Rubber Duck Thursday!
Chapters8
Host welcomes viewers, explains the weekly stream format and what they do during the session.
Rigorous, hands-on tour of enabling Claude and Codeex as GitHub Copilot coding agents, plus live demos of custom agents and Copilot CLI workflows.
Summary
Kadesha Kerr leads Rubber Duck Thursday with a jam-packed session on GitHub Copilot. She walks viewers through enabling Claude and Codeex as coding agents on GitHub, explains subscription requirements, and demoes assigning work to agents from the web UI and Issues tab. The stream revisits a previous Copilot CLI demo about generating documents via a Skill, then dives into the March 2026 change log highlighting GPT 5.3 Codex LTD and other Copilot improvements. Kerr also highlights the difference between GitHub CLI and Copilot CLI, explores the Awesome Copilot repository for ready-made agents and skills, and demonstrates building a security review using a custom security agent. The live build includes troubleshooting live permissions issues, testing agent sessions, and creating issues automatically via Copilot CLI. Viewers come away with practical steps to enable agents, use plan and fleet modes, and extend workflows with custom markdown-based agents.
Key Takeaways
- Claude and Codeex can be enabled as coding agents directly from GitHub Copilot settings, with access controlled at the repository level and no extra API keys required.
- Copilot subscriptions (Pro, Pro Plus, or Enterprise) are sufficient to run Claude and Codeex; no additional Enthropic/OpenAI keys are needed for these agents.
- GitHub’s change log (March 2026) announces GPT 5.3 Codex LTD and faster agent performance via semantic code search and the MCP server, signaling stronger enterprise-grade security and stability.
- Copilot CLI supports custom agent skills via Markdown files in the repository, demonstrated with an accessibility agent and a security agent that can audit code bases against OWASP Top 10 and other standards.
- The Awesome Copilot repository provides ready-made agents and skills (e.g., accessibility, security, PRD agents) that you can copy into your project to extend Copilot’s capabilities.
- Issues and PRs can be created and managed by agents in parallel (fleet mode), enabling rapid, automated triage and tasking without leaving the terminal.
- Live troubleshooting is part of the workflow: permission rule sets and bypass configurations may need adjustments, but once wired, agents can start tasks and open PRs automatically.
Who Is This For?
This is essential viewing for developers exploring AI-assisted workflows on GitHub, Copilot Pro/Enterprise users, and teams wanting to automate code reviews, security checks, and issue triage with Claude, Codeex, and custom agents.
Notable Quotes
"Claude and Codeex are now available as coding agents for Copilot Pro and Enterprise customers."
—Announcement of agent availability and eligibility.
"Access to Claude and Codeex is included in your existing Copilot subscription."
—No new keys required; value proposition emphasized.
"You can describe what you want the agent to do and send it off from the Issues tab or the Agents tab."
—How to initiate agent work from the UI.
"The security agent is a Markdown file that can review your code based on OWASP top 10 and enterprise standards."
—Shows how to implement a security review agent.
"Copilot CLI can create issues in your repo and then assign them to Claude or Codeex to work in parallel."
—Demonstrates parallel tasking and automation.
Questions This Video Answers
- How do I enable Claude and Codeex as coding agents on GitHub Copilot?
- What is the difference between GitHub CLI and Copilot CLI?
- Can I use custom agents in Copilot CLI and how do I add them to a project?
- What is Awesome Copilot and which ready-made agents does it include?
- Do I need API keys to use Claude or Codeex on GitHub Copilot, or are they included with my subscription?
GitHub CopilotCopilot CLIClaudeCodeexCustom agentsAwesome CopilotMarkdown agentsOWASP Top 10Security agentPlan mode','Fleet mode'
Full Transcript
Diplomacy. Hey, hey, hey. Hey, hey, hey. Hello world. Classic. I'm always muted. Welcome to Rubber Duck Thursday. Hey, so so happy to have you guys here with me today. Welcome, welcome, welcome. So, I saw some chatter in the comments already, which is great. Um, and one of the top questions I saw was, "What is Rubber Duck Thursday? I'm joining for the first time." First of all, welcome to the show. Welcome to the stream. So, Robotuck Thursdays is our weekly stream where we just come together, we hack, we vibe, I we answer questions, we learn together, and we build, you know, we just we just build and vibe for an hour and see if we can get something working.
Now, last week, last week I was on here, right? And we were having a good time. We're having a blast. I was showing you how to use plugins with Copilot CLI so you can do all the magical things that's happening in the Aentic world. And guess what? My internet went out. My there was an outage in my area. And so that's why uh we weren't able to finish the loop last week. But if you remember, I was showing you how you can use the um I believe it was the doc skill. So like PowerPoint, PDF, Word, Docskill with Copilot CLI to generate documents.
Uh and we were creating a word a specific worksheet for getting started with the Copilot CLI. So I want to show you the output of that because Copilot actually did it beautifully and I posted it on LinkedIn and all so many of you liked it. But if you missed it, I'm going to show it to you today. But let me see what's happening here in the comments. All right. So, let's see. Yeah. How is everyone doing today? I'm doing well and I'm really looking forward to this stream. Today, I want to show you how to enable claude code and codeex agents in GitHub and also show you how to use custom agents with Copilot CLI.
So, I have a really nice jam-packed session planned for you today. So, you know, like let's get into it. Let's get into it. Hey, hey, hey. Hello. Hi, Cadesha. Hi. Hi. Hi. Welcome y'all. So, yeah, let me share my screen here and we can start we can start noodling here. So, the first thing I want to show you is the output of GitHub copilot copilot CLI from last week window entire screen. Actually, let's share screen two. Boop. Awesome. And so, oh, I need to add it to the boop. Add it to the stage. There we go.
All right. So, this first thing I want to show you is the output of the PDF. And so this is from when I installed the agent skill into copilot CLI and asked it to do research on how to use copilot CLI, what it is, how to use it. And then it spat out this beautiful PDF here that you're seeing just like this. It has you know what is the copilot CLI? I saw someone ask what is copilot CLI? So, Copilot CLA is an agent um programming tool that you can use in your terminal. So, you can use it to build applications, you can go ahead and build a SAS, you can use it to do uh local computer works, and you can use it to create documents.
I've been using Copilot CLI to create B-roll with the remote scale for my videos, which has been so cool. Don't worry, I'm working on a video for that one. But let me show you the document that Copilot created to get you up and running on how to use Copilot CLI. So as you can see here, it has a definition installation instructions. It tells you the prerequisites that you use. It says, you know, you can use multiple models and you can choose a model with a /model command. At GitHub, we really want to make sure that you have choice in the model that you use and how you program.
So that is also always cool. We have three operating modes. So there's the interactive mode, the plan mode, the autopilot mode. And so this PDF is actually really so good. And I was so so impressed with the oneshot output that Copilot CLI came up with. And if you want a copy of this PDF so you can learn how to use Copilot CLI, please go to my LinkedIn. I I made a post about it because I knew it would have been so good and so many of you actually liked the post. Uh so I was very happy about that and that also taught me that you know we need to do I need to post more practical implementation of how to use copilot CLI.
So here is the PDF how to use copilot CLI. So yeah, if you can click on that linky, it will take you to the LinkedIn post. Otherwise, just look me up on LinkedIn, Kadesha Kerr, and you'll you'll find this post on my page, and you can go forth and use the the PDF. But yeah, I I thought that was so impressive. So impressive. So impressive. One second. Okay, so today I thought we could go through the change log as usual because you know at GitHub we're always shipping and we literally ship something new every day and then after the change log I want us to go through configuring claude and codeex on GitHub and assign an issue to it to show you that you can now use Claude and Codex on GitHub which I think is so cool right developer choice for the win that is like one of our flagship at GitHub.
All right. So, let's see on the change log March 2026. Okay. Some code spaces improvement. All right. So, we had a release here where it says GPT 5.3 CEX long-term support in GitHub Copilot. So, this is now going to be Wow, that's incredible. So, GPT 5.3 Codex long-term support is now in GitHub Copilot. So this is going to give you stability and internal security for safety reviews that you'd need especially at the enterprise level. GPT 5.3 codas is our first LTS model in partnership with OpenAI. Uh the model launched on February 5th, 2026 and will remain available through February 4th, 2027 for business and enterprise users.
That is so good. So so T means good. Sorry. and copilot coding agent works faster with semantic code search. Secret scanning and AI coding agents via GitHub MCP server. That's awesome. So, it looks like we now have secret scanning built into our GitHub MCP server, which is great. GitHub Enterprise Server 3.0 is now generally available. GBT 5.4 mini is now generally available in GitHub Copilot. All these incredible things, y'all. So, I always like to encourage you to go to the change log so you can see all the incredible things we're shipping and not just in GitHub copilot but across GitHub proper.
Okay, so let's see. Do we need a subscription for using Copilot CLI and any token limitations? This is this is this is a question I've been getting a lot. Let me actually write this down so that I can blog about it. So to use Copilot CLI, you need to have a GitHub copilot subscription. And once you have a GitHub copilot subscription, you can use GitHub Copilot in the IDE in your terminal with Copilot CLI on github.com or on github.com. Right? So the only thing you need is a GitHub copilot subscription and then you have access to GitHub copilot across the suite.
Do we need a subscription? A subscription and token limitation. Yeah, I think that would be something that we could blog about more. So, GitHub copilot subscription tiers. Let me just look that up really quickly just so I can direct you to the proper documentation here. Plans here. So if you go to the GitHub docs and you go to plans, let me just copy the linky here. Awesome. If you go to the docs and you go to GitHub copilot plans, you will see all the things that you need including token limitations and how many premium requests you have etc etc.
So I would encourage you to go to this link and see all the things that you that you get per um in regards to like the different tiers of GitHub copilot. So you can go to that link here. So go to GitHub GitHub docs and then you can go to get start GitHub copilot get started plans and it lists everything uh per per tier the models that you have access to your premium requests um tokens all that jazz all that jazz is listed here. So definitely check out here in the docs. Okay. And so let me see if there are any more questions before I move forward.
Is GitHub the same as GitHub CLI? Great question, Gabriel. So yes, so GitHub CLI is a way for you to use and interact with GitHub in your terminal. So yes, it is one product, one and the same. And GitHub CLI is different from Copilot CLI, right? So, GitHub CLI allows you to interact with GitHub in your terminal. So, that means you can create issues, create pull requests, you can see um what your team is working on. You can you can do all the things that you can do on GitHub, you can do in GitHub CLI.
Copilot CLI is how you can use our coding agent in your terminal. Right? So, that's the difference between GitHub CLI and Copilot CLI. Copilot CLI is an agentic coding tool and GitHub CLI is a way for you to interact with GitHub in your terminal. Hopefully that's clear. But yes, GitHub is the same as GitHub CLI essentially. Essentially, we own that product. All righty. Hello. Let's see if there any more question. You can use your copilot subscription in other idees as well. This is correct. This is correct. This is correct. We we like to, you know, promote developer choice and so we want to make sure that you can use copilot in as many places as you want.
Okay. All right. So, let's get into it. Right. Okay. So, is there spec and skill in copilot CLI? Great question. So, yes, you can use GitHub skills or like you can use agent skills in copilot CLI. So, let me just spin it up really quickly. So if I if I invoke compiler here I can do slashsklls and you can see all the skills I have currently for copilot CLI right so yes you can use agent skills and is there spec when you say is there spec do you mean like is there plan mode there is plan mode so right here let me just pull this down so you can see right here you'll see that there is plan mode here in Copilot CLI and this will help you to create a spec for whatever you want to build.
Is that what you meant? There's also autopilot. So, you know, you can just have Copilot CLI run and do the thing for you. We also have a mode that I love called fleet. And fleet mode allows you to build in parallel with with multiple sub aents executing your task at the same time. So honestly, lots of really good stuff with Copilot CLI and it's all included in your GitHub Copilot subscription, which I love. Okay, so let's get into the build. Let's get into the build. Let's get into the build. So today I want to show you how to use Claude and Codeex on GitHub, um, which is included in your subscription, right?
So let's see. I haven't done it before, so we're going to be doing it together. We're gonna be doing it together. So, I'm going to turn on a little a little background music here. Hold on. There we go. Just a little lowfi while we work. Plan mode is key and fleet yolo. I so agree, David. I so agree. How are you liking fleet? How are you liking fleet? And how are you liking plan mode? Let me know. do you have time to break down agent skills and their use cases? Actually, actually, yes. I on my list today is to show you how to use custom agents with Copilot CLI.
Not agent, not the skills section specifically. I can do that another time. Um, but I I did want to talk about custom agents and we can we can touch on agent skills. Let's see how far we get today. So, let me let me stop yapping and actually get into the show. Right. So, here you see in February we released Claude and Codeex on github.com. So, let's see how to how to um how to use this. And this is in the change log. So, if you go to the change log and you filter by Copilot and then you go to February 4th, you should be able to see this.
I'm going to pop it in the chat here. This is what I'm looking at. All right. So to enable claude and codeex on GitHub, let's see what we need to do. Cloud by anthropic and opening codex are now available as coding agents for copilot pro and enterprise customers. Okay. So first is to use this you have to be a copilot pro plus or a copilot enterprise customer. Okay. You can use a you can start agent sessions and assign work from github.com github mobile and vscode. You can do this directly from issues pull request agents tab d.
All right. Okay. Let's see. For copilot go to coding copilot coding agent settings. Choose which repository agents are allowed to access and enable claw codeex or both by toggling them on. All right, let's see if I have that. So, for repository access, I'm just going to do all repositories since we're doing a quick demo here. And hopefully you can see my screen properly. I zoomed in a little bit more. Allow cla. Okay. On. What happens? Okay. Allow codeex on. It's as simple as a toggle, folks. It's as simple as a toggle. Well, you know, I say that before trying to use it.
I say that before trying to use it. All right. So, let's see. Once I do that, then what? It looks like it should just automatically work. How to use agents. So, create and view sessions from the agents tab on GitHub web and mobile. You can create new agent sessions on github.com in a few ways. Okay. So, now that I've enabled this, let me go to the repository I want to show y'all today. Boop. So, I have a project here called Chapter Smith. And Chapter Smith allows me to pop in a YouTube link and automatically generate chapters for that video.
If you ever watch a YouTube video and you see those chapters and you can like click and go to a specific part in the video, that person had to do it manually, right? Or they're using a tool to do it. So I built my own tool to do this for my work and um I intentionally made this project insecure so that I can use it for demo purposes like now right and so let's see if I can assign one of these security issues to my agents and then I'll show you how I actually created these security issues with using copilot CLI locally.
Copilot CLI actually bulk opened all these issues for me and I'll show you how to do that. All right. So let's see there it is. Cloud and CEX is now here as options for me to choose. So what do I want to do here? Okay. How else can I if I go here and if I go here and if I go to assign co-pilot that pops up and are they here and they're also here. So this is actually how I'm going to do it. I'm just going to assign this one issue to copilot. So there are a few ways you can use agents on GitHub.
So you can go to the agents tab here and then you know choose your the agent that you want to work with claude copilot or codeex and as you can see I also have custom agents in this repository and I'll show you how to create those one second but you I also have custom agents here so you can use your custom agents or any one of these agents here you can choose your model on this side. Boop. And now you can describe what you want the agent to do. Pretty cool, right? I can't, you know, typos are a part of my brand.
I I I just cannot do it. Now, you can describe what you want the agent to do and send it off. You can also choose what branch you want the agent to work on. Like if you are working on a specific branch and you want the agent to do something there, you can do that too. Another way to assign task to agents is on the issues tab. Right? So on the issues tab, you'll see assign to copilot and then the repository automatically comes up here. You can choose a branch as well and then you can choose what agent you want to do the work and you can provide additional instructions if you want which is optional but this this issue is pretty detailed.
So I would expect our agent here to be able to perform this work properly. So after enabling it, do you need to use your API keys from cloud and codex for it to work? You do not and that's the beauty of this. So let's take a look at the the release together. So you do not so clawed by anthropic and openi codeex are now available as coding agents for copilot purpose. You can see here it no additional subscriptions are required. Access to cloud and codecs is included in your existing copilot subscription. Isn't that incredible? So you do not need API keys from Enthropic or from OpenAI to use Claw and Codeex on GitHub.
It is included in your copilot subscription. And I think that is incredible. That's such insane value especially in today's today's world like tokens are so expensive guys. So, like having this automatically be included on GitHub is it's so it's so nice. I love it so much. I love it so much. All right. So, let's keep going. John, you're not late. We're just getting into it. So right now I I just showed the folks how to how to enable claude and codeex on GitHub and you don't need any additional subscription. You go to your settings here, your copilot coding agent settings.
You select what repository you want it to have access to and then you toggle it on and that should work. And this will only work if you're on a pro plus or enterprise plan for GitHub Copilot. Uh, so that's the only that's the only kicker, right? But I think it's it's incredible. It's it's such an incredible value because you don't need your own API keys. You don't need anything extra. Just your GitHub compile subscription and you're good to go. All right. So, let me assign this to an agent here. I'm going to choose Claude here.
It's going to choose Opus 4.6. I'm going to hit assign. And we'll have this running while I show you how to use custom agents in copilot CLI locally. So while while Claude here okay see granting oh okay so let's take a look at this cuz you may also run into this repressor admin maintainer or custom present rules and the ad bypass model dialogue a okay let me try to read this properly so I need to add a rule set here okay the agent encountered an error and was unable to start working on this issue this may be caused by repository rule set violation see granting or please contact support if the issue persists So, let's take a look at our settings.
Let's go to rules. Rule set. I only have one rule set. You can grant certain roles, teams, or apps bypass permissions for your rule set. The following are eligible for bypass access. Repository admins, organization owners, or enterprise owners. the maintain or write role or custom repos roles based on the right role. In the bypass list section, click add bypass. So here, okay, I'm going to call this like agents, add bypass. Okay, in the ad bypass modal, search for the role, team, or app you would like to grant bypass permissions to. So if I search for clot, will it pop up?
No. Copilot coding agent is here. Optionally to grant bypass to an actor without allowing them to push. Um on the right for the click press only let's see we have netlifi which one of these I mean copilot coding agent is all all the already there. Let's see what that does. Sorry. I wonder if this one covers all the agents. Let me go back to here. What's this one? Let's try again. in there. Yeah, I don't. Let's see if that was here. One second. I feel this happened last week too when I was doing something for the first time live and we encountered an The agent encountered an error.
But why granting bypass permission for your branch or tag rule set admin bypass option? Ally click. Okay, let's try again. did that one. No, I do want them to be able to push through the repository. So, I don't think it's I think it's always I added the default branch. You guys, what's going on? Optionally, that's optional. I know it's always during the demo time. It really is. It really is. It really is. Um cuz theoretically this should work, right? Theoretically this should work. But guess what? This is this these are the same type of errors you're going to be encountering locally.
So I now have information to bring back to the team, you know, to make sure that things are clear here because theoretically we should have been able to enable enable the agents and then assign them an issue. Right? What if I try from the agents tab? Let's see if it will work from a different tab. Let's see. Um what issue did I want to assign to it here? Issue number seven. I don't know if I can do number seven here in the let's see I don't know if it has the context. I think it should.
I'm going to leave it as main branch and I'm going to say start task. What? Hold on. Hold on one second. Enjoy the music while I Hold on. Hold on. Hold on. All right. So, let's go back. Let's go back here so that if I go back to the repository. All right, let's try that again. Let me turn that down. Let's try that again. I'm going to say complete issue on number seven. Let's see if that works. I'm going to do boop and send. Let's see what what error we get now. Initializing session. It opened a pull request.
Okay. So, using it from the agents tab worked. using it from the agents tab worked. As you can see here, Claude started working. So, the Claude agent is working here. So, what I had to do was I had to go into my settings and I had to select a um a billing. It was a billing thing. So, if you're on an enterprise plan, you have to make sure that you select your organization as the place to be built to. If you're on the Pro Plus plan, um I'm not sure what that would look like for you.
If you are are on a Press plan and you try this, let me know on LinkedIn what worked for you. But, you know, I I kind of like when things break like this because it shows you that when you're doing it, you're not going crazy. It w it will break. Um, and now I have information to send back to the team. So, now Claude is working on GitHub on issue number seven. So, you know, let's see what it do. Let's see what it does. So, I kind of want to try and see if I can assign it here as well.
Um, so let's assign this one. Let's just try it again. If it doesn't work, I'll move on to something else and I will send it over to the team. So, I'm going to choose codeex this time and assign. And then let's see if there's an error down here. Okay, so this works. So it it was a building issue. It was because something wasn't selected on the back end there and that's why this wasn't work. And so now I have both Claude and Codeex working on two different issues at the same time on GitHub. I think that is incredible, right?
The speed at which which we can move these days is so great. And you can see the progress here uh of both agents working. Should I also assign one to copilot? Let's just do it. Right. So let's assign this one to the copilot agent assign. And boop copilot saw it and it's about to start working on it. So things are working now folks. Things are working. Uh, it's working. It's working. All righty. So, while the agents work on github.com, let's go to the to Copilot CLI locally so I can show you how to use custom agents and how you can add agent skills to uh copilot CLA.
Is this meeting recorded and where can I get a copy? So, the meeting is recorded. You can watch it on LinkedIn, YouTube, Twitch, um, afterwards. Okay, any more questions? If you have more questions, pop them in the chat. Is it worth becoming a developer? Yes, Robert, absolutely. uh software engineers and software developers are the ones building these systems, you know, like we're the ones monitoring the AI orchestration, you know what I mean? Like we're the ones that um building and iterating with AI agents along our side. If there's ever anything broken, we're the ones that people call to fix it.
Um we're the ones that's going to be helping small businesses implement AI and AI agents into their workflow. And so I think we are it's still very much worth becoming a developer. And if you are a developer, you know, do not be dismayed. I think it's still a really good time. It's really a great time to be a developer. There's so much building. Building is easier than ever. And so I think the thing that we can focus on now as developers is what problem do we want to solve? You know, who is our target audience?
Like what do we want to build and solve for them? Um I think I think that's the the case now. Did she say Svita? I did not. I don't know what that means. All right. So, let's keep going. Let's keep going. So, while our agents are running, I'm going to close some of these tabs here. I want to show you awesome co-pilot. So awesome co-pilot is a repository that's filled with goodies, right? So it's filled with plugins, agents, scales, hooks, aentic workflows, which goes into GitHub actions, right? Cookbook, uh, copy paste recipes for working with Copilot APIs.
So this repository is filled with so many things that you can use to customize your workflow when building with Copilot CLI. So I'm going to pop this up here. If you go on GitHub and you search for awesome copilot, this repository has a whole bunch of goodies that you can use. And so let's take a look at some of the agents that are available here that you can implement. So we have an accessibility agent, API architect, Apify integration expert. I've been using Appify lately and it's incredible. We have some Azure agents for multiple things. We have Context.
There's so many agents in this repository that you can use. It's crazy. It's crazy. And so I believe locally I have the I have a security agent and I have an accessibility agent. So I can show you what that looks like. There's also a PRD agent to, you know, just kind of like scope out your projects when you're building something. So, let's take a look at one of these and what it looks like locally. So, Awesome Copilot's here. Go ahead and go to Awesome Copilot. Star the repository so that you don't forget it. And if you have agents that you want to contribute to the repository, feel free to follow the contributing guide.
Right. So, let's go to Copilot here. So, let me know if I need to zoom in more so you can see. Otherwise, I'm going to go ahead and go. All right. So, if I do slash agents, you can see that I have an accessibility agent and I also have a security agent, right? But what does that look like, Cadia? Glad you asked. Let me show you. Um, Oo, zoom in here. Let's open this up in VS Code so I can show you what this looks like. So, if I go into the GitHub folder, you'll see I have agents and I also have skills.
Let me zoom in a bit more here. 300%. Okay. Yeah, you'll see I have agents and I have skills. So, if I go into the agents folder, I have the accessibility agent and I have the security agent. So, the accessibility agents and these agents, it's Markdown. Markdown is in again, folks. Markdown is in. If you don't know how to use markdown, we do have an episode coming out soon on YouTube on how you can write Markdown. All right, but it's all markdown. And so, in the front matter here, you have a description, you have tools that the agent has access to, and then you have the agent definition here.
So this allows um your LLM to act like an expert to act like an accessibility expert or to act like a security expert, a security reviewer. Right? So we have the definition, we give the agent an expertise, um we tell it the approach, guidelines, all these things. This is a very thorough document and you can get this document from the awesome co-pilot repository. So if I look for accessibility, I just copy it. I don't do anything magical. I lit literally just copy it. Then I go to my repo in the agents tab. I create a new file.
I call it accessibility agent. And then I pop it in. You know, I you know I it doesn't have to be complicated to use it. And that's how you have uh an accessibility agent, right? And this agent is accessible in accessible. This agent is accessible in copilot CLI and you can also use it on you know like GitHub copilot proper. So if I go here um you can see here I can select my security agents here. So that's pretty cool right? That's pretty cool. So if I select my security agent in copilot CLI, I can tell it to do something incredible.
So I can say perform a security review. And before we do that, let's take a look at what the security agent looks like. So yes, agents are MD files. So the MDN extension MD stands for markdown and markdown is pretty much the text but in the coding world we use MD to to you to the it's write text right so that's what the MD is so it stands for markdown if you're unfamiliar with markdown never fear we do have a GitHub for beginners markdown episode coming out pretty soon on GitHub's YouTube channel so be sure to subscribe be sure to subscribe And if you're also unfamiliar with GitHub, check out GitHub for beginners on GitHub's YouTube channel.
It's it's very good, I promise. And you'll see a familiar face. You'll see a familiar face. Okay. So, let's take a look at the security agent. So, this is our security agent. It is a specialist that's going to review a code base based on OWASP top 10 zero trust LLM security and enterprise security standards. So this is this is a pretty good pretty legit agent, right? So we have specific steps here. Create a targeted review plan, right? Step one, OS top 10. And it goes through all the 10. It gives it examples of what these things look like.
Let me run the agent and then we can go through it cuz you know to do a thorough review it works for a little bit and I'm using GPT 5.4 here in Copilot CLI. So as you see it's going through it's going to perform this review. All right. So let's go back here. So, we have examples of what these security concerns are so that um our LLM knows exactly what to look for. So, it's going to look for prompt injection. It's going to look for different forms of injection attacks. It's going to look for information disclosure, all that stuff.
All that stuff. So, see this? This is pretty good. Pretty good. Pretty good. And then it's going to spit out a report that we can then use to resolve all the issues in the codebase. Now, this codebase has a lot of issues. So, it should come back with maybe like five, six um things that we need to address. So, let's take a look. And if you have any questions, let me know. Let's see. Security agent is great. You're making fun. This is an open door to your drive. is that security agent language agnostic? Yes. And you know why?
Because it's markdown. So regardless of your codebase, you can pop this security agent into your GitHub folder. Github/ aents and then you pop your agents right here. And because it's markdown, it can review all sorts of um stack. We also have a skill here. So, we have a GitHub issue skill. We have a skill creator skill. We have a web design reviewer skill. Yeah. So, that's pretty good. And these skills also came from um the awesome co-pilot repository. Done. I completed the security review and saved it into Docs code review. Okay, so let's see what this looks like.
Docs code review. Boop. Ready for production. No critical issues four. Okay. So you must fix public extensive endpoints with no real abuse controls. So there's no rate limiting. There are no rate limiting for any of these API routes which is not good. Okay. If there are any bypers watching the stream today, please please please look up OASP top 10. Okay. Okay. Okay. All right. All right. So that's something here. So this means that anyone can come in and make as many requests as possible to my YouTube API endpoints and run up my API cost. And that's not good cuz I don't want to wake up to a $5,000 charge in my bank account.
You know what I mean? You know what I mean? Okay. What else is here? Sensitive information disclosure through raw upstream errors. Ooh, so there's like a lot of unsanitized details here. Uh, health endpoint exposes operational intelligence without authentication. Unbounded prompt input and weak LLM output controls. CSV export is vulnerable to formula injection. So, it's catching a really good stuff here. External fetches left consistent timeouts. Wow. And so, guess what I can say now? I can come in copilot CLI and I can say, hey, I can change a model. So, you do /mod to change your model and I can switch to um any model here.
Let's go to cloud 4.6. six. And I can say um can you check the repo issues if these um items are logged and if not create new issues for them um so I can track work. You know, not the best prompt, but here we go. We're just we're just chatting here. So now Copilot CLI is going to go it's going to use the GitHub MCP server and it's going to check the repository issues to see if these security concerns are already issues in my repository and then if there are not issues in the repository it's going to create new issues in the repo that we can go ahead and assign for work.
Right? So if I come and if we go to our repo, you'll see that I have five issues. So theoretically, we should have at least one more issue if nothing is logged, right? Let's see if any of these are here. And so we have five issues. So let's see if any new issues are logged. Um, looks like there was command 7 is already run window for read by stop it with okay so it's doing its thing. So you see here it's it's using the GitHub issues scale to go to the repo. Got the repo name.
Now it's going to list the open GitHub issues to check to see if any of the the item it found is already logged in the issues. So I think that's great, right? So imagine you can keep track of your work so much easier using GitHub copilot just from your terminal. You don't even don't even have to leave. Is there a VS Code extension? Do you mean is there a VS Code extension for Copilot CLI? There is a GitHub Copilot VS Code extension that allows you to use GitHub Copilot in VS Code. So here you can see this is the GitHub copilot VS code extension.
GitHub copilot. You see here you have this one and you install it. And then once you install it, you'll see this button here. You click it and then you should be able to choose your models, choose agent ask or plan, create custom agents. You're also able to configure MCP servers. So, we have built-in MCP servers and then we also have I also have the a Playright MCP server, Context 7. Um, lots of great stuff that you can do. with the GitHub copilot extension in VS Code. It's It's very good. It's very good. Okay. So, it's saying my GitHub token lacks right permission, but it's going it should switch to um my user that's logged into Copilot CLI to be able to to add add the issues.
So, let's see if it does that. Let's see if it does that. All right, any more questions? Hopefully, you learned something today that you didn't know. We covered enabling cloud and codecs on GitHub proper. And then I also showed you how to use custom agents with GitHub copilot CLI. We use a custom agents. We use a custom security agent. Here I showed you how you can, you know, access all these agents and configure your environment the way that you want. Yeah. All right. So I see a question. What is GitHub? So GitHub is GitHub is a lot, right?
So GitHub initially we were like a place for you to store your repositories like to store your code and work along with your team. Collaboration. So you can collaborate with your team. We can create projects to track your work, create issues, track your work. Now we have agents on GitHub. So you can do full agentic programming on GitHub. So GitHub is a platform for developers and all builders to truly ship incredible products together. And if you want to learn more about GitHub, I encourage you to go to GitHub's YouTube channel. And actually, let me just find GitHub's YouTube channel here.
Yeah, I encourage you to go to GitHub's YouTube channel and look for the GitHub for beginners series here. So, GitHub for beginners is a series that will teach you how to use GitHub from beginning to end. And you'll see a familiar face. I will be your teacher here. It's a really great uh program and it literally walks you through how to use GitHub from beginning to end. So, I encourage you if you don't know what GitHub is, if you've never used it before, go to GitHub's YouTube channel, look up the GitHub for beginners playlist and go forth and learn.
Go forth and learn. All right, so let's check on our work, right? And it looks like it's 200 p.m. So almost time to wrap up here. So as you can see, Copilot CLI created some issues for us, right? So it created all these issues for us. So let's take a look at our repository to see what additional work we have to do. Um, where is the repo? Did I lose it? I did. Okay, I can put that there. I can actually close this one and let's go to the repository. So, five open issues. If I refresh now, we have eight.
So, Copilot CLA created three new issues here for us. And it also assigned labels. Is this session related to AI models? Hm. Can you clarify your question? So we did use quite a few models and quite a few agents today. So initially we assigned I'm going to go back here. So we assigned this issue to copilot coding agent on github.com and we also assigned this issue to codeex agent on github.com. So if I go to the agents tab, you'll see that the agents have completed their work, right? So let's take a look at this one that Claude did.
And if you toggle this drop down here, you can literally go through what the agent did in this view. But I'm going to go and look at the pull request. So, as you can see, Claude and I requested my review on this work. It told me exactly what it did. Isn't that cool? I think that's so cool. Right. It did a plan. It started the work, opened a PR, finished the work, and now it told me that I need to review it. This is exactly what we need. What? We want more issues. I know. But the good thing is you can assign your issues now to agents to to work on them in parallel for you.
So you know you know you know you know you know. Okay. So is there a video on custom agents creating your own? I missed that part. Yes. Yes. So to create your own custom agents especially using copilot CLI um one of the best ways to do it is to use agents that's already created for you. Uh so for example in this awesome Copilot repository there are so many agents that you can use right and so let's say you want to add the critical thinking agent. I just chose a random one. I would copy this boop literally copy.
I'm not going to do anything special, anything crazy. I would come here and make sure you have agitub folder in the root of your project. Then create an agents folder. And in the agents folder, I would literally do this. That's going to be my critical thinking agent. It's a markdown file. I paste it. And now I have a critical thinking agent that I can use. And that's how you create custom agents with GitHub for GitHub copilot and for GitHub copilot CLI. And so now if I go here and I type / agent. Oh, I think oh you'll see the critical a thinking agent popped up.
And now I can use that agent to do some critical thinking for me. And that's how you with um with Copilot. Literally, custom agents are markdown files and they are incredible because they give your LLM so much context and so much usability and so much you it allows you to extend what the agents can do out of the out of the box and I think that's awesome. And so now you know how to use Codex and Claude on github.com to complete some work for you. I hope you had a great time today. I'm about to start wrapping up.
If there are no more questions, um, sorry, I don't know how poor porna porna, I encourage you to go to GitHub's YouTube channel and watch GitHub for beginners to learn how to use GitHub. I promise you it's for beginners. It's very entry level, you know. I made we made sure that it's a program that I lead uh specifically and so we made sure that the the language and the information that we share is very approachable for you. So go forth go on GitHub's YouTube channel watch GitHub for beginners. There are also blog posts for every single episode.
So you can also read more and learn more about GitHub and how to use GitHub. Promise you if you missed the beginning, if you missed the beginning, you know what, Ryan, I appreciate you coming though. You made it. You made it. And this session is recorded. We covered a lot today. So, I would encourage you to rewatch the session. Can we access awesome copilot? Yes, you can. So, go to this repository. I'll pop it in the chat again. You can also um look up awesome copilot GitHub and the repository should pop up in your search.
This was very informative. I'm so happy Millison. Thank you so much for joining. And if there's anything else you guys want to learn, just send me a message on LinkedIn. I do get a lot of messages, okay? So, it takes me a while to get through the messages, but eventually I do. I get there. Send me a message on LinkedIn. Let me know what you want to see. And you know, it's it's a wrap, folks. It's a wrap. It's a wrap. It's a wrap. What's for the next edition? Honestly, we plan it like the same week.
So, I you know, it could it could be building a project from scratch. It could be, you know, diving into a brownfield project to make some updates to it. It could be anything. So, stay tuned for the next Thursday. And thank you guys so much for joining me. I am going to close this stream right now and have a fantastic day. Bye.
More from GitHub
Get daily recaps from
GitHub
AI-powered summaries delivered to your inbox. Save hours every week while staying fully informed.









