GitHub Copilot · Customizing

Customizing Copilot

A generic AI gives generic answers. This is how you feed Copilot the context, conventions, and procedures that make it yours — the bridge from “using Copilot” to “building with Copilot.”

There are four mechanisms here, from simplest to most powerful. (The fifth — connecting real tools via MCP — is big enough to get its own topic.)

increasing power & scope → Instructionsalways-onconventions Prompt filesreusableprompts Skillsprocedures(SKILL.md) Spacescuratedcontext + MCPreal toolsnext topic
☺ Explain it like I’m 10

It’s like leaving sticky notes for your helper — “always do it this way” — so you never have to repeat yourself. You can also teach it step-by-step recipes it follows whenever they’re needed.

🐘Your host for this topic: Ellie the Elephant — she never forgets your project’s rules, so you don’t have to repeat them.

1 · Custom instructions

☺ Like you’re 10: Imagine taping a house-rules note to the fridge — “wipe your feet, put toys away” — so everyone follows it without being told. Copilot reads that note before it starts helping, every single time.

The simplest steering: a copilot-instructions.md file (commonly in .github/) or an AGENTS.md file in your repo. These are short, natural-language statements about how you want Copilot to behave in this project — coding standards, preferred libraries, architectural rules, “always write tests,” “prefer composition over inheritance.” Copilot loads them automatically as context for completions, chat, agent mode, the cloud agent, and code review.

Organization owners can define instructions org-wide, so every repo inherits a shared source of truth. This is how teams keep many developers — and many agents — consistent.

Why it’s high-leverage: one file, written once, silently improves every interaction in the repo. Start every serious project with a good copilot-instructions.md.

Instructions in action. Same request, with and without one convention in copilot-instructions.md:

copilot-instructions.md:  "Use the repo's Result<T> type for fallible calls; never throw."

WITHOUT it   ask "add a function to fetch a user"
             -> function fetchUser(id) { ...; throw new Error('not found') }

WITH it      ask "add a function to fetch a user"
             -> function fetchUser(id): Result<User> { ...; return Err('not found') }

Nobody re-typed the rule — the file is silently in context for every completion, chat, and agent run in the repo.

🎬 At the AI Academy
🦊

Foxy: But I keep telling Copilot “use our Result type, never throw” — why does it forget every single time?

🦉

Professor Owl: Because a chat is a conversation, not a memory. Write the rule once in copilot-instructions.md and it’s read before every reply — that’s custom instructions.

🐘

Ellie the Elephant: That’s my job — I hold the note so nobody has to repeat it. One file, and I remember your project’s rules forever.

🐢

Timmy the Turtle: And I double-check the file only tells, it never runs. If a skill wants a shell, give it the least it needs — no more.

2 · Prompt files

☺ Like you’re 10: It’s like saving your favorite pizza order so you can reorder it with one tap instead of listing every topping again. You write the tricky request once, then just tell Copilot “do that saved one.”

A prompt file is a reusable, shareable prompt stored as a Markdown file in your workspace. Instead of retyping the same complex instruction (“scaffold a new React component following our design-system conventions, with a test and a story”), you save it once and invoke it. Think of prompt files as parameterized, version-controlled prompts your whole team can reuse. They live in the repo, so they’re reviewed and improved like any other code.

3 · Agent Skills (the important one)

☺ Like you’re 10: A skill is like handing Copilot a recipe card for one special dish — it keeps the card tucked away and only pulls it out when that exact dish is ordered. That way it always cooks it the way you like.

This is where customization gets powerful, and it’s the same concept whether you use Copilot’s agents or build your own.

An Agent Skill is a folder containing a SKILL.md file (plus optional supporting Markdown, scripts, and resources) that Copilot loads when relevant to perform specialized tasks better. Skills work with the cloud agent, code review, the CLI, the Copilot app, and agent mode in VS Code.

Anatomy of a SKILL.md

☺ Like you’re 10: The top of the recipe card has a label saying what the dish is and when to make it, and the rest is the actual step-by-step cooking instructions. The label is how Copilot knows which card to grab.

It’s Markdown with YAML frontmatter:

---
name: github-actions-failure-debugging
description: Guide for debugging failing GitHub Actions workflows. Use this
  when asked to debug failing GitHub Actions workflows.
license: MIT
---

To debug failing GitHub Actions workflows in a pull request, follow this
process, using tools provided from the GitHub MCP Server:

1. Use the `list_workflow_runs` tool to find recent runs for the PR.
2. For a failed run, fetch the logs and identify the failing step.
3. ... (step-by-step instructions, examples, guidelines for Copilot)

The two required fields are name (lowercase, hyphenated) and description (what it does and when Copilot should use it — this is the trigger). The Markdown body is the actual instructions.

Where skills live

Skills can run scripts. You can include a script (say, an SVG-to-PNG converter) and tell Copilot in the SKILL.md when and how to run it.

⚠ Security

Only pre-approve shell/bash execution for a skill if you fully trust it and have read every referenced script. Pre-approving shell removes the confirmation step — which means a malicious or compromised skill, or a prompt injection, could run arbitrary commands in your environment. When in doubt, leave shell out of the allowed tools so Copilot must ask before running anything.

◆ Why this matters later

Agent Skills are the simplest way to “create an agent” in the Copilot ecosystem. You’re not writing an orchestration loop — you’re writing Markdown that teaches an existing agent a repeatable, specialized procedure. We build on this in Building Your Own Agents.

4 · Copilot Spaces

☺ Like you’re 10: A Space is like a small shelf where you put only the books about one topic, so when you ask a question the answer comes from those trusted books instead of the whole messy library.

A Copilot Space is a curated, project-specific knowledge base you attach to conversations — docs, code, and instructions bundled as context. When a question should be grounded in a particular body of knowledge (a product area, a service’s runbook, a set of design docs), you point Copilot at the Space and its answers are grounded in that curated material rather than the whole sprawling repo. Think of it as a focused, reusable context bundle.

⌁ Next

The most powerful customization — giving Copilot real tools to reach databases, APIs, and services — is the Model Context Protocol. That’s the next topic, and it’s the foundation for everything agentic. Continue to MCP →

🦫 Benny’s workshop · 30 min

(a) Add a copilot-instructions.md to a repo with three real conventions, then ask Copilot a question and notice it respecting them. (b) Create a tiny Agent Skill: a folder .github/skills/changelog-writer/SKILL.md whose body tells Copilot how you like changelog entries formatted, with a clear description trigger. Then ask Copilot to write a changelog entry and watch the skill kick in.

🐢 Timmy’s checkpoint

(1) What’s the difference between a custom-instructions file and an Agent Skill? (2) In a SKILL.md, why is the description field so important? (3) What’s the security risk of pre-approving shell in a skill?

Check your answers
  1. Instructions vs. skill: A copilot-instructions.md file holds always-on project rules (like “use our Result<T> type, never throw”) that are silently in context for every completion, chat, and agent run. An Agent Skill is a folder with a SKILL.md that Copilot loads only when relevant to perform a specialized task — a recipe card pulled out only when that dish is ordered.
  2. Why description matters: The description is the trigger — it tells Copilot what the skill does and when to use it. Because a skill is loaded only when relevant, that field is how Copilot knows which card to grab, so a clear description is what makes the skill actually kick in at the right moment.
  3. Shell pre-approval risk: Pre-approving shell/bash removes the confirmation step, so a malicious, compromised, or prompt-injected skill could run arbitrary commands in your environment. Only pre-approve shell for a skill you fully trust and whose every referenced script you’ve read; when in doubt, leave shell out so Copilot must ask first.