Hve Core Installer
MicrosoftOfficialPublished by Microsoft
- Skill
- Workflow
- Automation and integrations
- MIT
- Low risk
- Has scripts
AutoGineer summary
Written by AutoGineer from the skill’s own files, not by the author
The HVE-Core Installer is a guided, multi-phase tool designed to help users integrate HVE-Core components into their development environment. It supports multiple installation routes, including a direct plugin, team-wide defaults, native repository adoption, a VS Code extension, or a clone-based setup. The skill operates through two personas: an Installer that handles environment detection and execution, and a Validator that ensures the configuration is correctly recognized by Copilot. It includes robust checks for existing installations, environment-specific recommendations, and post-installation setup for MCP servers and repository settings.
What it does
- Detects existing HVE-Core installations and offers upgrade or cleanup paths.
- Provides a decision matrix to recommend the optimal installation method based on environment and team needs.
- Automates the installation of plugins, extensions, or repository-native component copies.
- Configures repository-level settings for team-wide HVE-Core availability.
- Validates installations to ensure agents and skills are correctly loaded in Copilot Chat.
- Handles post-installation tasks like gitignore updates and MCP server configuration.
When to use it
- When you need to integrate HVE-Core agents and skills into a new or existing project.
- When you require a team-wide, reproducible HVE-Core configuration.
- When you need to pin a specific version of HVE-Core for development or customization.
- When you want to migrate from an older, manual installation to a supported harness-based setup.
Advantages
- Flexible installation options tailored to specific development environments.
- Reduces configuration errors through automated validation and environment detection.
- Supports both plugin-based and native repository-owned installation models.
- Provides clear guidance on updating and maintaining HVE-Core components.
- Ensures compatibility with the Copilot harness by managing settings and cleanup.
Usage examples
- “Install HVE-Core in my project.”
- The agent initiates the environment detection phase, asks for consent, and presents the five available installation routes.
- “I want to set up HVE-Core for my whole team.”
- The agent recommends the Team Default route and guides the user through creating the necessary .github/copilot/settings.json file.
- “How do I update my HVE-Core installation?”
- The agent identifies the current installation route and provides the specific commands or steps required to perform an upgrade.
Install
Download the skill as a ZIP:
https://autogineer.com/agent-skills/microsoft/hve-core-installer/downloadUnzip it into the cross-client skills folder of your project:
mkdir -p .agents/skills && unzip hve-core-installer.zip -d .agents/skills
Documentation by Microsoft
HVE-Core Installer Skill
Decision-driven installer for HVE-Core in VS Code's Copilot agent harness. It recommends the HVE-Core plugin first, then a team default in .github/copilot/settings.json, then native repository adoption, which copies every HVE-Core component into the project's own .github folders.
The VS Code extension remains an editor option. A clone is a storage choice that Copilot uses as a plugin from source or, for a copy inside the project's checkout, through folders declared in .github/copilot/settings.json. The skill also validates the result and configures MCP servers.
Role Definition
Operate as two collaborating personas:
The Installer persona detects the environment, guides route selection, and executes installation steps
The Validator persona verifies installed folders and repository settings, then has the user confirm that HVE-Core agents and skills appear in Copilot Chat
The Installer persona handles all detection and execution. After installation completes, switch to the Validator persona to verify success before reporting completion.
Re-run Behavior: Running the installer again validates an existing installation or offers upgrade. Safe to re-run anytime.
Required Phases
| Phase | Name | Purpose |
|---|---|---|
| 1 | Environment Detection | Obtain consent and check for earlier HVE-Core installs |
| 2 | Install Route Selection | Choose the plugin, team default, native adoption, extension, or clone route |
| 3 | Environment Detection & Decision Matrix | For native adoption and clones: detect the environment and recommend where to keep the clone |
| 4 | Installation Methods | Clone HVE-Core and, for the clone route, connect the clone to Copilot |
| 5 | Validation | Verify the clone before it is used |
| 6 | Post-Installation Setup | Configure gitignore and MCP servers, then reload the window and check Copilot Chat |
| 7 | Component Installation | Native adoption: copy every component into the project's .github folders |
Flow paths:
Plugin, team default, and extension routes: Phase 1 → Phase 2 → Phase 6 → Complete
Native adoption: Phase 1 → Phase 2 → Phase 3 → Phase 4 → Phase 5 → Phase 7 → Phase 6 → Complete
Clone route: Phase 1 → Phase 2 → Phase 3 → Phase 4 → Phase 5 → Phase 6 → Complete
For native adoption from a clone the user already has, skip Phases 3 and 4 and validate that clone in Phase 5.
[!IMPORTANT] Install HVE-Core through one route at a time. Installing the same content through more than one route, for example the plugin and the extension, or the plugin and a declared clone, lists agents more than once in the subagent list, and Copilot does not remove copies that arrive by different routes.
Phase 1: Environment Detection
Before presenting options, obtain consent and check what is already installed.
Checkpoint 1: Initial Consent
Present the following and await explicit consent:
🚀 HVE-Core Installer
I'll help you install HVE-Core agents, instructions and skills.
Available content:
• Specialized agents, including RPI Agent, Documentation, and domain planners
• Technology-specific coding instructions (bash, python, markdown, etc.)
• Domain-specific skills (pr-reference, etc.)
I'll recommend an install route. If your route needs a clone, I'll ask 2-3 questions about your setup first.
Would you like to proceed?If user declines, respond: "Installation cancelled. You can invoke this skill anytime to restart."
Existing Install Check
Upon consent, look for HVE-Core content that is already installed:
.hve-tracking.jsonat the workspace root means components were copied into the repository. Offer to upgrade them through native adoption, which runs Phase 7 in upgrade mode..github/copilot/settings.jsonthat enableshve-core@hve-coreor declares folders from an HVE-Core clone means the team default or a declared clone is in place.Ask whether the user has installed the HVE-Core plugin or the HVE Core extension.
VS Code settings that list HVE-Core folders come from an earlier version of this installer. Note the files that hold them. Phase 6 offers the cleanup below once the user confirms HVE-Core in a Copilot session.
When a route is already active, ask whether to keep it or replace it before installing another. Then proceed to Phase 2.
Earlier Location Settings Cleanup
Earlier versions of this installer added HVE-Core folders to chat.agentFilesLocations, chat.instructionsFilesLocations, chat.agentSkillsLocations, chat.promptFilesLocations, and chat.hookFilesLocations. Those settings are editor-only: VS Code forwards files from those locations, but Copilot CLI and the GitHub Copilot app do not read them. Kept beside a new route, they deliver the same content twice.
HVE-Core supports only the Copilot harness. VS Code's Local harness doesn't load the skills: preloads that HVE-Core agents depend on, and removing these settings while the user still works in Local hides the agents Local found through them. Offer the cleanup only after the user confirms both of these:
Their chat sessions use the Copilot harness. VS Code shows the harness at the start of the chat title.
A Copilot session shows HVE-Core, using the agent and skill checks from the final completion report in Phase 6.
When the user is still on Local, explain that HVE-Core supports only the Copilot harness and that they switch by starting a new chat and selecting Copilot in the Session Target control before the first prompt. Keep the settings until the user confirms both points, and report "⏭️ Kept earlier location settings until a Copilot session shows HVE-Core".
Look in .vscode/settings.json, any .code-workspace file, and the customizations.vscode.settings block of .devcontainer/devcontainer.json for entries whose paths point into an HVE-Core clone, such as ../hve-core, .hve-core, /workspaces/hve-core, or lib/hve-core. For each file with such entries:
Show the user the HVE-Core entries it holds.
Get approval under Checkpoint 3 (see Authorization Guardrails).
Remove only the HVE-Core entries. Remove a setting only when it has no entries left, and leave unrelated entries alone.
Report "✅ Removed earlier HVE-Core location settings from [file]", or "⏭️ Kept earlier location settings in [file]" when the user declines.
After removing entries, ask the user to run Developer: Reload Window and repeat the agent and skill checks, so they confirm that the installed route, not the old settings, delivers HVE-Core.
Phase 2: Install Route Selection
Present the route choice before any environment detection. The plugin, team default, and extension routes need no shell selection or environment detection.
Checkpoint 2: Install Route Choice
Present the following choice:
<!-- <install-route-checkpoint> -->
🚀 Choose How to Install HVE-Core
**Option 1: Plugin (Recommended)**
Install the HVE-Core plugin with two commands in Copilot Chat.
• 📦 All agents, skills, and instructions
• 🔄 Updates from the Plugins page
**Option 2: Team Default**
I add .github/copilot/settings.json so Copilot offers the plugin
to everyone who opens this repository.
**Option 3: Copy into This Repository**
I copy every HVE-Core agent, skill, and instruction into your
.github folders. Your repository owns the copies.
**Option 4: VS Code Extension**
Install from the VS Code Marketplace. Its agents and skills reach
Copilot sessions, but its instructions may not.
**Option 5: Clone**
Keep a pinned copy of HVE-Core in a folder you choose, then
connect it to Copilot.
Use one route at a time. Which would you prefer? (1-5)<!-- </install-route-checkpoint> -->
User input handling:
"1", "plugin" → Plugin Route
"2", "team", "team default" → Team Default Route
"3", "copy", "adopt", "native", "components" → Native adoption: continue to Shell Selection and Prerequisites
"4", "extension", "vsix" → Extension Installation Execution
"5", "clone", "submodule" → Clone route: continue to Shell Selection and Prerequisites
Unclear response → Ask for clarification
Recommend a route other than the plugin when:
A team wants Copilot to offer HVE-Core to everyone who opens the repository (Option 2)
The repository should own and customize its copy of HVE-Core (Option 3)
The user needs a pinned copy of HVE-Core or plans to edit HVE-Core itself (Option 5)
Plugin Route
The plugin carries the full set: agents, skills, and path-specific instructions. Slash commands and editor controls need the user, so present these steps and wait for confirmation:
<!-- <plugin-install-steps> -->
📦 Install the HVE-Core Plugin
In Copilot Chat with the Copilot harness, send these commands one at a time:
/plugin marketplace add microsoft/hve-core
/plugin install hve-core@hve-core
Or open the Agent Customizations editor, select Plugins, add the
microsoft/hve-core marketplace, and install hve-core.
With Copilot CLI, run these commands in a terminal instead:
copilot plugin marketplace add microsoft/hve-core
copilot plugin install hve-core@hve-core
VS Code discovers plugins that Copilot CLI installs.
Reply "done" when the plugin is installed.<!-- </plugin-install-steps> -->
Run the Copilot CLI commands only when the user asks you to. After the user confirms, proceed to Phase 6.
Tell the user how to update later: select Check for and Apply Updates (the refresh icon) on the Plugins page, or run Chat: Update Plugins. With Copilot CLI, run copilot plugin marketplace update hve-core, then copilot plugin update hve-core@hve-core. After any update, run Developer: Reload Window.
Team Default Route
A project can commit .github/copilot/settings.json so the Copilot harness offers HVE-Core to everyone who opens the repository. Each person can turn optional plugins off on the Plugins page, and enterprise-managed settings take precedence over these defaults.
Get approval under Checkpoint 3, then create .github/copilot/settings.json with the content below. When the file already exists, merge the two keys into it and keep its other entries.
<!-- <team-default-settings> -->
{
"extraKnownMarketplaces": {
"hve-core": {
"source": {
"source": "github",
"repo": "microsoft/hve-core"
}
}
},
"enabledPlugins": {
"hve-core@hve-core": true
}
}<!-- </team-default-settings> -->
The marketplace key must match the marketplace name, hve-core. Report "✅ Added the HVE-Core plugin default to .github/copilot/settings.json", remind the user to commit the file so teammates receive it, and proceed to Phase 6.
Extension Installation Execution
The ise-hve-essentials.hve-core extension is an editor option. VS Code forwards the extension's agents and skills to Copilot sessions, but its instructions may not reach them, and the extension does not carry canvases. Recommend the plugin when the user needs the instructions.
When the user selects the extension, first ask which VS Code variant they are using:
<!-- <vscode-variant-prompt> -->
Which VS Code variant are you using?
[1] VS Code (stable)
[2] VS Code Insiders
Your choice? (1/2)<!-- </vscode-variant-prompt> -->
User input handling:
"1", "code", "stable" → Use
codeCLI"2", "insiders", "code-insiders" → Use
code-insidersCLIUnclear response → Ask for clarification
Store the user's choice as the code_cli variable for use in validation scripts.
Display progress message:
📥 Installing HVE Core extension from marketplace...
Note: You may see a trust confirmation dialog if this is your first extension from this publisher.Execute VS Code CLI command:
<code_cli> --install-extension ise-hve-essentials.hve-coreAfter command execution, proceed to Extension Validation.
Extension Validation
Run the appropriate validation script based on the detected platform (Windows = PowerShell, macOS/Linux = Bash). Use the code_cli value from the user's earlier choice (code or code-insiders).
PowerShell: Run scripts/validate-extension.ps1 with the code_cli variable set.
Bash: Run scripts/validate-extension.sh with the code_cli variable set.
Extension Success Report
Upon successful validation, display:
<!-- <extension-success-report> -->
✅ Extension Installation Complete!
The HVE Core extension has been installed from the VS Code Marketplace.
📦 Extension: ise-hve-essentials.hve-core
📌 Version: [detected version]
🔗 Marketplace: https://marketplace.visualstudio.com/items?itemName=ise-hve-essentials.hve-core
🧪 Available Agents:
• rpi-agent, documentation, backlog-manager, and adr-creation
• code-review, security-planner, ux-ui-designer, and more!
ℹ️ VS Code forwards the extension's agents and skills to Copilot sessions.
Its instructions may not reach Copilot sessions, and the extension does
not carry canvases. Use the plugin when you need the instructions.
📋 Configuring optional settings...<!-- </extension-success-report> -->
After displaying the extension success report, proceed to Phase 6: Post-Installation Setup for gitignore and MCP configuration options.
Extension Error Recovery
If extension installation fails, provide targeted guidance:
<!-- <extension-error-recovery> -->
| Error Scenario | User Message | Recovery Action |
|---|---|---|
| Trust dialog declined | "Installation was cancelled. You may have declined the publisher trust prompt." | Offer retry or the plugin route |
| Network failure | "Unable to connect to VS Code Marketplace. Check your network connection." | Offer retry or CLI alternative |
| Organization policy block | "Extension installation may be restricted by your organization's policies." | Provide CLI command for manual installation |
| Unknown failure | "Extension installation failed unexpectedly." | Offer the plugin route as a fallback |
<!-- </extension-error-recovery> -->
Flow Control After Failure:
If extension installation fails and user cannot resolve:
Offer: "Would you like to install the HVE-Core plugin instead? (yes/no)"
If yes: Continue to the Plugin Route
If no: End session with manual installation instructions
Shell Selection and Prerequisites
Native adoption and the clone route run scripts, so ask for a shell first:
Ask: "Which shell would you prefer? (powershell/bash)"
Shell detection rules:
"powershell", "pwsh", "ps1", "ps" → PowerShell
"bash", "sh", "zsh" → Bash
Unclear response → Windows = PowerShell, macOS/Linux = Bash
Before cloning, verify git is available:
Run:
git --versionIf fails: "Git is required to clone HVE-Core. Install git, or choose the plugin route instead."
When the user selects Bash, also verify jq is available:
Run:
jq --versionIf fails: "jq is required by the Bash component scripts. Install jq or choose PowerShell."
Then run the Environment Detection Script and continue to Phase 3.
Environment Detection Script
Run the appropriate detection script based on the user's shell:
PowerShell: Run scripts/detect-environment.ps1
Bash: Run scripts/detect-environment.sh
Phase 3: Environment Detection & Decision Matrix
Phase 3 recommends where to keep the clone. For native adoption, first ask whether the user already has an HVE-Core clone. When they do, use its path as the copy source and skip to Phase 5.
When detection reports IS_HVE_CORE_REPO=true, tell the user that no install is needed. Copilot discovers the repository's own .github/agents, .github/skills, and .github/instructions folders, including nested package folders, without any settings.
Otherwise, ask the following questions based on the detected environment.
Question 1: Environment Confirmation
Present options filtered by detection results:
<!-- <question-1-environment> -->
### Question 1: What's your development environment?
Based on my detection, you appear to be in: [DETECTED_ENV_TYPE]
Please confirm or correct:
| Option | Description |
|--------|-------------------------------------------|
| **A** | 💻 Local VS Code (no devcontainer) |
| **B** | 🐳 Local devcontainer (Docker Desktop) |
| **C** | ☁️ GitHub Codespaces only |
| **D** | 🔄 Both local devcontainer AND Codespaces |
Which best describes your setup? (A/B/C/D)<!-- </question-1-environment> -->
Question 2: Team or Solo
<!-- <question-2-team> -->
### Question 2: Team or solo development?
| Option | Description |
|----------|---------------------------------------------------------------|
| **Solo** | Solo developer - no need for version control of HVE-Core |
| **Team** | Multiple people - need reproducible, version-controlled setup |
Are you working solo or with a team? (solo/team)<!-- </question-2-team> -->
Question 3: Update Preference
Ask this question only when multiple methods match the environment + team answers:
<!-- <question-3-updates> -->
### Question 3: Update preference?
| Option | Description |
|----------------|-----------------------------------------------|
| **Auto** | Always get latest HVE-Core on rebuild/startup |
| **Controlled** | Pin to specific version, update explicitly |
How would you like to receive updates? (auto/controlled)<!-- </question-3-updates> -->
Decision Matrix
Use this matrix to recommend where to keep the clone and how Copilot uses it. For native adoption, the clone is only the copy source, so skip the first row and ignore the last column.
<!-- <decision-matrix> -->
| Environment | Team | Updates | Recommended Method | Copilot Uses It Through |
|---|---|---|---|---|
| Any (simplest) | Any | - | Plugin (Option 1, no clone needed) | The plugin |
| Local (no container) | Solo | - | Method 1: Peer Clone | Plugin from source |
| Local (no container) | Team | Controlled | Method 6: Submodule | .github/copilot/settings.json or plugin from source |
| Local devcontainer | Solo | Auto | Method 2: Git-Ignored | Plugin from source |
| Local devcontainer | Team | Controlled | Method 6: Submodule | .github/copilot/settings.json or plugin from source |
| Codespaces only | Solo | Auto | Method 4: Codespaces | .github/copilot/settings.json |
| Codespaces only | Team | Controlled | Method 6: Submodule | .github/copilot/settings.json or plugin from source |
| Both local + Codespaces | Any | Any | Method 5: Multi-Root Workspace | Plugin from source |
<!-- </decision-matrix> -->
Folders declared in .github/copilot/settings.json must sit inside the project's checkout. Methods 2, 3, 4, and 6 keep the clone there, so they can declare its folders; Methods 1 and 5 connect through a plugin from source.
For Codespaces, ask whether the user needs a pinned or customized copy before recommending Method 4. When they do not, recommend the Team Default Route (Option 2) instead: it needs no clone, and Copilot offers HVE-Core to everyone who opens the repository in a codespace.
Method Selection Logic
After gathering answers:
Match answers to decision matrix
Present recommendation with rationale
Offer alternative if user prefers different approach
<!-- <recommendation-template> -->
## 📋 Your Recommended Setup
Based on your answers:
* **Environment**: [answer]
* **Team**: [answer]
* **Updates**: [answer]
### ✅ Recommended: Method [N] - [Name]
**Why this fits your needs:**
* [Benefit 1 matching their requirements]
* [Benefit 2 matching their requirements]
* [Benefit 3 matching their requirements]
**How Copilot uses it:** [Plugin from source, folders declared in .github/copilot/settings.json, or copy source for native adoption]
Would you like to proceed with this method, or see alternatives?<!-- </recommendation-template> -->
Phase 4: Installation Methods
Each clone method, and both ways to connect a clone to Copilot, are documented end to end in references/installation-methods.md. Follow the method resolved by the decision matrix there. For native adoption, clone the source and leave it unconnected. When that file is unavailable, warn the user that installation cannot proceed for the selected method and stop rather than improvising the steps.
Phase 5: Validation (Validator Persona)
After installation completes, switch to the Validator persona and verify the clone.
[!IMPORTANT] After successful validation, run Phase 7 for native adoption and then Phase 6. For the clone route, proceed to Phase 6.
Validation Workflow
Run validation based on the selected method. Set the base path variable before running:
| Method | Base Path |
|---|---|
| 1 | ../hve-core |
| 2, 3, 4 | .hve-core |
| 5 | Check workspace file |
| 6 | lib/hve-core |
For a clone the user already had, use its path as the base path with method 1, which checks only the agents, instructions, and skills folders.
PowerShell: Run scripts/validate-installation.ps1 with the method and basePath variables set.
Bash: Run scripts/validate-installation.sh with the method number and base path as arguments.
For the clone route, also confirm the connection: the user replied "done" after installing the clone as a plugin from source, or .github/copilot/settings.json declares the clone's three folders.
Success Report
Upon successful validation, display:
<!-- <success-report> -->
✅ Core Installation Complete!
Method [N]: [Name] installed successfully.
📍 Location: [path based on method]
🔌 Connected through: [plugin from source or .github/copilot/settings.json]
📖 Documentation: https://github.com/microsoft/hve-core/blob/main/docs/getting-started/methods/[method-doc].md
🧪 Available Agents:
• rpi-agent, documentation, backlog-manager, and adr-creation
• code-review, security-planner, ux-ui-designer, and more!
📋 Configuring optional settings...<!-- </success-report> -->
For native adoption, skip this report. Display "✅ HVE-Core source ready at [path]" and proceed to Phase 7.
After displaying the success report, proceed to Phase 6 for post-installation setup.
Phase 6: Post-Installation Setup
Read references/post-installation-setup.md and perform every step it specifies before continuing. When that file is unavailable, warn the user that post-installation setup cannot be completed and stop rather than improvising the steps.
Phase 7: Component Installation and Upgrade
Read references/component-installation.md and follow its component installation and upgrade procedures exactly, including every confirmation gate it defines. Phase 7 runs only for native adoption, including upgrade mode when .hve-tracking.json exists.
For Methods 3 and 5, and for a clone the user already had, verify the pre-existing HVE-Core clone's configured upstream source before collision detection or copy, using the warning and confirmation behavior in that reference. When the reference is unavailable, warn the user that component installation and upgrade cannot be performed and stop without writing to the target repository.
Error Recovery
Provide targeted guidance when steps fail:
<!-- <error-recovery> -->
| Error | Troubleshooting |
|---|---|
| Not in git repo | Run from within a git workspace; verify git --version |
| Clone failed | Check network to github.com; verify git credentials and write permissions |
| Validation failed | Repository may be incomplete; delete HVE-Core directory and re-run installer |
| Settings update failed | Verify .github/copilot/settings.json is valid JSON and check write permissions |
| Declared folders not loading | Trust the workspace folder; declared folders load only in a trusted folder and must be literal paths inside the checkout |
| Agents listed twice | More than one route is installed; keep one route and remove the others |
| Agents or skills missing | Confirm the chat uses the Copilot harness, run Developer: Reload Window, then start a new chat session |
<!-- </error-recovery> -->
Rollback
To remove a failed or unwanted installation:
| Route or Method | Cleanup |
|---|---|
| Plugin | Manage hve-core on the Plugins page of the Agent Customizations editor |
| Team default | Remove the hve-core entries from extraKnownMarketplaces and enabledPlugins in .github/copilot/settings.json |
| Native adoption | Delete .hve-tracking.json and any copied .github/agents/, .github/prompts/, .github/instructions/, or .github/skills/ content you no longer need |
| Extension | VS Code → Extensions → HVE Core → Uninstall |
| 1 (Peer Clone) | rm -rf ../hve-core |
| 2 (Git-Ignored) | rm -rf .hve-core |
| 3-4 (Mounted/Codespaces) | Remove the mount or postCreateCommand from devcontainer.json and rebuild the container; for Method 4, also delete .hve-core |
| 5 (Multi-Root) | Delete .code-workspace file |
| 6 (Submodule) | git submodule deinit lib/hve-core && git rm lib/hve-core |
For a clone, also undo its connection: manage a plugin installed from source on the Plugins page, or remove the clone's folders from agentDirectories, skillDirectories, and instructionDirectories in .github/copilot/settings.json. When an earlier installer version added HVE-Core entries to the chat.*Locations settings, remove them as described in Earlier Location Settings Cleanup. Then run Developer: Reload Window.
Authorization Guardrails
Never modify files without explicit user authorization. Always explain changes before making them. Respect denial at any checkpoint.
Checkpoints requiring authorization:
Initial Consent (Phase 1), before starting detection
File Change Authorization (Checkpoint 3), before writing
.github/copilot/settings.json,devcontainer.json, or a.code-workspacefile, and before removing earlier location settings
Checkpoint 3: File Change Authorization
Before each of those changes, present the following:
⚙️ File Update
I will now update [file] for HVE-Core.
Changes to be made:
• [Each key, path, or entry to add or remove]
⚠️ Authorization Required: Do you authorize these changes? (yes/no)If the user declines, respond "No changes were made to [file]." Then skip the change and explain how the route is affected, or stop when the route cannot work without it.
Output Format Requirements
Progress Reporting
Use these exact emojis for consistency:
In-progress indicators (always end with ellipsis ...):
"📂 Detecting environment..."
"🔍 Asking configuration questions..."
"📋 Recommending installation method..."
"📥 Installing HVE-Core..."
"🔍 Validating installation..."
"⚙️ Updating settings..."
"🛡️ Configuring gitignore..."
"📡 Configuring MCP servers..."
Completion indicators:
"✅ [Success message]"
"❌ [Error message]"
"⏭️ [Skipped message]"
Success Criteria
The installation succeeds when the user has one install route in place, every file change was authorized, any clone passed validation, the user ran Developer: Reload Window, and the agent and skill checks for that route passed in Copilot Chat.
It fails when detection fails, a clone or submodule fails, validation finds missing directories, a settings or copy step fails, or the agent and skill checks still fail after a reload.
Files
- ATTRIBUTION.mdAdded by AutoGineer842 B
- LICENSELicence file added by AutoGineer1.1 KiB
- SECURITY.md30.2 KiB
- SKILL.md31.2 KiB
- examples/README.md3.9 KiB
- references/component-installation.md16.4 KiB
- references/installation-methods.md15.4 KiB
- references/post-installation-setup.md12.1 KiB
- scripts/collision-detection.ps1Script1.6 KiB
- scripts/collision-detection.shScript1006 B
- scripts/component-copy.ps1Script19.8 KiB
- scripts/component-copy.shScript17.0 KiB
- scripts/detect-environment.ps1Script1.5 KiB
- scripts/detect-environment.shScript1.3 KiB
- scripts/eject.ps1Script3.8 KiB
- scripts/eject.shScript2.5 KiB
- scripts/file-status-check.ps1Script2.6 KiB
- scripts/file-status-check.shScript2.2 KiB
- scripts/upgrade-detection.ps1Script2.5 KiB
- scripts/upgrade-detection.shScript2.1 KiB
- scripts/validate-extension.ps1Script1.3 KiB
- scripts/validate-extension.shScript1.1 KiB
- scripts/validate-installation.ps1Script2.1 KiB
- scripts/validate-installation.shScript1.8 KiB
- tests/collision-detection.Tests.ps1Script8.1 KiB
- tests/component-copy.Tests.ps1Script59.7 KiB
- tests/detect-environment.Tests.ps1Script3.8 KiB
- tests/eject.Tests.ps1Script14.9 KiB
- tests/file-status-check.Tests.ps1Script8.4 KiB
- tests/upgrade-detection.Tests.ps1Script9.9 KiB
- tests/validate-extension.Tests.ps1Script4.3 KiB
- tests/validate-installation.Tests.ps1Script8.9 KiB
SECURITY.md
title: HVE Core Installer Skill Security Model description: STRIDE threat model for the hve-core-installer skill organized by assets, adversaries, and trust buckets (source clone and plugin manifest, target repository writes, tracking manifest and eject, caller process and local tools) with in-code mitigations, verified platform coverage, and acknowledged enterprise readiness gaps author: microsoft/hve-core ms.date: 2026-10-31 ms.topic: reference estimated_reading_time: 11 keywords:
security
STRIDE
installer
symlink
threat model
<!-- markdownlint-disable-file -->
HVE Core Installer Skill Security Model
This document records the STRIDE threat model for the hve-core-installer skill. The skill ships 16 scripts as 8 behaviorally equivalent PowerShell and Bash pairs under scripts/: component-copy, collision-detection, detect-environment, eject, file-status-check, upgrade-detection, validate-extension, and validate-installation. The model is organized by trust bucket: Source clone and plugin manifest (B1), Target repository writes (B2), Tracking manifest and eject (B3), and Caller process and local tools (B4). Each bucket enumerates all six STRIDE categories with the in-code mitigations that address them. Assets and adversaries are enumerated first. Acknowledged enterprise readiness gaps are listed at the end.
The skill guides an operator through installing HVE Core into their own repository. For clone-based methods, the scripts copy selected agents, prompts, instructions, and skills from a local HVE Core clone into the target repository, then record what was installed in .hve-tracking.json. The scripts handle no credentials, open no listener, and make no network requests. They run with the caller's privileges against local files and invoke only jq (Bash), git rev-parse (environment detection), and, for extension validation, the VS Code CLI.
See also: repo-wide STRIDE model. This skill participates in the repository-wide threat model at
docs/security/security-model.mdand is registered in its Skill Security Models section.
Executive Summary
The installer's highest-risk behavior is writing files into a user's repository from a source clone that may be a fork or a substituted local checkout. Component copy validates every requested path against the source plugin.json membership before the first write.
Links are refused on both sides of a copy:
on the source side, anywhere between the source root and a component;
on the target side, anywhere between the target root and a destination;
at the tracking manifest itself.
Target containment is re-verified immediately before each write, which narrows but does not eliminate the check-to-write race. The upstream-origin check is advisory. The operator remains responsible for trusting the content of the source they install from. Residual risk concentrates in that content trust, the check-to-write race, and platforms where containment has not been exercised by execution.
Security Posture Overview
| Dimension | Value |
|---|---|
| Runtime surface | Local PowerShell and Bash twins; file copy into a target repository; jq, git rev-parse, and VS Code CLI subprocesses |
| Trust buckets | B1 source clone and plugin manifest, B2 target repository writes, B3 tracking manifest and eject, B4 caller process and local tools |
| Credentials | None handled or persisted |
| Network egress | None from the scripts |
| Open residual gaps | 7 (Spoofing-Med: source content is trusted after an advisory origin check) |
Platform Verification
Containment claims in this model were verified by execution on these platforms:
| Platform | Evidence | Result |
|---|---|---|
| Windows 11, PowerShell 7.6.6 | tests/component-copy.Tests.ps1 and tests/eject.Tests.ps1 run natively | Symlink, directory junction, check-to-write, source-link, and manifest-link cases pass. The junction case runs and passes rather than skipping |
Linux (Ubuntu under WSL), PowerShell 7.5 with Bash and jq | The full installer Pester suite, including PowerShell and Bash parity cases. The same suite runs in CI on ubuntu-latest | All containment and parity cases pass; the Windows-only junction case skips |
Git for Windows ships with core.symlinks=false. With that default, a cloned repository materializes committed symlinks as plain text files containing the link target, so a symlink delivered through a cloned fork does not reach the installer as a link. This was observed by cloning a repository containing a symlink entry with Git for Windows 2.55. Real links appear only when symlinks are enabled (core.symlinks=true) and the account can create them. Per the Git for Windows documentation, that means an Administrator, Developer Mode, or an explicit privilege grant. This lowers the likelihood of link-based threats on a default Windows install. On Linux and macOS, cloned symlinks materialize by default, and the refusals in B1 and B2 apply.
macOS was not exercised (G-TAM-2). Bash under Git for Windows was not exercised (G-TAM-3).
Contents
System Description
Trust Boundaries
Assets
Adversaries
Bucket B1: Source clone and plugin manifest
Bucket B2: Target repository writes
Bucket B3: Tracking manifest and eject
Bucket B4: Caller process and local tools
Enterprise Readiness Gaps
References
System Description
Components
scripts/component-copy.ps1andscripts/component-copy.sh: resolve requested components against the sourceplugin.json, validate every path, refuse links on the source and target sides, copy files, and write.hve-tracking.json.scripts/collision-detection.ps1andscripts/collision-detection.sh: run component copy in report-only mode, so the pre-write check resolves components exactly as the copy does. Nothing is written.scripts/eject.ps1andscripts/eject.sh: mark a tracked componentejectedin.hve-tracking.json, so future upgrades skip it. The files stay on disk.scripts/file-status-check.ps1andscripts/file-status-check.sh: compare each tracked file's current SHA-256 hash with the recorded hash, and reportmanaged,modified,ejected, ormissing. Read-only.scripts/upgrade-detection.ps1andscripts/upgrade-detection.sh: compare the recorded version with the sourcepackage.jsonversion, and report the recorded selection. Read-only.scripts/detect-environment.ps1andscripts/detect-environment.sh: report whether the session is local, a dev container, or Codespaces. Read-only.scripts/validate-installation.ps1andscripts/validate-installation.sh: check that the expected.githubdirectories and method-specific configuration exist. Read-only.scripts/validate-extension.ps1andscripts/validate-extension.sh: query the VS Code CLI for the installed HVE Core extension. Read-only.
Data Flow
flowchart TD
accTitle: HVE Core Installer Data Flow
accDescr: The installer reads a local HVE Core source clone and its plugin manifest, copies validated components into a target repository, writes a tracking manifest there, and queries local tools, all inside the operator workstation trust zone.
subgraph SRC["Source clone (operator-chosen; may be a fork)"]
PLUGIN["plugin.json + package.json"]
FILES["Component source files"]
end
subgraph HOST["Operator Workstation (trust zone)"]
COPY["component-copy<br/>(PowerShell / Bash)"]
EJECT["eject"]
READERS["file-status-check / upgrade-detection<br/>detect-environment / validate-*"]
TOOLS["jq / VS Code CLI"]
end
subgraph TGT["Target repository"]
OUT[".github/ components"]
MAN[".hve-tracking.json"]
end
PLUGIN -->|"membership (read)"| COPY
FILES -->|"read; links refused"| COPY
COPY -->|"write; links refused, re-verified per write"| OUT
COPY -->|"write; link refused"| MAN
EJECT -->|"temp file + replace; link refused"| MAN
MAN -->|"read"| READERS
COPY -->|"fixed arguments"| TOOLS
READERS -->|"fixed arguments"| TOOLSTrust Boundaries
Boundary Diagram
┌──────────────────────────────────────┐
│ TRUST BOUNDARY: Source clone │
│ ┌────────────────────────────────┐ │
│ │ plugin.json, package.json, │ │
│ │ component source files │ │
│ └────────────────────────────────┘ │
└──────────────────┬───────────────────┘
│ read (membership check, source links refused)
┌──────────────────▼───────────────────────────────────────┐
│ TRUST BOUNDARY: Operator Workstation │
│ ┌───────────────┐ ┌──────────┐ ┌──────────────────┐ │
│ │ installer │ │ jq │ │ VS Code CLI │ │
│ │ scripts │ │ │ │ (allow-listed) │ │
│ └───────────────┘ └──────────┘ └──────────────────┘ │
└──────────────────┬───────────────────────────────────────┘
│ write (target links refused, re-verified per write)
┌──────────────────▼───────────────────┐
│ TRUST BOUNDARY: Target repository │
│ ┌────────────────────────────────┐ │
│ │ .github/ components │ │
│ │ .hve-tracking.json │ │
│ └────────────────────────────────┘ │
└──────────────────────────────────────┘Boundary Descriptions
| Boundary | Assets Protected | Controls Enforced |
|---|---|---|
| Source clone | Integrity of what is installed | Advisory upstream-origin check; plugin.json membership; .github/ manifest-path prefix; source-side link refusal; exclusions |
| Operator Workstation | Caller process, local tools | Array arguments (no shell); jq --arg data binding; VS Code CLI name allow-list with fixed arguments |
| Target repository | Files outside the target root; tracking manifest | Path validation; target ancestor link refusal re-verified per write; manifest link refusal; schema gate before any write |
Assets
| Id | Asset | Lifetime | Notes |
|---|---|---|---|
| A1 | Files outside the target root | Persistent | Must never be written by the installer |
| A2 | Files outside the source clone | Persistent | Must never be read into the target repository |
| A3 | Installed components in the target | Persisted | Agents, prompts, instructions, and skills later loaded by Copilot in the user's repository |
| A4 | .hve-tracking.json | Persisted | Records source, version, selection, and per-file SHA-256 hash and status |
| A5 | Source clone content | Operator-managed | Chosen by the operator; may be upstream, a fork, or a local development checkout |
| A6 | jq, git, and VS Code CLI binaries | External, PATH-resolved | Unpinned host dependencies (G-SUP-1) |
Adversaries
| Id | Adversary | In-scope mitigations |
|---|---|---|
| ADV-a | Author of a malicious fork or substituted source clone | Advisory origin check with explicit confirmation; membership in the source plugin.json; source-side link refusal. Content of declared components is trusted (G-SPF-1) |
| ADV-b | Author of a target repository containing planted links | Target ancestor link refusal re-verified immediately before each write; manifest link refusal; refusal before any write |
| ADV-c | Local process racing the check and the write | Per-write re-verification narrows the window; the check and the write are not atomic (G-TAM-1) |
| ADV-d | Caller or agent supplying adversarial component paths | Rejects control characters, backslashes, absolute paths, drive letters, empty segments, . and .., unknown fields, non-members, and duplicate targets |
| ADV-e | Anyone who can edit files in the target repository | SHA-256 status detects local modification of tracked files, but the manifest is not integrity-protected (G-TAM-4) |
Bucket B1: Source clone and plugin manifest
Spoofing
For the mounted and multi-root methods, and for a clone the user already had, installation guidance runs
git -C <HveCoreBasePath> remote get-url originbefore any write. Whenoriginis missing or does not match an expectedgithub.com/microsoft/hve-coreHTTPS, SCP-like SSH, orssh://form, it warns and requires an explicityesto continue. This is an advisory trust signal, not proof of repository integrity. Intentional forks and local development clones are allowed after confirmation (G-SPF-1).
Tampering
Only components declared in the source
plugin.jsoncan be installed. Everyplugin.jsonpath must start with.github/, and every requested component must match a declared member after package-path projection.A component is refused before any write when its source path, or any ancestor between the source root and the component, is a link.
Assert-SourceWithoutLinkin PowerShell checks theReparsePointattribute, which also covers Windows junctions;assert_source_without_linkin Bash tests-L. Inside a skill directory, file links are omitted and directory links are not traversed.Local environment, cache, and test paths are never copied:
tests,.venv,.hypothesis,node_modules,__pycache__,.ruff_cache,.pytest_cache,.git,.envand its variants,.DS_Store,Thumbs.db, and*.pyc.The content of declared components is copied as-is. The installer does not verify signatures or compare content with upstream (G-SPF-1).
Repudiation
Not applicable. This is a local, operator-driven installer with no audit requirement. The tracking manifest records the source identifier, version, selection, and install timestamp for the operator's own reference.
Information Disclosure
Source-side link refusal prevents a link in the source clone from pulling files outside the clone (for example, from the operator's home directory) into the target repository, where they could later be committed.
No credentials are read and no network requests are made.
Denial of Service
A malformed
plugin.json, a manifest that declares no installable components, or a missing source file fails preflight with an error before any write.
Elevation of Privilege
The scripts run with the caller's privileges; there is no privilege transition. Installed components are Copilot customization files that take effect only when the user's tools load them.
Risk Rating
| Threat | Likelihood | Impact | Residual Risk | Status |
|---|---|---|---|---|
| Malicious content from a fork installed after confirmation | Low | High | Med | Accepted (G-SPF-1) |
| Source link pulls outside files into the target repository | Low | High | Low | Mitigated (source link refusal) |
| Undeclared or excluded path installed | Low | Med | Low | Mitigated |
Bucket B2: Target repository writes
Spoofing
Not applicable. The target is the operator-supplied directory; the installer asserts no identity over it.
Tampering
Containment is decided by real filesystem state, not by the shape of a joined string. The full destination must lie under the separator-terminated target root. Every existing ancestor from the target root to the destination is inspected, and the component is refused when any of them is a link:
Assert-WithinTargetRootchecksReparsePoint, covering symlinks and Windows junctions;assert_within_target_roottests-L.The Bash implementation deliberately walks ancestors instead of resolving the path with
realpath -m, which is a GNU coreutils extension and is not dependable on macOS. The leaf does not exist yet on a first install.Containment runs in preflight, then again immediately before each file is written. The re-check narrows the window in which a link planted between the two checks could redirect a write. It does not make the check and the write atomic (G-TAM-1).
The PowerShell and Bash implementations are kept behaviorally equivalent. Parity tests assert the same accept and refuse verdicts for clean, symlinked-destination, linked-source, and linked-manifest cases.
Repudiation
Not applicable. Local operator action; per-component copy results are printed to the caller.
Information Disclosure
Not applicable. The installer writes only files taken from the source clone into the target repository, and reports target-relative paths.
Denial of Service
Collision detection reports existing components before any write. Installation guidance requires explicit confirmation and a per-collision choice to overwrite or keep. Ejected files are never overwritten.
Elevation of Privilege
A write outside the target root, for example into a user profile or a global configuration location, is refused by the containment check above. The caller's privileges bound what an escaped write could reach.
Risk Rating
| Threat | Likelihood | Impact | Residual Risk | Status |
|---|---|---|---|---|
| Planted destination link redirects a write outside target | Low | High | Low | Mitigated (ancestor link refusal) |
| Link planted between the check and the write | Low | High | Low | Partially Mitigated (G-TAM-1) |
| Containment divergence between PowerShell and Bash | Low | High | Low | Mitigated (parity tests) |
Bucket B3: Tracking manifest and eject
Spoofing
Not applicable. The manifest records a
sourcestring and version for operator reference; nothing authenticates against them.
Tampering
component-copyandejectrefuse a.hve-tracking.jsonthat is a link, before reading or writing it and before any component copy. The PowerShell scripts inspect the link itself rather than relying onTest-Path, and the Bash scripts test-L, so a dangling link is refused as well. The manifest write therefore cannot be redirected outside the target root.An existing manifest must be schema version 2. Any other version fails before the target is touched, with clean-reinstall guidance.
ejectwrites the updated manifest to a new, randomly named temporary file in the same directory (a GUID name in PowerShell,mktempin Bash), replaces the manifest with it, and removes the temporary file if the write fails. A link planted at a predictable temporary name therefore cannot redirect the write.component-copyrewrites the manifest in place at the end of a run (G-DOS-1).Each tracked file carries a SHA-256 hash and a
managedorejectedstatus.file-status-checkreportsmodifiedwhen a file's hash differs. This detects local modification of tracked files. It is not integrity protection: anyone who can edit the files can edit the manifest, which is neither signed nor otherwise protected (G-TAM-4).
Repudiation
Not applicable. The manifest records installation and ejection timestamps as operator information, not as tamper-evident audit records.
Information Disclosure
file-status-checkhashes files at the paths recorded in the manifest and reports only a status per path. It does not print file content.
Denial of Service
A truncated or malformed manifest fails parsing before any write. Recovery is to delete the manifest and reinstall, which discards recorded ejections (G-DOS-1).
Elevation of Privilege
Not applicable. Ejection changes only the manifest status of the named component's files.
Risk Rating
| Threat | Likelihood | Impact | Residual Risk | Status |
|---|---|---|---|---|
| Linked manifest redirects the manifest write | Low | Med | Low | Mitigated (manifest link refusal) |
| Manifest edited to hide local modification | Low | Low | Low | Accepted (G-TAM-4) |
| Interrupted copy leaves an unreadable manifest | Low | Low | Low | Accepted (G-DOS-1) |
Bucket B4: Caller process and local tools
Spoofing
jq,git, and the VS Code CLI (codeorcode-insiders) are resolved by name fromPATH. The installer trusts the operator's environment for binary identity (G-SUP-1).
Tampering
The VS Code CLI name is restricted to
codeorcode-insiders:[ValidateSet]in PowerShell, with the same allow-list in Bash, checked before execution. It is invoked only with the fixed--list-extensionsand--show-versionsarguments.The Bash scripts pass manifest paths and values to
jqthrough--argand--argjson, not by building thejqprogram from input. Every script is invoked with discrete arguments, not a composed shell string.
Repudiation
Not applicable. Local, interactive tooling.
Information Disclosure
detect-environmentreports only environment type flags (CODESPACES,REMOTE_CONTAINERS,/.dockerenv, devcontainer and workspace file presence, and whether the repository is namedhve-core). It prints no environment values or credentials.
Denial of Service
Not applicable. The read-only scripts perform bounded local checks.
Elevation of Privilege
Subprocesses run with the caller's privileges and no shell. There is no privilege transition.
Risk Rating
| Threat | Likelihood | Impact | Residual Risk | Status |
|---|---|---|---|---|
| Arbitrary command via the VS Code CLI name | Low | High | Low | Mitigated (allow-list) |
| PATH-resolved tool substitution | Low | High | Low | Accepted (operator environment) |
Enterprise Readiness Gaps
The following are known limitations recorded so operators can make informed deployment decisions. Severity ratings are the project's own assessment and are not equivalent to a CVSS score.
| Id | Gap | Severity | Status |
|---|---|---|---|
| G-SPF-1 | The upstream-origin check is advisory. A fork or substituted local clone is accepted after explicit confirmation, and the content of its declared components is installed without signature or content verification. | Spoofing-Med | Accepted; install from a trusted source and review components before committing them |
| G-TAM-1 | Target containment is re-verified immediately before each write, which narrows but does not eliminate the check-to-write race. A local process able to swap a directory for a link in that window could still redirect a write. | Tampering-Low | Accepted; the window requires concurrent local write access to the target |
| G-TAM-2 | Containment has not been exercised on macOS. The Bash implementation avoids the GNU-only realpath -m and uses a POSIX-portable ancestor -L walk, so no known GNU-specific dependency exists. That is a design argument, not verification. | Tampering-Low | Open; verify by running the installer Pester suite on macOS |
| G-TAM-3 | Windows containment, including the directory-junction case, was verified on a developer machine only. CI runs on ubuntu-24.04, where the junction case skips permanently. Bash under Git for Windows was not exercised. | Tampering-Low | Open; add a Windows CI job for the installer Pester suite |
| G-TAM-4 | .hve-tracking.json is not integrity-protected. SHA-256 status detects local modification of tracked files, but anyone who can edit those files can also edit the manifest. | Tampering-Low | Accepted; the manifest is operator bookkeeping, not a security control |
| G-DOS-1 | component-copy rewrites .hve-tracking.json in place. An interrupted run can leave a manifest that later runs reject, and recovery by reinstall discards recorded ejections. eject uses a temporary file and replace. | DoS-Low | Accepted |
| G-SUP-1 | jq, git, and the VS Code CLI are external, unpinned dependencies resolved from PATH. | SupplyChain-Low | Accepted (operator keeps local tools trusted) |
For an active issue tracker entry covering these gaps, see the hve-core issues list.
References
Repository security model
🤖 Crafted with precision by ✨Copilot following brilliant human instruction, then carefully refined by our team of discerning human reviewers.
Requirements and compatibility
Written for: GitHub Copilot
Works with: Claude Code, Claude apps, OpenAI Codex, GitHub Copilot, Cursor, Gemini CLI, Kiro, OpenCode, Goose, Amp, Roo Code, JetBrains Junie, Factory Droid, Devin (ex-Windsurf), Mistral Vibe, OpenHands, Letta
“Works with” means the tool reads the open Agent Skills format; a skill written for one tool may use features others lack.
Needs: Needs an MCP server, Needs Python
The author says: Requires VS Code or VS Code Insiders. Clone-based methods require git on PATH and network access. The Bash component scripts require jq.
Security
What our scanner noticed· Low risk
- Scripts that your agent may run
This skill includes scripts that your agent may run. Read them before you use it.
A static scan is not a guarantee. Skills are third-party content: review a skill before you let an agent use it.
Attribution and licence
- Published by
- Microsoft
- Publisher
- Microsoft (Official)
- Source
- microsoft/hve-core · .github/skills/installer/hve-core-installer · commit f425e94
- Licence
- MIT License (redistribution allowed)
- LICENSE (added by AutoGineer from LICENSE)
- ATTRIBUTION.md (written by AutoGineer)
- Synced
AutoGineer is not affiliated with or endorsed by Microsoft or Microsoft.
Download ZIP
The ZIP holds the skill’s files, its licence files and an ATTRIBUTION.md. Download hve-core-installer.zip