Copilot CLI: Add info on how a Copilot skill can run a script. (#60461)

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

Author: hubwriter

data/reusables/copilot/creating-adding-skills.md

@@ -27,9 +27,9 @@ To add a skill, you save the `SKILL.md` file, and any subsidiary resources, to a
      * **license** (optional): A description of the license that applies to this skill.
    * A Markdown body, with the instructions, examples and guidelines for {% data variables.product.prodname_copilot_short %} to follow.
 
-1. Optionally, add scripts, examples or other resources to your skill's directory. 
+1. Optionally, add scripts, examples or other resources to your skill's directory.
 
-   For example, if you were writing a skill for converting images between different formats, you might include a script for converting SVG images to PNG. The skill instructions should tell {% data variables.product.prodname_copilot_short %} when, and how, to use these resources.
+   For more information, see "[Enabling a skill to run a script](#enabling-a-skill-to-run-a-script)."
 
 ### Example `SKILL.md` file
 
@@ -51,3 +51,38 @@ To debug failing {% data variables.product.prodname_actions %} workflows in a pu
 4. Try to reproduce the failure yourself in your own environment.
 5. Fix the failing build. If you were able to reproduce the failure yourself, make sure it is fixed before committing your changes.
 ```
+
+### Enabling a skill to run a script
+
+When a skill is invoked, {% data variables.product.prodname_copilot_short %} automatically discovers all of the files in the skill's directory and makes them available alongside the skill's instructions. This means you can include scripts or other resources in the skill directory and reference them in your `SKILL.md` instructions.
+
+To create a skill that runs a script:
+
+1. **Add the script to your skill's directory.** For example, a skill for converting SVG images to PNG might have the following structure.
+
+   ```text
+   .github/skills/image-convert/
+   ├── SKILL.md
+   └── convert-svg-to-png.sh
+   ```
+
+1. **Optionally pre-approve the tools the skill needs.** In your `SKILL.md` frontmatter, you can use the `allowed-tools` field to list the tools {% data variables.product.prodname_copilot_short %} may use without asking for confirmation each time. If a tool is not listed in the `allowed-tools` field, {% data variables.product.prodname_copilot_short %} will prompt you for permission before using it.
+
+   ```markdown
+   ---
+   name: image-convert
+   description: Converts SVG images to PNG format. Use when asked to convert SVG files.
+   allowed-tools: shell
+   ---
+   ```
+
+   > [!WARNING]
+   > Only pre-approve the `shell` or `bash` tools if you have reviewed this skill and any referenced scripts, and you fully trust their source. Pre-approving `shell` or `bash` removes the confirmation step for running terminal commands and can allow attacker-controlled skills or prompt injections to execute arbitrary commands in your environment. When in doubt, omit `shell` and `bash` from `allowed-tools` so that {% data variables.product.prodname_copilot_short %} must ask for your explicit confirmation before running terminal commands.
+
+1. **Write instructions that tell {% data variables.product.prodname_copilot_short %} how to use the script.** In the Markdown body of `SKILL.md`, describe when and how to run the script.
+
+   ```markdown
+   When asked to convert an SVG to PNG, run the `convert-svg-to-png.sh` script
+   from this skill's base directory, passing the input SVG file path as the
+   first argument.
+   ```