🎯 Riksdagsmonitor — Agent Skills Guide

🧠 91 Specialised Skills Powering Autonomous Political Intelligence
🛡️ 14 ISMS & Security · 🕵️ 11 Political Intelligence · 🤖 13 GitHub Agentic Workflows · …

📋 Document Owner: CEO | 🏢 Owner: Hack23 AB (Org.nr 559534-7807) | 🏷️ Classification: 🟢 Public

Overview

Agent skills are strategic, high-level principles and best practices that guide Copilot agents in performing their tasks. Skills are automatically loaded when relevant to the current context, providing agents with specialized knowledge without cluttering the main prompt.

Directory-level catalog: .github/skills/README.md — compact 91-skill catalog grouped by 12 functional categories. Companion docs: AGENTS.md · .github/agents/README.md · .github/prompts/README.md · .github/workflows/README.md

What Are Skills?

Skills are structured instruction sets stored in .github/skills/ that teach agents:

How to approach specific types of tasks
What principles and standards to follow
Why certain practices are important
When to apply specific patterns

Skills are:

✅ Strategic: High-level principles, not step-by-step instructions
✅ Rule-Based: Clear rules and standards
✅ Reusable: Apply across multiple tasks
✅ Context-Aware: Load only when relevant

Available Skills (91 Total) ✨ UPDATED 2026-04-22

Core Infrastructure (9 skills) ⬆️ EXPANDED

hack23-isms-compliance
security-by-design
static-site-security
ci-cd-security
documentation-standards
html-accessibility
multi-language-localization
hack23-future-architecture-standards ✨ (2026-02-11)
documentation-portfolio ✨ NEW (2026-02-20) - Required architecture docs (current/future state)

Political Intelligence (11 skills)

Cross-cutting — Horizon stratification: Skills 12, 14, 17, 18 and 82 (intelligence-analysis-techniques, electoral-analysis, legislative-monitoring, risk-assessment-frameworks, prospective-news-coverage) each include a "Horizon stratification" subsection mapping the canonical bands (72h / week / month / quarter / year / cycle / election) to per-band WEP language. The election band is scenario-driven (coalition outcomes never above "likely"). Authoritative source: .github/prompts/ext/long-horizon-forecasting.md. Runtime helper: scripts/horizon-context.ts.

political-science-analysis
osint-methodologies
intelligence-analysis-techniques
swedish-political-system
electoral-analysis
behavioral-analysis
strategic-communication-analysis
legislative-monitoring
risk-assessment-frameworks
data-science-for-intelligence
gdpr-compliance

ISMS & Security (12 skills) ⬆️ EXPANDED

cis-controls
iso-27001-controls
nist-csf-mapping
threat-modeling
secure-code-review
security-documentation
incident-response ✨ NEW (2026-02-20) - Security incident procedures (NIST/ISO 27001)
input-validation ✨ NEW (2026-02-20) - XSS/injection prevention patterns
vulnerability-management ✨ NEW (2026-02-20) - Vulnerability scanning and remediation
data-protection ✨ NEW (2026-02-20) - Privacy-by-design, GDPR compliance
ai-governance ✨ NEW (2026-02-20) - AI/LLM governance and responsible AI
information-security-strategy ✨ NEW (2026-02-20) - Security program governance

Development & Operations (16 skills) ⬆️ EXPANDED

c4-architecture-documentation
github-actions-workflows
code-quality-checks
secrets-management
data-pipeline-engineering
automated-content-generation
performance-optimization
api-integration
github-agentic-workflows
code-review-practices ✨ NEW (2026-02-20) - Code review standards and feedback
testing-strategy ✨ NEW (2026-02-20) - Unit/integration/E2E/security testing
contribution-guidelines ✨ NEW (2026-02-20) - Open source contribution standards
change-management ✨ NEW (2026-02-20) - Change control processes (ITIL/ISO 27001)
open-source-governance ✨ NEW (2026-02-20) - License compliance and supply chain security
copilot-agent-patterns ✨ NEW (2026-02-20) - Agent design patterns and orchestration
product-management-patterns ✨ NEW (2026-02-20) - Feature prioritization and roadmaps

UI/UX & Design (7 skills) ⬆️ EXPANDED

responsive-design
design-system-management
political-data-visualization
advanced-data-visualization
ui-ux-design
seo-optimization ✨ NEW (2026-02-20) - Schema.org, meta tags, multilingual SEO
data-visualization-principles ✨ NEW (2026-02-20) - Chart selection, color theory, accessibility

Testing & Quality Assurance (2 skills)

playwright-testing
issue-management

Data Integration (6 skills) ⬆️ EXPANDED

riksdag-regering-mcp
cia-data-integration
mcp-server-development ✨ NEW (2026-02-20) - MCP server patterns and transport protocols
european-parliament-api ✨ NEW (2026-02-20) - EU Parliament Open Data integration
mcp-gateway-configuration ✨ NEW (2026-04-22) - MCP gateway setup, routing, access control
mcp-gateway-security ✨ NEW (2026-04-22) - Token management, request validation, audit logging

Business & Marketing (3 skills)

marketing
business-development
business-model-canvas ✨ NEW (2026-04-22) - Business Model Canvas for open-source sustainability

Language & Localization (1 skill)

language-expertise

GitHub Agentic Workflows (12 skills)

gh-aw-authentication-credentials
gh-aw-containerization
gh-aw-continuous-ai-patterns
gh-aw-firewall
gh-aw-github-actions-integration
gh-aw-logging-monitoring
gh-aw-mcp-configuration
gh-aw-mcp-gateway
gh-aw-safe-outputs
gh-aw-security-architecture
gh-aw-tools-ecosystem
gh-aw-workflow-authoring

Journalism & Media (4 skills)

editorial-standards
investigative-journalism
prospective-news-coverage
comparative-politics-reporting

Secure Development (3 skills)

secure-development-lifecycle
secure-development-policy
compliance-checklist

Government & Regulatory (5 skills) ⬆️ EXPANDED

global-government-analysis
myndigheter-monitoring
regulatory-affairs
economic-policy-analysis
seo-best-practices ✨ NEW (2026-04-22) - Canonical URLs, sitemap, robots.txt, technical SEO

Detailed Skill Descriptions

Available Skills

1. hack23-isms-compliance

Purpose: Ensure all work complies with Hack23's ISMS requirements (ISO 27001:2022, NIST CSF 2.0, CIS Controls v8.1)

Key Principles:

Security by Design
Compliance as Code
Transparency First
Risk-Based Approach

Enforces:

Required documentation portfolio (SECURITY_ARCHITECTURE.md, THREAT_MODEL.md, etc.)
Compliance framework mapping (ISO 27001 Annex A, NIST CSF functions, CIS Controls)
DevSecOps requirements (CI/CD security, scanning, access control)
STRIDE threat modeling
Audit evidence collection

When to Use:

Any security-related task
Documentation updates
Architecture changes
Compliance reviews
Audit preparation

2. security-by-design

Purpose: Apply security-by-design principles from project inception

Key Principles:

Secure by Default
Defense in Depth
Least Privilege
Fail Securely
Don't Trust User Input
Keep Security Simple
Separation of Duties
Economy of Mechanism

Enforces:

Security considered in all design decisions
Multiple layers of security controls
Minimal necessary permissions
Secure failure modes
Input validation everywhere
Simple, auditable security mechanisms

When to Use:

Designing new features
Architecture reviews
Security enhancements
Code reviews
Threat modeling

3. static-site-security

Purpose: Security best practices specific to static HTML/CSS websites on GitHub Pages

Key Principles:

Leverage eliminated server-side attack vectors (no server-side SQL injection/CSRF and greatly reduced XSS surface)
Minimize attack surface
Secure transport layer (TLS 1.3, HTTPS-only)
Implement security headers
Content security and integrity

Enforces:

HTTPS-only with TLS 1.3
Comprehensive security headers (CSP, HSTS, X-Frame-Options, etc.)
Subresource Integrity (SRI) for CDN resources
Minimal dependencies
Access control for repository
Security monitoring and alerting

When to Use:

Static site development
Security configuration
Deployment setup
Security reviews
Incident response

4. ci-cd-security

Purpose: Security-hardened CI/CD pipelines using GitHub Actions

Key Principles:

Least Privilege Permissions
Pin Actions to SHA
Harden Runner (egress auditing)
Secrets Management
Supply Chain Security

Enforces:

Minimal workflow permissions
SHA-pinned action versions (never tags)
step-security/harden-runner on all jobs
Proper secrets handling (never echo)
Dependency scanning (Dependabot, CodeQL)
Quality gates that fail on security issues

When to Use:

Creating workflows
Workflow security reviews
CI/CD optimization
Supply chain hardening
Security scanning setup

5. documentation-standards

Purpose: Consistent, high-quality technical documentation following C4 model and Hack23 standards

Key Principles:

Clarity First
Consistency
Visual Communication
Completeness
Maintenance

Enforces:

Standard document structure (version, classification, owner, review date)
C4 architecture model (Context, Container, Component levels)
Professional Mermaid diagrams
Document control metadata
Cross-references to related docs

When to Use:

Creating documentation
Architecture diagrams
Documentation reviews
Knowledge transfer
Onboarding materials

6. html-accessibility

Purpose: Ensure websites meet WCAG 2.1 Level AA accessibility standards

Key Principles (POUR):

Perceivable: Content must be presentable to all users
Operable: Interface must be operable by all
Understandable: Information must be understandable
Robust: Content must work with assistive technologies

Enforces:

Semantic HTML5 markup
Alt text for all images
Sufficient color contrast (4.5:1 for normal text, 3:1 for large)
Keyboard navigation support
ARIA attributes where appropriate
Visible focus indicators

When to Use:

HTML development
UI/UX design
Accessibility audits
Quality reviews
User testing

7. multi-language-localization

Purpose: Proper internationalization (i18n) and localization (l10n) for multi-language sites

Key Principles:

Language Declaration
Proper File Structure
Language Switcher
RTL Support
Cultural Considerations

Enforces:

Correct lang attribute on all pages
Separate HTML files per language (index_sv.html, etc.)
Proper hreflang tags for SEO
RTL layout support (Arabic, Hebrew)
Cultural formatting (dates, numbers, currency)

When to Use:

Multi-language implementation
Translation management
RTL language support
SEO optimization
Cultural adaptation

8. hack23-future-architecture-standards ✨ NEW (2026-02-11)

Purpose: Complete standards for creating FUTURE_ARCHITECTURE.md documents following CIA Compliance Manager gold standard

Key Principles:

Comprehensive Future State Planning
C4 Model Architecture (Context + Container diagrams)
AWS Well-Architected Framework Alignment (5 pillars)
Multi-Region Strategy Documentation
Pure Technical Architecture (no business/monetary content)

Enforces:

Document structure: minimum 800 lines (target 1,000-1,300)
Related documentation table: 16 documents (8 current + 8 future)
C4 diagrams: Context + Container with focus statements
AWS Well-Architected: All 5 pillars (Security, Reliability, Performance, Cost Optimization, Operational Excellence)
AWS Security Services: 7 core services (IAM, Cognito, GuardDuty, Security Hub, WAF, KMS, CloudTrail)
Multi-region architecture: Active-Active or Active-Passive with DynamoDB Global Tables
Mermaid diagrams: Minimum 8 diagrams with consistent color scheme
Migration roadmap: 4-phase plan with timeline and technical milestones
Comprehensive conclusion: 400-600 words summarizing technical vision

Standards Include:

Header format with version, date, status (X.X-DRAFT)
Executive summary (100-200 words)
Current vs Future comparison (v1.0 → v2.0)
Architectural vision with core principles (8-12 principles)
Security services integration diagrams
Multi-region deployment topology
DynamoDB Global Tables configuration
Route 53 health checks and failover
Risk mitigation strategies

Reference Implementation:

CIA Compliance Manager: 1,326 lines, 65 KB, 15+ diagrams
URL: https://github.com/Hack23/cia-compliance-manager/blob/main/docs/architecture/FUTURE_ARCHITECTURE.md

When to Use:

Creating new FUTURE_ARCHITECTURE.md documents
Updating existing future architecture documentation
Planning AWS serverless migrations
Documenting multi-region strategies
Compliance with Hack23 documentation standards

9. political-science-analysis

Purpose: Apply comparative politics, political behavior, public policy analysis frameworks to Swedish political data

Key Principles:

Objectivity and Non-Partisanship
Evidence-Based Analysis
Multi-Source Verification
Democratic Theory Application
Swedish Political System Context

Enforces:

Balanced coverage of all parties
Comparative political frameworks
Democratic quality indicators
Policy cycle analysis
Voting behavior analysis

When to Use:

Political dashboard design
Voting pattern analysis
Coalition stability assessment
Policy impact evaluation
Democratic accountability metrics

10. osint-methodologies

Purpose: OSINT collection, source evaluation, data integration for Swedish political intelligence

Key Principles:

Public Sources Only
Source Reliability Assessment (NATO Admiralty Code)
Data Quality Metrics
Source Triangulation
GDPR Compliance

Enforces:

riksdag-regering-mcp as primary data source
Multi-source verification
Completeness/accuracy/timeliness tracking
Ethical OSINT collection
Privacy-by-design

When to Use:

Data source integration
Data quality validation
Source credibility assessment
OSINT collection strategies

11. intelligence-analysis-techniques

Purpose: Structured analytic techniques (ACH, SWOT, Devil's Advocacy) for political intelligence

Key Principles:

Analysis of Competing Hypotheses
SWOT Analysis
Red Team Thinking
Key Assumptions Check
Confidence Level Assessment

Enforces:

Multiple hypothesis consideration
Structured reasoning
Bias mitigation
Diagnostic evidence focus
Uncertainty communication

When to Use:

Election forecasting
Coalition prediction
Policy outcome assessment
Crisis analysis

12. swedish-political-system

Purpose: Swedish Riksdag structure, 8 parties, electoral system, government formation

Key Principles:

Parliamentary Democracy
Negative Parliamentarism
Proportional Representation
Consensus-Seeking Culture
Public Access Principle (Offentlighetsprincipen)

Enforces:

349 MPs, 15 committees
8 parliamentary parties
4% electoral threshold
Coalition formation patterns
Parliamentary procedures

When to Use:

Political data interpretation
Coalition analysis
Electoral analysis
Government formation

13. electoral-analysis

Purpose: Election forecasting, campaign analysis, coalition prediction

Key Principles:

Historical Trend Analysis
Polling Aggregation
Seat Projection Modeling
Coalition Viability Assessment
Confidence Intervals

Enforces:

Historical data (1970-present)
Uncertainty quantification
Methodology transparency
Scenario modeling

When to Use:

Election forecasts
Campaign tracking
Coalition predictions
Voter behavior modeling

14. behavioral-analysis

Purpose: Political psychology, cognitive biases, leadership analysis

Key Principles:

Cognitive Bias Recognition
Leadership Styles
Group Dynamics
Political Psychology
Behavioral Profiling

Enforces:

Evidence-based psychological analysis
MP behavioral profiles
Influence network analysis
Coalition psychology

When to Use:

MP profiling
Leadership assessment
Coalition dynamics
Decision-making analysis

15. strategic-communication-analysis

Purpose: Narrative analysis, media bias detection, information operations

Key Principles:

Narrative Identification
Media Analysis
Discourse Analysis
Counter-Disinformation
Fact-Checking

Enforces:

Objective communication analysis
Source credibility assessment
Disinformation detection
Transparent methodologies

When to Use:

Media monitoring
Narrative tracking
Disinformation detection
Communication strategy assessment

16. legislative-monitoring

Purpose: Voting patterns, bill tracking, committee effectiveness, parliamentary oversight

Key Principles:

Voting Record Analysis
Legislative Pipeline Tracking
Committee Productivity
Parliamentary Oversight
Accountability Mechanisms

Enforces:

Comprehensive vote tracking
Bill lifecycle monitoring
Committee effectiveness metrics
Government oversight assessment

When to Use:

Voting pattern analysis
Bill tracking
Committee analysis
Oversight effectiveness

17. risk-assessment-frameworks

Purpose: Political risk indicators, corruption detection, early warning systems

Key Principles:

Electoral Risk
Policy Risk
Institutional Risk
Corruption Risk
External Risk

Enforces:

45 risk rules framework
Severity classification
Risk scoring methodology
Early warning indicators

When to Use:

Risk assessment
Corruption indicators
Democratic stability
Accountability gaps

18. data-science-for-intelligence

Purpose: Statistical analysis, data visualization, pattern recognition for political intelligence

Key Principles:

Statistical Rigor
CSS-Only Visualization
Pattern Recognition
Network Analysis
WCAG 2.1 AA Accessibility

Enforces:

Responsive HTML/CSS dashboards
No JavaScript frameworks
Accessible visualizations
Data quality validation

When to Use:

Dashboard design
Data visualization
Pattern analysis
Statistical modeling

19. gdpr-compliance

Purpose: GDPR compliance for political data processing, privacy-by-design

Key Principles:

Public Interest Basis (Article 6(1)(e))
Special Category Data (Article 9)
Data Subject Rights
Privacy-by-Design
Data Minimization

Enforces:

GDPR Article 6(1)(e) compliance
No personal data beyond official capacity
No tracking/cookies
HTTPS-only
Transparent data usage

When to Use:

Political data processing
Privacy assessments
Data collection strategies
Compliance verification

20. cis-controls ✨ NEW

Purpose: CIS Controls v8.1 critical security controls for static HTML/CSS websites on GitHub Pages

Key Principles:

Asset Inventory (repositories, domains, CDN)
Secure Configuration (GitHub Pages, security headers)
Access Control (branch protection, MFA)
Audit Logging (GitHub audit logs)
Application Security (HTML/CSS validation, dependency scanning)

Enforces:

Control 1: Asset management (GitHub repo, domain, DNS)
Control 4: Secure configuration (CSP, HSTS, X-Frame-Options)
Control 6: Access control management (GitHub permissions)
Control 8: Audit log management
Control 16: Application software security (validation, scanning)

When to Use:

Security hardening
Compliance assessments
GitHub Pages configuration
Security baseline establishment

21. iso-27001-controls ✨ NEW

Purpose: ISO 27001:2022 Annex A controls for static HTML/CSS websites

Key Principles:

Organizational Controls (A.5)
Technical Controls (A.8)
Development Controls (A.14)
Incident Management (A.16)

Enforces:

A.8.3: Access restrictions via GitHub permissions
A.8.23: Web filtering (CSP, security headers)
A.8.24: Cryptography (TLS 1.3, HTTPS-only)
A.8.28: Secure coding (HTML5/CSS3 validation)
A.14.2.8: Security testing (validation, scanning)

When to Use:

ISMS audits
Security architecture changes
ISO 27001 certification prep
Control implementation verification

22. nist-csf-mapping ✨ NEW

Purpose: NIST Cybersecurity Framework 2.0 mapping for static sites

Key Principles:

IDENTIFY: Asset management, risk assessment
PROTECT: Access control, data security
DETECT: Continuous monitoring, adverse events
RESPOND: Incident analysis, mitigation
RECOVER: Recovery planning, communications

Enforces:

ID.AM: Repository and domain inventory
PR.AC: GitHub MFA, branch protection
PR.DS: HTTPS-only, no cookies
DE.CM: GitHub audit logs, Dependabot
RC.RP: Git history backups, rollback procedures

When to Use:

Security architecture reviews
Compliance assessments
Risk management
Control mapping

23. threat-modeling ✨ NEW

Purpose: STRIDE threat modeling for static HTML/CSS websites on GitHub Pages

Key Principles:

Spoofing (domain hijacking, DNS attacks)
Tampering (repository compromise)
Repudiation (audit trail integrity)
Information Disclosure (secret leaks)
Denial of Service (DDoS protection)
Elevation of Privilege (access control)

Enforces:

HTTPS and DNSSEC
Branch protection and GPG signing
GitHub audit logs
Secret scanning
GitHub Pages CDN protection
Minimal workflow permissions

When to Use:

Security design
Threat analysis
Risk assessments
ISMS compliance (ISO A.12.6)

24. secure-code-review ✨ NEW

Purpose: Security code review for HTML/CSS/JavaScript in static websites

Key Principles:

HTML Security (no inline scripts, CSP compliance)
CSS Security (no external imports, no user-controlled CSS)
Link Security (HTTPS-only, link integrity)
Configuration Security (no secrets, minimal permissions)

Enforces:

No inline JavaScript (CSP compliance)
External links use rel="noopener noreferrer"
All links HTTPS
Secret scanning
Workflow permissions minimal

When to Use:

PR reviews
Security audits
Code contributions
XSS prevention

25. security-documentation ✨ NEW

Purpose: ISMS security documentation standards for Hack23 projects

Key Principles:

Current State (SECURITY_ARCHITECTURE.md)
Future State (FUTURE_SECURITY_ARCHITECTURE.md)
Threat Analysis (THREAT_MODEL.md)
System Design (ARCHITECTURE.md)
Security Policy (SECURITY.md)

Enforces:

C4 diagrams (Context, Container, Component)
Mermaid workflows
Compliance mapping (ISO/NIST/CIS)
Document control metadata
Classification marking

When to Use:

Architecture changes
Security control updates
ISMS audits
Compliance documentation

26. c4-architecture-documentation ✨ NEW

Purpose: C4 architecture model for documenting static sites with MCP integrations

Key Principles:

Context Diagram (system and users)
Container Diagram (technology choices)
Component Diagram (internal structure)
Code Diagram (class/interface level)

Enforces:

Mermaid C4 diagrams
Technology stack documentation
MCP server integration diagrams
Deployment pipeline documentation

When to Use:

ARCHITECTURE.md updates
System design documentation
MCP server integration
Technology decisions

27. github-actions-workflows ✨ NEW

Purpose: GitHub Actions workflow patterns for static site CI/CD

Key Principles:

Quality Checks (HTML/CSS validation, link checking)
Security Scanning (CodeQL, Dependabot, secret scanning)
Deployment (GitHub Pages publishing)
Minimal Permissions (least privilege)

Enforces:

HTMLHint validation
linkinator link checking
CodeQL security analysis
Dependency scanning
Least privilege permissions
SHA-pinned actions

When to Use:

CI/CD pipeline design
Workflow optimization
Security hardening
Quality gate implementation

28. code-quality-checks ✨ NEW

Purpose: Quality gates for static HTML/CSS websites

Key Principles:

HTML Validation (HTMLHint, 0 errors)
CSS Validation (CSSLint, warnings only)
Link Integrity (linkinator, 0 broken links)
Accessibility (axe-core, WCAG 2.1 AA)
Performance (Core Web Vitals, PageSpeed Insights)

Enforces:

0 HTML validation errors
0 broken links
0 WCAG 2.1 AA violations
4.5:1 color contrast minimum
90+ PageSpeed score

When to Use:

PR reviews
Quality assurance
Pre-deployment checks
Continuous monitoring

29. secrets-management ✨ NEW

Purpose: GitHub secrets and environment variables for MCP servers and CI/CD

Key Principles:

GitHub Secrets (Actions, Environment)
Secret Scanning (automatic detection)
Secret Rotation (90-day cycle)
Least Privilege (minimal scopes)
Audit Logging (secret access tracking)

Enforces:

COPILOT_MCP_GITHUB_PERSONAL_ACCESS_TOKEN configuration
Environment-specific secrets (copilot environment)
.gitignore for sensitive files
Secret scanning enabled
90-day rotation policy

When to Use:

MCP server configuration
CI/CD workflow setup
Secret rotation
Security audits

29. responsive-design ✨ NEW

Purpose: Mobile-first responsive web design with CSS Grid/Flexbox, breakpoints (320px-1440px+)

Key Principles:

Mobile-First Design
Fluid Typography (clamp())
Flexible Layouts (Grid/Flexbox)
Touch-Friendly (44x44px targets)
Performance Optimized
Content Priority

Enforces:

Standard breakpoints (320px, 768px, 1024px, 1440px+)
Fluid typography with clamp()
CSS Grid for layouts
44x44px minimum touch targets
Viewport meta tag required
Max-width constraint for ultra-wide

When to Use:

All HTML/CSS development
New feature implementation
Dashboard design
Navigation redesign
Mobile optimization
Cross-device testing

30. design-system-management ✨ NEW

Purpose: Cyberpunk theme design system with CSS custom properties and component library

Key Principles:

Single Source of Truth (CSS variables)
Component-Based Architecture
Theme Consistency
Accessibility Built-In
Responsive Scaling
Performance Focused

Enforces:

CSS custom properties for all design tokens
Cyberpunk color palette (cyan, magenta, yellow on dark)
Fluid typography and spacing scales
Reusable component patterns
4.5:1 color contrast minimum
Neon glow effects

When to Use:

New page creation
Component development
UI refactoring
Theme updates
Accessibility enhancements
Style standardization

31. political-data-visualization ✨ NEW

Purpose: CSS-only data visualization (charts, heat maps, progress bars) for political metrics

Key Principles:

CSS-Only (no JavaScript)
Accessibility First (WCAG 2.1 AA)
Semantic Markup
Progressive Disclosure
Color-Blind Safe
Responsive Design

Enforces:

Progress bars for voting discipline
Bar charts for MP/party distribution
Heat maps for voting patterns
Donut charts for coalitions
Timeline visualizations
Swedish party color palette
Screen reader support

When to Use:

Dashboard design
Party analysis visualizations
Voting record displays
Committee activity metrics
MP profile timelines
Risk assessment indicators

32. playwright-testing ✨ NEW

Purpose: Browser automation, visual regression testing, screenshot capture for static websites

Key Principles:

Headless First
Visual Evidence
Accessibility Integration (axe-core)
Cross-Browser Coverage
Responsive Testing
Performance Monitoring

Enforces:

Xvfb display for headless rendering
Screenshot capture on all tests
WCAG 2.1 AA audits with axe-playwright
Multi-language testing (14 languages)
Responsive viewport testing
Core Web Vitals measurement

When to Use:

Quality assurance automation
Visual regression detection
Accessibility audits
Cross-browser testing
Issue validation with evidence
Performance monitoring

33. issue-management ✨ NEW

Purpose: GitHub issue creation, labeling, milestones, agent assignment for product management

Key Principles:

Clarity First
Actionable Items
Properly Labeled
Traceable
Evidence-Based
Agent-Optimized

Enforces:

Structured issue templates
Clear acceptance criteria
Type/priority/area/agent labels
Screenshot/log evidence
Related issue linking
Copilot agent assignment format

When to Use:

Bug reports
Feature requests
Security issues
Accessibility issues
Technical debt tracking
Agent task delegation

34. riksdag-regering-mcp ✨ NEW

Purpose: 32 specialized tools for Swedish political data via riksdag-regering-mcp MCP server

Key Principles:

Authoritative Data Source
Comprehensive Coverage (50+ years)
Structured API
Real-Time Access
GDPR Compliance
Multi-Source Integration

Available Tools:

Search & Discovery (6 tools): MPs, documents, speeches, votes
Detailed Information (6 tools): Document content, MP profiles
Parliamentary Documents (6 tools): Motions, propositions, reports
Government Documents (4 tools): SOU, Dir, propositions
Analytics & Aggregation (5 tools): Voting groups, reports
Advanced Queries (5 tools): Pagination, batch fetching

When to Use:

Political intelligence analysis
Legislative monitoring
MP profiling and analysis
Coalition behavior assessment
Policy research and tracking
Voting pattern analysis
Government oversight
Electoral research

How Skills Feed the News Aggregator

The news-generation pipeline (scripts/aggregate-analysis.ts → scripts/render-articles.ts → scripts/render-lib/) derives every published article from three static inputs — analysis/methodologies/, analysis/templates/, and the per-day analysis/daily/$DATE/$SUB/*.md artifacts — and skills shape all three. During the analysis phase of every per-type news workflow, the agent loads the relevant skills and uses them to author artifacts that the aggregator can consume without modification: automated-content-generation dictates the section schema each artifact must hit (executive-brief, synthesis, significance, stakeholders, SWOT, scenarios, comparative, intel-assessment, classification); editorial-standards governs tone, inverted-pyramid structure, attribution, and the rule that every factual claim must cite a specific Riksdag/Regering source; and data-pipeline-engineering provides the contract for how MCP query results are cached, deduplicated, and inlined into artifacts so the aggregator's SHA-256 manifest remains reproducible. These three skills are therefore primary for the aggregator flow — an artifact authored with them drops into analysis/daily/$DATE/$SUB/ and is published as news/$DATE-$SUB-{en,sv}.html on the next CI run with zero manual intervention, no template fill-in, and no post-hoc HTML editing.

How Skills Work

Automatic Loading

Skills are automatically loaded by Copilot when relevant to the task. You don't need to explicitly reference them.

Skill Discovery

Copilot determines skill relevance based on:

Task description
File paths being modified
Agent being used
Keywords in instructions

Skill Structure

Each skill follows this structure:

---
name: skill-name
description: Brief description of skill purpose
license: Apache-2.0
---

# Skill Title

## Purpose
[Why this skill exists]

## Core Principles
[High-level guiding principles]

## Enforces
[Specific rules and standards]

## When to Use
[Scenarios where skill applies]

## Examples
[Concrete examples]

## Remember
[Key takeaways]

## References
[External resources]

Skill Hierarchy

Skills follow a hierarchy from strategic to tactical:

Level 1 (Strategic): hack23-isms-compliance
  ├─ Level 2 (Architectural): security-by-design
  │   ├─ Level 3 (Technical): static-site-security
  │   └─ Level 3 (Technical): ci-cd-security
  │
  └─ Level 2 (Standards): documentation-standards
      ├─ Level 3 (Technical): html-accessibility
      └─ Level 3 (Technical): multi-language-localization

Best Practices

For Users

Trust the Skills: Agents automatically apply skills - you don't need to reference them
Be Specific: Provide clear task descriptions to help skill discovery
Review Results: Verify agents followed skill guidelines
Provide Feedback: Improve skills based on agent outcomes

For Skill Authors

Strategic, Not Tactical: Focus on principles, not step-by-step instructions
Rule-Based: Clear, enforceable rules
Examples Matter: Show good and bad patterns
Keep Updated: Evolve skills as standards change
Cross-Reference: Link to relevant ISMS policies and standards

Skill Development

Creating a New Skill

Identify Need: What knowledge gap exists?
Define Scope: What should this skill cover?
Write Principles: What are the high-level rules?
Add Examples: Show concrete applications
Document Use Cases: When should this apply?
Test: Verify agents use the skill correctly

Skill Template

---
name: your-skill-name
description: Brief description (max 200 chars)
license: Apache-2.0
---

# Skill Title

## Purpose
Why this skill exists and what problem it solves.

## Core Principles
1-5 high-level guiding principles

## Enforces
Specific rules, standards, and requirements

## When to Use
Scenarios and contexts where skill applies

## Examples
### Good Pattern
[Example]

### Anti-Pattern
[Counter-example]

## Remember
Key takeaways (3-5 bullet points)

## References
External resources and standards

Quality Standards for Skills

All skills must:

✅ Have valid YAML frontmatter
✅ Include clear purpose statement
✅ Define strategic principles (not step-by-step instructions)
✅ Provide concrete examples
✅ Specify when to apply
✅ Reference authoritative sources
✅ Follow Hack23 ISMS requirements
✅ Use inclusive, accessible language

Integration with Agents

Agents are configured to automatically discover and use skills:

# Agent configuration includes skill discovery
tools: ["view", "edit", "create", "search", "bash", "grep", "glob"]

# Agents have access to .github/skills/ directory
# Skills load automatically based on context

Relationship to Hack23 ISMS

All skills align with Hack23's public ISMS:

Skills operationalize ISMS policies into practical, actionable guidance for agents.

Compliance Framework Mapping

Skills enforce compliance with:

ISO 27001:2022: Annex A controls
NIST CSF 2.0: Six functions (GOVERN, IDENTIFY, PROTECT, DETECT, RESPOND, RECOVER)
CIS Controls v8.1: Implementation Groups 1-3
WCAG 2.1: Level AA accessibility
W3C Standards: HTML5, CSS3, i18n/l10n

Troubleshooting

Skill Not Being Applied

Verify skill file exists in .github/skills/
Check YAML frontmatter is valid
Ensure SKILL.md filename is correct
Review skill description for keyword matching

Conflicting Skills

Skills are applied in hierarchy order (strategic → tactical)
More specific skills override general ones
Document exceptions in custom instructions

Updating Skills

Update skill file in .github/skills/
Changes take effect on next agent invocation
Test with sample task to verify changes
Document changes in commit message

New Skills Details (2026-02-11)

38. ui-ux-design ✨ NEW

Purpose: Comprehensive user experience and interface design for political transparency platforms

Key Capabilities:

User research and persona development (journalists, researchers, citizens, policymakers)
Information architecture and site structure optimization
WCAG 2.1 AA accessibility compliance (mandatory)
Mobile-first responsive design (320px-1920px+)
Cyberpunk theme design system implementation
Usability testing and A/B testing strategies
Core Web Vitals optimization (LCP, FID, CLS)
Multi-language UI considerations (14 languages, RTL support)

When to Use:

Designing new features or pages
UI/UX improvements and optimization
Accessibility audits and remediation
Usability testing and user research
Design system updates
Performance optimization
Multi-language UI enhancements

Related Skills: responsive-design, design-system-management, html-accessibility, multi-language-localization

44. marketing ✨ NEW

Purpose: Strategic marketing for promoting political transparency platforms and driving adoption

Key Capabilities:

SEO optimization (technical, content, link building)
Content marketing strategy and calendar
Social media engagement (Twitter/X, LinkedIn, Mastodon)
Analytics and measurement (Google Analytics, KPIs)
Media relations and press kit development
Growth strategies (short, medium, long-term)
Brand guidelines and messaging framework
Compliance and ethical marketing (GDPR, neutrality)

When to Use:

SEO optimization across all language versions
Content strategy and planning
Social media campaigns
Media outreach and partnerships
Growth initiatives and user acquisition
Brand development and positioning
Analytics review and optimization

Target Audiences: Citizens, journalists, researchers, policymakers, international users

45. business-development ✨ NEW

Purpose: Strategic growth, partnerships, and sustainable revenue models for open-source platforms

Key Capabilities:

Stakeholder engagement and partnership strategies
Revenue models (freemium, enterprise SaaS, grants, consulting)
Community building (open-source and user communities)
Target stakeholder analysis (journalists, academics, NGOs, corporate, citizens)
Sales funnel and outreach strategies
Business risk management
Ethical boundaries and transparency commitments

When to Use:

Partnership development and evaluation
Revenue strategy and business model design
Community engagement and growth
Enterprise sales and consulting services
Grant applications and funding strategies
Stakeholder communication
Business planning and sustainability

Revenue Streams: Enterprise licenses, research grants, consulting, partnerships, ethical sponsorships

46. language-expertise ✨ NEW

Purpose: Comprehensive linguistic and cultural expertise for all 14 supported languages

Supported Languages:

Latin Script (LTR): English (en), Swedish (sv), Danish (da), Norwegian (no), Finnish (fi), German (de), French (fr), Spanish (es), Dutch (nl)
RTL Languages: Arabic (ar), Hebrew (he)
Asian Scripts: Japanese (ja), Korean (ko), Chinese (zh)

Key Capabilities:

Native-level translation quality and domain expertise
Cultural appropriateness and political sensitivities
Technical correctness (UTF-8, RTL, fonts, formatting)
Language-specific style guidelines and terminology
Translation workflow and quality assurance
Accessibility (screen readers, font selection)
SEO (hreflang tags, multilingual sitemaps)
Cultural considerations (colors, symbols, formats)

When to Use:

Creating or updating content in any of 14 languages
Translation and localization tasks
Cultural adaptation and sensitivity reviews
RTL layout implementation (Arabic, Hebrew)
Multi-language SEO optimization
Font and typography selection
Date/number/currency formatting
Political terminology translation

Critical Features: RTL support for Arabic/Hebrew, CJK font support, cultural color symbolism, political neutrality across all languages

Skill Usage Guidelines

When to Apply Multiple Skills

Many tasks benefit from combining multiple skills:

Example 1: New Dashboard Feature

ui-ux-design - User research, wireframes, usability testing
responsive-design - Mobile-first layout implementation
html-accessibility - WCAG 2.1 AA compliance
advanced-data-visualization - Chart.js/D3.js implementation
language-expertise - Multi-language labels, RTL support
marketing - SEO optimization, social sharing

Example 2: Content Creation

automated-content-generation - Template-based article generation
language-expertise - Translation to all 14 languages
editorial-standards - Fact-checking, AP style compliance
marketing - SEO optimization, social media promotion
html-accessibility - Accessible article structure

Example 3: Business Growth Initiative

business-development - Partnership strategy, revenue models
marketing - SEO, content marketing, social media
ui-ux-design - User research, conversion optimization
data-science-for-intelligence - Analytics and insights
language-expertise - International market expansion

Skill Maintenance

Adding New Skills

Create directory in .github/skills/SKILL-NAME/
Create SKILL.md with YAML frontmatter
Include comprehensive guidance and examples
Update this SKILLS.md catalog
Update README.md if adding new category

Updating Existing Skills

Maintain version history in skill file
Update last modified date
Cross-reference related skills
Keep examples current with repository state

Quality Standards

✅ Clear purpose statement
✅ Comprehensive capabilities list
✅ Concrete examples and code snippets
✅ "When to Use" guidance
✅ Related skills cross-references
✅ Compliance with Hack23 standards

Last Updated: 2026-04-22
Total Skills: 91
New Skills (2026-02-20 → 2026-04-22): 18 skills added from Hack23 repos (security, development, governance, platform, design); +4 since 2026-02-20 (business-model-canvas, mcp-gateway-configuration, mcp-gateway-security, seo-best-practices per catalog reconciliation)
Maintained by: Hack23 AB

🌐 IMF as Primary Economic-Data Canon (Cross-Skill Rule)

Effective: 2026-04-24 · Owner: CEO · Authority: .github/aw/ECONOMIC_DATA_CONTRACT.md v2.1

Every skill that touches economic-data analysis (electoral, risk, comparative-politics, OSINT, data-science, economic-policy, intelligence-analysis-techniques) MUST default to IMF as the primary economic-data source. World Bank citations are reserved for governance, environment and social residue. SCB is the Swedish-specific ground truth layer.

Authoritative IMF references for skills

analysis/imf/README.md · analysis/imf/agentic-integration.md · analysis/imf/indicators-inventory.json · analysis/imf/data-dictionary.md · .github/aw/ECONOMIC_DATA_CONTRACT.md

Skills affected (by economic-data dependency)

Skill	IMF dataflows used	WB residue used	SCB use
`economic-policy-analysis`	WEO · FM · IFS · BOP · DOTS · GFS_COFOG	None — full IMF	SCB monthly KPI/AKU
`electoral-analysis`	WEO (growth, unemployment, inflation as electoral conditions)	None	SCB regional
`risk-assessment-frameworks`	WEO + FM (debt, deficit, projections)	WGI governance	SCB budget execution
`comparative-politics-reporting`	WEO + FM (cross-country Nordic peers)	WGI for governance benchmarks	—
`osint-methodologies`	IMF graded A1/A2 (Admiralty); cite WEO/FM as primary economic sources	WB graded A1 for governance	SCB graded A1 for SE-specific
`data-science-for-intelligence`	IMF for cross-country panels; vintage-discipline as data-quality control	WB for non-economic panels	SCB for SE-specific
`intelligence-analysis-techniques`	IMF projections feed scenario analysis (T+5)	—	—
`legislative-monitoring`	IMF GFS_COFOG for committee-aligned spending (FöU/SoU/UbU/SfU)	—	SCB budget execution
`behavioral-analysis`	IMF macro context as backdrop for political behaviour	—	—
`business-model-canvas`	IMF for market/macro context	—	—
`gh-aw-mcp-configuration`	IMF is CLI-not-MCP (intentional) — `tsx scripts/imf-fetch.ts`	`worldbank-mcp` for residue	`scb-mcp` for SE

Canonical rule. Every economic claim in a Riksdagsmonitor article cites an IMF dataflow first; World Bank citations are reserved for governance, environment and social residue (the classes IMF does not publish). SCB is the Swedish-specific ground truth layer. See ECONOMIC_DATA_CONTRACT.md v2.1 for the banned-phrase list and vintage discipline (>6 mo → annotation).

🔗 Hack23 Ecosystem

🌐 Platforms	📦 Open-Source Projects	🛡️ Governance & Standards
🗳️ Riksdagsmonitor — Swedish Parliament intelligence 🇪🇺 EU Parliament Monitor — European coverage 🕵️ Citizen Intelligence Agency — political-data engine 🌐 Hack23 AB — corporate site 📰 Hack23 Blog — engineering & policy 💼 Hack23 on LinkedIn	🗳️ Hack23/riksdagsmonitor 🕵️ Hack23/cia 🇪🇺 Hack23/euparliamentmonitor 🔌 Hack23/european-parliament-mcp ✅ Hack23/cia-compliance-manager 🥋 Hack23/black-trigram 🏠 Hack23/homepage	🛡️ Hack23 ISMS-PUBLIC — public ISMS 🔒 Information Security Policy 🤖 AI Policy 🧪 Secure Development Policy 🎯 Threat Modeling Policy ⚠️ Vulnerability Management 🏷️ Classification Framework

🗳️ Empower citizens · 🔍 Strengthen democratic accountability · 🕵️ Illuminate the political process

FilesExpand file tree

SKILLS.md

Latest commit

History

SKILLS.md

File metadata and controls

🎯 Riksdagsmonitor — Agent Skills Guide

Overview

What Are Skills?

Available Skills (91 Total) ✨ UPDATED 2026-04-22

Core Infrastructure (9 skills) ⬆️ EXPANDED

Political Intelligence (11 skills)

ISMS & Security (12 skills) ⬆️ EXPANDED

Development & Operations (16 skills) ⬆️ EXPANDED

UI/UX & Design (7 skills) ⬆️ EXPANDED

Testing & Quality Assurance (2 skills)

Data Integration (6 skills) ⬆️ EXPANDED

Business & Marketing (3 skills)

Language & Localization (1 skill)

GitHub Agentic Workflows (12 skills)

Journalism & Media (4 skills)

Secure Development (3 skills)

Government & Regulatory (5 skills) ⬆️ EXPANDED

Detailed Skill Descriptions

Available Skills

1. hack23-isms-compliance

2. security-by-design

3. static-site-security

4. ci-cd-security

5. documentation-standards

6. html-accessibility

7. multi-language-localization

8. hack23-future-architecture-standards ✨ NEW (2026-02-11)

9. political-science-analysis

10. osint-methodologies

11. intelligence-analysis-techniques

12. swedish-political-system

13. electoral-analysis

14. behavioral-analysis

15. strategic-communication-analysis

16. legislative-monitoring

17. risk-assessment-frameworks

18. data-science-for-intelligence

19. gdpr-compliance

20. cis-controls ✨ NEW

21. iso-27001-controls ✨ NEW

22. nist-csf-mapping ✨ NEW

23. threat-modeling ✨ NEW

24. secure-code-review ✨ NEW

25. security-documentation ✨ NEW

26. c4-architecture-documentation ✨ NEW

27. github-actions-workflows ✨ NEW

28. code-quality-checks ✨ NEW

29. secrets-management ✨ NEW

29. responsive-design ✨ NEW

30. design-system-management ✨ NEW

31. political-data-visualization ✨ NEW

32. playwright-testing ✨ NEW

33. issue-management ✨ NEW

34. riksdag-regering-mcp ✨ NEW

How Skills Feed the News Aggregator

How Skills Work

Automatic Loading

Skill Discovery

Skill Structure

Skill Hierarchy

Best Practices

For Users

For Skill Authors

Skill Development

Creating a New Skill

Skill Template

Quality Standards for Skills

Integration with Agents

Relationship to Hack23 ISMS

Compliance Framework Mapping

Troubleshooting

Skill Not Being Applied

Conflicting Skills

Updating Skills