Portable Skills. Replaceable Agents. Faster Delivery.
Version 1.0 · 2026-08-31. Build a Skill once, validate it, then run it through the enterprise-approved agent or model that best fits the job. Start read-only, preserve evidence, and make every development iteration reversible.
Core architecture
Business goal → vetted SKILL.md → Agent Adapter → approved model/runtime → read-only tools/data → evidence bundle → human review → controlled write/promotion.
The Skill contains the reusable method. The Agent Adapter translates that method for Microsoft Copilot Studio, GitHub Copilot, Cursor, Claude Code, Gemini or another approved runtime. This prevents the workflow from being locked to one vendor.
Practical enterprise Skill library
| Skill | What it does | Safe default output |
|---|---|---|
| Enterprise Knowledge Discovery | Search SharePoint, Confluence, service catalogs, architecture repositories and approved folders for a defined topic. | Cited source inventory, gaps, owners and confidence. |
| MDM Estate Discovery | Master Data Management (MDM): identify products, domains, hubs, interfaces, data models, match/merge rules, stewardship and dependencies. | Current-state MDM map plus modernization candidates. |
| MQ Estate Discovery | IBM MQ / message-queue discovery: document queue managers, channels, producers, consumers, flows, service-level needs and known pain points. | Messaging inventory and dependency map; no queue changes. |
| MQ Modernization Advisor | Compare retain, integrate, wrap, migrate or replace options such as event streaming, managed messaging or API-based integration. | Decision matrix with risks, sequencing and coexistence plan. |
| Service / Host / Config Inventory | Correlate approved configuration-management data, documentation and repositories to identify services, hosts, environments and configuration references. | Sanitized inventory that never copies passwords, tokens or private keys. |
| Current → Future Architecture | Turn discovered facts into current-state diagrams, pain points, principles, transition states and a target architecture. | Architecture pack with assumptions explicitly separated from verified facts. |
| Observability Catalog | List logs, metrics, traces, alerts, dashboards, Service Level Indicators (SLIs) and Service Level Objectives (SLOs). | Coverage matrix and missing-observability backlog. |
| Architecture Drift Checker | Compare approved architecture/design documents with repositories, inventories and deployed evidence. | Drift report; never auto-remediates production. |
| Release Evidence Pack | For WordPress/plugins/apps: capture version, changed files, tests, screenshots, package and checksum. | Immutable release folder / ZIP and rollback instructions. |
| Visual Regression Reviewer | Open the development build, capture key screenshots, compare with the prior accepted version and report layout/function changes. | PASS / REVIEW / FAIL with before-after evidence. |
Microsoft Copilot first
For businesses standardized on Microsoft, start with Copilot Studio because it can ground agents in approved enterprise knowledge such as SharePoint, Confluence, ServiceNow, Jira, Azure DevOps, Dataverse and Azure AI Search. Keep user permissions intact: an agent should not reveal information the signed-in user cannot normally read.
- Scope one business domain and approved repositories.
- Search architecture documents, operational runbooks, SharePoint/Confluence, service catalogs and approved source repositories.
- Extract MDM products, versions, domains, interfaces, data owners, match/merge processes, stewardship workflows and known incidents.
- Build a source-cited current-state inventory.
- Identify contradictions and missing evidence instead of guessing.
- Produce a future-state option set: optimize existing MDM, expand domains, integrate with cloud platforms, or replace components.
- Require human approval before any write, configuration change, deployment or ticket creation.
Cursor without runaway cost
Cursor is useful, but it should not become the only runtime. Use it as an implementation workstation while keeping Skills and project evidence portable. For normal work, prefer lower-cost models / routing for repetitive edits, tests, documentation and searches. Escalate to expensive frontier models only for difficult debugging, architecture, security review or large refactors.
Top approachable runtimes / model routes
Do not standardize the Skills themselves on these vendors. Standardize the adapter contract, then select the runtime that your employer, client or budget allows.
- Microsoft Copilot Studio / Microsoft 365 Copilot — strongest first choice for Microsoft-governed internal knowledge and business agents.
- GitHub Copilot — practical coding hub with agent mode and access to multiple model families.
- Cursor — strong interactive coding experience; control cost through model tiers and route simple work cheaply.
- OpenAI Codex / GPT coding models — strong implementation and agentic software-development route.
- Anthropic Claude Code / Sonnet — strong coding, tool use and large-change reasoning.
- Google Gemini developer tools — useful alternative for coding, multimodal review and Google-oriented environments.
- Visual Studio Code agent ecosystem — keeps the editor familiar while allowing Copilot and other agent integrations.
- Open-source / bring-your-own-model IDE agents — valuable as a cost-control and vendor-fallback lane when company policy allows.
- Local/private model runtimes — useful for sensitive internal workloads when approved infrastructure and model quality are sufficient.
- Specialist review agents — security, testing, documentation and visual-quality agents that inspect another agent’s output rather than writing the main feature.
Two-hour development loop
- Checkpoint — assign version and create a recoverable package before changes.
- Plan — convert the request into acceptance tests.
- Implement — one agent makes the smallest coherent change.
- Test — automated functional checks plus security/static checks.
- See — browser agent opens the development site and captures defined screenshots.
- Compare — visual reviewer compares against the previous accepted screenshots.
- Package — create versioned ZIP, manifest, checksums, changed-file list and rollback instructions.
- Review — a second model/agent critiques the implementation and evidence.
- Accept or roll back — only accepted versions become the new baseline.
- Promote — development → staging → production through an explicit controlled step.
Required release evidence
- Version number and timestamp.
- Goal / acceptance criteria.
- Changed-file inventory.
- Tests executed and results.
- Before and after screenshots for important user flows.
- ZIP/package checksum (SHA-256).
- Known issues and unresolved risks.
- Exact rollback package / previous accepted version.
- Human approval status for production promotion.
Security gate for internal SKILL.md sharing
Internal Skills may contain useful company-specific logic, but they must never become a secret-exfiltration mechanism. Before saving or sharing, run automated and human checks for credentials, API keys, tokens, certificates, private keys, passwords, connection strings, personally identifiable information, hidden Unicode/control characters, destructive shell commands, privilege escalation, security-control disabling, unexplained external network destinations and instructions that bypass company policy.
Discovery agents are read-only. Production changes, deletes, queue modifications, database writes, firewall changes, credential operations and deployments require a separate write-capable Skill with explicit authorization, preview, validation and rollback.
Definition of done
A feature is not done because an agent says it finished. It is done when the acceptance tests pass, the development site was actually inspected, screenshots exist, the package is recoverable, a second review found no blocking issue, and the result can be rolled back cleanly.
Recovery Guard v3.6.1 is live and healthy. CarrySkills v3.7.0 is the validated next target: portable SKILL.md downloads, cross-engine prompt packs and Bring Your Own Account (BYOA) use for ChatGPT, Claude, Copilot, Cursor, Gemini, Codex and other AI tools. Normal CarrySkills use does not require CarrySkills-paid model APIs.