[dotnet-port-api] Port skill tool auto-approval helpers

[github-actions]

Summary

Ported the narrow public API portion of the upstream AgentSkillsProvider approval change from microsoft/agent-framework#6729 by adding exported skill-tool name constants plus reusable skills.ReadOnlyToolsAutoApprovalRule and skills.AllToolsAutoApprovalRule helpers in Go. This also adds a focused skills auto-approval sample and updates the feature-comparison note.

The upstream source of truth for this port is commit e3b64fdc4749256fa2d559be18a41f1a008dd7f6. Go already matched the broader behavioral part of that .NET change because all three skill tools already required approval by default, so this PR keeps scope to the missing exported helper surface.

Ported .NET PRs

• .NET: [BREAKING] Make all AgentSkillsProvider tools require approval by default agent-framework#6729 - added AgentSkillsProvider skill-tool auto-approval helpers and aligned sample usage; ported from upstream commit e3b64fdc4749256fa2d559be18a41f1a008dd7f6

Breaking Changes

No. Go already required approval for load_skill, read_skill_resource, and run_skill_script by default, so this PR only adds exported constants, reusable auto-approval helpers, tests, and a sample.

Tests and Examples

• Ran go test ./agent/skills ./agent/harness/toolapproval ./examples/02-agents/skills/...
• Added examples/02-agents/skills/step04_skills_auto_approval
• Added focused tests for skills.ReadOnlyToolsAutoApprovalRule and skills.AllToolsAutoApprovalRule

Notes

• The broader .NET PR also removed .NET-specific ScriptApproval members and updated hosted scenarios; those removals do not map to an equivalent Go API change because Go already exposes per-tool disable knobs instead.
• Nearby upstream skills changes such as skills source context and reusable public skills source types were already tracked separately and were intentionally not bundled into this narrow PR.

Generated by .NET to Go API Porting Agent · 839.7 AIC · ⌖ 38.9 AIC · ⊞ 21.7K · ◷

---

Note

This was originally intended as a pull request, but GitHub Actions is not permitted to create or approve pull requests in this repository.
The changes have been pushed to branch copilot/dotnet-port-api-skills-auto-approval-20260709-0a5188c6deb256e2.

Click here to create the pull request

To fix the permissions issue, go to Settings → Actions → General and enable Allow GitHub Actions to create and approve pull requests. See also: gh-aw FAQ

Show patch preview (449 of 449 lines)

From 3353a7fe40e6adc9dbf5e531c5c6fe714f67b58e Mon Sep 17 00:00:00 2001
From: "github-actions[bot]" <github-actions[bot]@users.noreply.github.com>
Date: Thu, 9 Jul 2026 06:41:35 +0000
Subject: [PATCH] [dotnet-port-api] Port skill tool auto-approval helpers

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 agent/skills/provider.go                      |  46 ++++++-
 agent/skills/provider_test.go                 | 128 +++++++++++++++---
 docs/dotnet-go-sdk-feature-comparison.md      |   2 +-
 .../step04_skills_auto_approval/main.go       | 109 +++++++++++++++
 4 files changed, 263 insertions(+), 22 deletions(-)
 create mode 100644 examples/02-agents/skills/step04_skills_auto_approval/main.go

diff --git a/agent/skills/provider.go b/agent/skills/provider.go
index 4031b8274..730ac24b6 100644
--- a/agent/skills/provider.go
+++ b/agent/skills/provider.go
@@ -20,6 +20,13 @@ import (
 )
 
 const (
+	// LoadSkillToolName is the name of the tool that loads a skill's full content.
+	LoadSkillToolName = "load_skill"
+	// ReadSkillResourceToolName is the name of the tool that reads a skill resource.
+	ReadSkillResourceToolName = "read_skill_resource"
+	// RunSkillScriptToolName is the name of the tool that runs a skill script.
+	RunSkillScriptToolName = "run_skill_script"
+
 	skillsPlaceholder = "{skills}"
 )
 
@@ -38,6 +45,39 @@ When a task aligns with a skill's domain, follow these steps in exact order:
 - Use ` + "`run_skill_script`" + ` to run referenced scripts, using the name exactly as listed.
 Only load what is needed, when it is needed.`
 
+// ReadOnlyToolsAutoApprovalRule auto-approves read-only skill tools.
+//
+// Add this function to toolapproval.Config.AutoApprovalRules to automatically
+// approve load_skill and read_skill_resource while continuing to prompt for
+// run_skill_script and non-skill tools.
+func ReadOnlyToolsAutoApprovalRule(_ context.Context, functionCall *message.FunctionCallContent) (bool, error) {
+	if functionCall == nil 
... (truncated)

[michelle-clayton-work]

Pull request #1045 is linked to this issue and will close it when merged.