-mcp.md`
 - `.github/aw/asciicharts.md`
 - `.github/aw/campaign.md`
 - `.github/aw/charts-trending.md`
@@ -27,6 +28,7 @@ Load these files from `github/gh-aw` (they are not available locally).
 - `.github/aw/github-agentic-workflows.md`
 - `.github/aw/github-mcp-server.md`
 - `.github/aw/llms.md`
+- `.github/aw/mcp-clis.md`
 - `.github/aw/memory.md`
 - `.github/aw/messages.md`
 - `.github/aw/network.md`

From b207dbc2ef5598cb393eb1974e4c9561b944e5f9 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Thu, 4 Jun 2026 03:08:16 +0000
Subject: [PATCH 14/14] Add auth and GHE guidance to workflow designer skill

Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>
---
 .../skills/agentic-workflow-designer/SKILL.md | 38 ++++++++++++++++++-
 .../data/agentic_workflow_designer_skill.md   | 38 ++++++++++++++++++-
 2 files changed, 72 insertions(+), 4 deletions(-)

diff --git a/.github/skills/agentic-workflow-designer/SKILL.md b/.github/skills/agentic-workflow-designer/SKILL.md
index eda4113606e..a397dc18c05 100644
--- a/.github/skills/agentic-workflow-designer/SKILL.md
+++ b/.github/skills/agentic-workflow-designer/SKILL.md
@@ -78,13 +78,19 @@ Guide toward safe output behavior and explicit `noop` instructions.
 
 ### Phase 6: Context & Network
 
-Ask: **"Does it need external APIs, web access, or package installs?"**
+Ask: **"Does it need external APIs, web access, package installs, or MCP servers?"**
 
-Follow up for exact external domains (FQDN/wildcard).
+Follow up:
+- **"Any third-party services or MCP servers to include (for example Slack, Jira, Datadog, custom internal MCP)?"**
+- **"Are you deploying on GitHub.com, GHEC with custom endpoints, or GHES?"**
+- For each integration, identify required auth from source docs and map it to GitHub Actions secrets + workflow env variables.
+- Ask for exact external domains (FQDN/wildcard).
 
 Map to:
 - `network.allowed`
 - Optional MCP/GitHub tool usage in `tools:`
+- `secrets:` / `env:` wiring for integration tokens
+- GHES/GHEC settings such as `engine.api-target` and `aw.json` `ghes: true` (when applicable)
 
 ### Phase 7: Engine (optional)
 
@@ -148,6 +154,29 @@ Present a structured summary and ask for approval before generation.
 | "browse web pages/docs" | `web-fetch` and/or `web-search` |
 | "test UI flows" | `playwright` |
 
+### Integration Auth Mapping
+
+When the user names a third-party service or MCP server:
+
+1. Confirm whether native tool, MCP server, or safe-output job is the right integration path.
+2. Look up the integration's auth requirements and required scopes before finalizing the design.
+3. Provide a concrete setup checklist with:
+   - required GitHub Actions secrets (names to create)
+   - workflow env variables that consume those secrets
+   - minimum token scopes/permissions needed
+
+Output format to use:
+
+```text
+Integration auth setup:
+- <service-or-mcp>: <purpose>
+  - Secrets to create: <SECRET_NAME>, <SECRET_NAME>
+  - Workflow env vars: <ENV_VAR>=${{ secrets.<SECRET_NAME> }}
+  - Required scopes/permissions: <least-privilege scopes>
+```
+
+Never suggest committing plaintext tokens.
+
 ### Data Strategy Mapping
 
 | User says... | Maps to |
@@ -187,6 +216,8 @@ Use this exact structure:
 - Tools: <tool summary>
 - Safe outputs: <list or none>
 - Network: <allowed summary>
+- Integrations/Auth: <service/mcp + required secrets/env vars>
+- Deployment: <GitHub.com or GHEC/GHES details>
 - Intent: <one-sentence task>
 ```
 
@@ -251,6 +282,9 @@ Before final output, run this internal self-check:
 - [ ] Only required toolsets are listed (avoid blanket toolset lists)
 - [ ] Prompt references specific pre-computed file paths
 - [ ] For batch processing (>5 items), sub-agent pattern is suggested
+- [ ] For each third-party service/MCP integration, required secrets/env vars are listed
+- [ ] Auth guidance includes least-privilege token scope recommendations
+- [ ] For GHEC/GHES deployments, `engine.api-target` and GHES compatibility guidance are included when needed
 
 ## References (load only when needed)
 
diff --git a/pkg/cli/data/agentic_workflow_designer_skill.md b/pkg/cli/data/agentic_workflow_designer_skill.md
index eda4113606e..a397dc18c05 100644
--- a/pkg/cli/data/agentic_workflow_designer_skill.md
+++ b/pkg/cli/data/agentic_workflow_designer_skill.md
@@ -78,13 +78,19 @@ Guide toward safe output behavior and explicit `noop` instructions.
 
 ### Phase 6: Context & Network
 
-Ask: **"Does it need external APIs, web access, or package installs?"**
+Ask: **"Does it need external APIs, web access, package installs, or MCP servers?"**
 
-Follow up for exact external domains (FQDN/wildcard).
+Follow up:
+- **"Any third-party services or MCP servers to include (for example Slack, Jira, Datadog, custom internal MCP)?"**
+- **"Are you deploying on GitHub.com, GHEC with custom endpoints, or GHES?"**
+- For each integration, identify required auth from source docs and map it to GitHub Actions secrets + workflow env variables.
+- Ask for exact external domains (FQDN/wildcard).
 
 Map to:
 - `network.allowed`
 - Optional MCP/GitHub tool usage in `tools:`
+- `secrets:` / `env:` wiring for integration tokens
+- GHES/GHEC settings such as `engine.api-target` and `aw.json` `ghes: true` (when applicable)
 
 ### Phase 7: Engine (optional)
 
@@ -148,6 +154,29 @@ Present a structured summary and ask for approval before generation.
 | "browse web pages/docs" | `web-fetch` and/or `web-search` |
 | "test UI flows" | `playwright` |
 
+### Integration Auth Mapping
+
+When the user names a third-party service or MCP server:
+
+1. Confirm whether native tool, MCP server, or safe-output job is the right integration path.
+2. Look up the integration's auth requirements and required scopes before finalizing the design.
+3. Provide a concrete setup checklist with:
+   - required GitHub Actions secrets (names to create)
+   - workflow env variables that consume those secrets
+   - minimum token scopes/permissions needed
+
+Output format to use:
+
+```text
+Integration auth setup:
+- <service-or-mcp>: <purpose>
+  - Secrets to create: <SECRET_NAME>, <SECRET_NAME>
+  - Workflow env vars: <ENV_VAR>=${{ secrets.<SECRET_NAME> }}
+  - Required scopes/permissions: <least-privilege scopes>
+```
+
+Never suggest committing plaintext tokens.
+
 ### Data Strategy Mapping
 
 | User says... | Maps to |
@@ -187,6 +216,8 @@ Use this exact structure:
 - Tools: <tool summary>
 - Safe outputs: <list or none>
 - Network: <allowed summary>
+- Integrations/Auth: <service/mcp + required secrets/env vars>
+- Deployment: <GitHub.com or GHEC/GHES details>
 - Intent: <one-sentence task>
 ```
 
@@ -251,6 +282,9 @@ Before final output, run this internal self-check:
 - [ ] Only required toolsets are listed (avoid blanket toolset lists)
 - [ ] Prompt references specific pre-computed file paths
 - [ ] For batch processing (>5 items), sub-agent pattern is suggested
+- [ ] For each third-party service/MCP integration, required secrets/env vars are listed
+- [ ] Auth guidance includes least-privilege token scope recommendations
+- [ ] For GHEC/GHES deployments, `engine.api-target` and GHES compatibility guidance are included when needed
 
 ## References (load only when needed)