Skip to content

agents

Directory actions

More options

Directory actions

More options

Latest commit

 

History

History

agents

README.md

🤖 Custom Agent Profiles

This directory contains repository-level GitHub Copilot custom agents for the Citizen Intelligence Agency platform. Each agent provides domain-specific expertise and enforces the Hack23 Information Security Policy (ISP) and its supporting ISMS policies.

Scope: These are repository-level agents (.github/agents/*.md). Per Hack23 policy, repo-level agents do not declare mcp-servers: blocks — MCP configuration is handled by the environment via .github/copilot-mcp-config.json. All agents declare tools: ["*"] so the Copilot runtime can grant full tool access.

📋 Agent Overview

Agent Expertise Primary Use
task-agent Product quality, GitHub issues, Copilot orchestration, ISMS Issue engineering, quality analysis, Copilot task delegation (base_ref, stacked PRs)
stack-specialist Java 21/26, Spring, Vaadin, Hibernate/JPA, PostgreSQL 18, Maven 3.9.15 Implementation, refactoring, debugging, SDLC security gates
ui-enhancement-specialist Vaadin, data visualization, WCAG 2.1 AA, secure rendering, privacy-by-design UI/UX improvements, charts, accessibility, XSS-safe components
intelligence-operative Political science, OSINT, intelligence analysis, risk frameworks, Swedish politics Analytical frameworks, data source integration, classified intelligence products
business-development-specialist Strategic planning, partnerships, revenue models, market expansion Business strategy, licensing, partner due-diligence
marketing-specialist Digital marketing, content strategy, community building, brand positioning Neutral, privacy-respecting storytelling; OSS posture marketing

🚀 Usage

Agents are automatically available in GitHub Copilot conversations. Reference them by name:

@task-agent Analyze SonarCloud results and create prioritized improvement issues
@task-agent Assign issue #8033 to Copilot on branch feature/isp-integration with custom instructions
@stack-specialist How should I implement a new JPA entity for committee membership?
@ui-enhancement-specialist Review this Vaadin view for WCAG 2.1 AA compliance
@intelligence-operative Design a risk scoring framework for politician financial disclosures
@business-development-specialist Evaluate a partnership request from an academic institution
@marketing-specialist Draft a release announcement for the new risk dashboard

🏗️ Agent Architecture — Shared Principles

All agents follow these common principles:

  1. Context-aware — read README.md, copilot-instructions.md, copilot-setup-steps.yml, and copilot-mcp-config.json before work
  2. ISP-first — the Hack23 Information Security Policy is the apex — every change defers to it
  3. Skills-integrated — reference the .github/skills/ library (80 skills, see skills README)
  4. Evidence-based — recommendations grounded in data, metrics, scanner output, ISMS controls
  5. Security-first — align with Secure Development Policy, Open Source Policy, Secrets Management, Cryptography Policy, Access Control
  6. Classification-aware — every artefact is labelled per CLASSIFICATION
  7. Non-partisan — outputs analyse all parties / politicians with equal rigor
  8. Human-in-the-loop — Critical / High security changes require human approval

🗺️ ISMS Policy × Agent Matrix

Every agent has explicit responsibility for specific ISMS policies. The Information Security Policy (ISP) is the apex for all.

Policy task-agent stack-specialist ui-enhancement intelligence-operative business-dev marketing
Information Security Policy (Apex) ✅ ✅ ✅ ✅ ✅ ✅
Secure Development Policy ✅ ✅ ✅ ○ ○ ○
Open Source Policy ✅ ✅ ○ ○ ✅ ✅
Secrets Management Policy ✅ ✅ ○ ○ ○ ○
Cryptography Policy ○ ✅ ○ ○ ○ ○
Access Control Policy ✅ ✅ ✅ ○ ○ ○
CLASSIFICATION ✅ ✅ ✅ ✅ ✅ ✅
Data Protection Policy ✅ ✅ ✅ ✅ ✅ ✅
Privacy Policy ○ ○ ✅ ✅ ○ ✅
Vulnerability Management ✅ ✅ ○ ○ ○ ✅
Change Management ✅ ✅ ○ ○ ✅ ○
Third Party Management ○ ✅ ○ ○ ✅ ○
Incident Response Plan ✅ ✅ ○ ✅ ○ ✅
Threat Modeling ✅ ✅ ✅ ○ ○ ○
AI Policy ✅ ✅ ✅ ✅ ✅ ✅
Information Security Strategy ○ ○ ○ ✅ ✅ ✅

Legend: ✅ primary owner / must comply · ○ secondary / consult as needed

🔗 Top Skills per Agent

For the full 80-skill library, see .github/skills/README.md.

task-agent

  • hack23-information-security-policy, hack23-isms-compliance, secure-development-policy, open-source-policy
  • vulnerability-management, code-quality-checks, testing-strategy-enforcement, product-quality-analysis
  • issue-triage-workflow, product-management-patterns
  • playwright-ui-testing, accessibility-wcag-patterns
  • github-actions-workflows, github-agentic-workflows, ai-governance

stack-specialist

  • hack23-information-security-policy, secure-development-policy, secrets-management, cryptography-policy
  • spring-framework-patterns, jpa-hibernate-optimization, postgresql-operations
  • maven-build-management, github-actions-workflows, ci-cd-security
  • unit-testing-patterns, integration-testing, performance-optimization, api-integration
  • secure-code-review, input-validation, threat-modeling, vulnerability-management

ui-enhancement-specialist

  • hack23-information-security-policy, secure-development-policy
  • vaadin-component-design, ui-ux-design-system
  • accessibility-wcag-patterns, data-visualization-principles, advanced-data-visualization
  • playwright-ui-testing, e2e-testing, input-validation
  • data-protection, gdpr-compliance, classification-framework-enforcement, performance-optimization

intelligence-operative

  • hack23-information-security-policy
  • swedish-political-system, political-science-analysis, electoral-analysis, legislative-monitoring
  • osint-methodologies, intelligence-analysis-techniques, behavioral-analysis
  • risk-assessment-frameworks, risk-assessment-methodology, strategic-communication-analysis, data-science-for-intelligence
  • data-protection, gdpr-compliance, classification-framework-enforcement, ai-governance
  • european-parliament-api, cia-data-integration

business-development-specialist

  • hack23-information-security-policy, information-security-strategy
  • business-model-canvas, product-management-patterns
  • open-source-policy, compliance-frameworks, hack23-isms-compliance
  • gdpr-compliance, data-protection, cia-data-integration, european-parliament-api

marketing-specialist

  • hack23-information-security-policy
  • seo-best-practices, documentation-standards, contribution-guidelines
  • open-source-policy, data-visualization-principles, accessibility-wcag-patterns
  • gdpr-compliance, data-protection, ai-governance

📐 Agent File Format

Each repository-level agent file uses this structure:

---
name: agent-name                                    # kebab-case, unique
description: One-sentence role summary (≤200 chars)
tools: ["*"]                                        # always allow all tools
---
# Role header + mission
**Always read first:** …context files…
## Core Expertise
## ISMS Policy Integration        ← explicit mapping table
## (Domain-specific sections)
## Agent Handoff Matrix           ← who to delegate to
## Boundaries — Must NOT Do       ← red-lines
## Skills I Primarily Use
## Remember                       ← bullet key reminders

Repository agents do not include mcp-servers:. MCP configuration lives in .github/copilot-mcp-config.json and is applied by the Copilot runtime.

📚 Related Resources