Microsoft Skill Recorder

What It Does

Skill Recorder is an official Microsoft Electron desktop application (v0.3.1, MIT, TypeScript with React 19, Vite 8, Electron 43) that records a real on-screen work session and reconstructs it as a reusable skill. The capture layer records screen video, active-window and app switches, browser URLs (macOS), short clipboard previews, and optional spoken narration transcribed on-device by Whisper (99 languages, a one-time ~252 MB model download). All capture, storage, frame extraction, and transcription happen locally. When the user clicks Analyze, Skill Recorder sends the event timeline, extracted screen images, and narration text to GitHub's cloud, where the GitHub Copilot CLI (driven through the @github/copilot-sdk) reconstructs one overall intent and an ordered list of steps. From an approved analysis, a second Copilot agent then builds either a Skill (an on-demand SKILL.md) or an Automation (a scheduled, multi-step procedure). The audience is knowledge workers and developers who want to teach an agent a repeated task by doing it once, and the explicit target agents are Microsoft Scout and Microsoft 365 Copilot (Cowork), with Copilot Studio listed but greyed out as "coming soon".

The Good

The supply-chain and install hygiene are the most rigorous GearScope has seen in an agent-skill-adjacent tool. The install.sh and install.ps1 scripts require a full 40-character commit SHA (SKILL_RECORDER_COMMIT) and die on anything shorter, explicitly rejecting main, master, branch names, and unverified tags as mutable references. The commit pins both the downloaded script and the source archive it builds. Node.js 24 is downloaded from nodejs.org and verified against the live SHASUMS256.txt on every run (re-fetched each time, not cached). Cached partial-download artifacts are re-verified by SHA-256 before reuse and discarded on mismatch. All five published releases (v0.1.0 through v0.3.1) are source-only: no prebuilt application, installer, or portable binary is attached. Each release lists its exact commit SHA and publishes SHA-256 values for both installer scripts. The compliance pipeline (scripts/compliance.mjs and friends) fails closed if any installed platform package lacks reviewed legal material.

The release notes honestly flag their own broken installers instead of burying the defects. The v0.1.0 release carries a WARNING banner that a Windows PowerShell 5.1 compatibility issue exits early on some systems and directs users to v0.2.0. The v0.3.0 release carries a second WARNING that the Windows source installer can fail on dependency paths longer than legacy MAX_PATH and directs users to v0.3.1. The v0.3.1 notes state plainly that "the v0.3.0 Windows command pins the defective installer and cannot receive this correction in place." This is the opposite of the silent-regression pattern, and it is rare even among official vendor repos.

The engineering is type-safe, tested, and builds clean. npm run typecheck (tsc --noEmit) passes with zero errors. The schema layer uses Zod throughout (common/skill.ts, common/analysis.ts) with preprocessors that migrate legacy input shapes. The unit suite (npm test) runs 75 tests across 11 files in 930ms with 0 failures and 0 skips, covering recording-privacy (warns before every start until disclosure is reviewed, and the acknowledgement does not survive a new app process), session-store (size accounting and full-directory deletion), the compliance engine (license discovery, immutable reviewed sources, fail-closed on unreviewed ONNX and Copilot CLI versions, WASM payload exclusion from every artifact, archive validation that rejects HTML challenge pages), frame extraction, narration gates, and the recorder controller. npx vite build produces a clean renderer bundle (106 modules, dist/index.html at 0.53 kB plus assets/index.js at 334.51 kB or 96.60 kB gzip) and a clean Electron main bundle (142 modules, dist-electron/main.js at 310.81 kB or 83.08 kB gzip) in 405ms.

The eval harness is deterministic, well-reasoned, and guards a real regression. The describer eval (evals/) ships 9 synthetic scenarios that materialize a fixed event stream and run the real pipeline plus the real Copilot describer, scored by an LLM-free rubric. The rubric includes forbidden-noise rules (recorder start/stop bracketing, permission dialogs, and tracking-parameter hops must not surface as steps) and an irrelevant-detour scenario that fails outright if an off-task recipe detour leaks into the intent. The builder eval exists explicitly because of a real defect: when generalizing GitHub work, the builder preferred driving the browser via Playwright instead of using the gh CLI, even though Scout runs on the user's own device where gh is installed and authenticated. The harness runs the real app source through a resolution hook with no bundler, so a failure points at the model or instructions rather than capture flakiness.

The privacy architecture is sound and precisely documented. Recording, storage, frame extraction, and narration transcription are all on-device. Nothing leaves the machine until the user explicitly clicks Analyze. The README's "What gets captured" section enumerates exactly what is collected (window tracking, browser URLs, screen video with low-rate change-detected snapshots, short clipboard previews, optional narration) and repeats the "do not record secrets" warning in a callout. The recording-privacy unit test confirms the disclosure gate fires before every start.

The Bad

The produced skills target Microsoft Scout and Microsoft 365 Copilot Cowork only, with zero support for any other agent. A grep across the entire codebase for hermes, openclaw, claude code, cursor, .claude/skills, and .hermes/skills returns zero matches (the only cursor hit is screen.getCursorScreenPoint(), an unrelated Electron API). The SkillArchitecture enum (common/skill.ts) defines exactly three targets: scout, cowork, and copilot-studio (the last is hard-disabled with enabled: false and the note "Coming soon"). Finished skills are written to ~/.copilot/skills//SKILL.md (electron/skillbuilder/builder.ts, line 52, overridable only via SKILL_RECORDER_SKILLS_DIR). The catalogue baked into the builder's system prompt (electron/skillbuilder/scout-catalog.ts) references Microsoft-internal tool names that do not exist outside Scout: the workiq_* family for Teams, Outlook, Calendar, SharePoint, and People, the browser_* Playwright surface, and the built-in pptx, docx, xlsx, loop, web-artifacts-builder, expense-report, and excalidraw skills. A Hermes or OpenClaw user who installs this and builds a skill gets a SKILL.md whose body tells the agent to call tools the agent does not have.

The core value proposition, the Copilot-backed Analyze and Build steps, is unverifiable without an enterprise or organization Copilot policy. Running npm run eval produced 9 of 9 ERROR results. The deterministic pipeline stage succeeded for every scenario (for example, bundle: 6 steps, 12 events -> description.md), but every Copilot analysis call failed with the identical message: "You are not authorized to use this Copilot feature, it requires an enterprise or organization policy to be enabled." The model-list call also failed with 403 unauthorized. The README says only that "you'll need a GitHub account with Copilot access" and that the Copilot CLI "ships with the app", with no mention that a personal Copilot subscription is insufficient and that an admin must enable a specific enterprise or organization policy. For a tool whose entire purpose is the Analyze and Build steps, this is the central gap.

SUPPORT.md ships as the unedited Microsoft template. The file begins with the literal line "TODO: The maintainer of this repo has not yet edited this file" and retains the placeholder "REPO MAINTAINER: INSERT INSTRUCTIONS HERE FOR HOW TO ENGAGE REPO OWNERS OR COMMUNITY FOR HELP. COULD BE A STACK OVERFLOW TAG OR OTHER CHANNEL. WHERE WILL YOU HELP PEOPLE?" The README points users at SUPPORT.md for support details, so the pointer currently leads to a TODO. This is a shipping-process miss for an official Microsoft repo.

An internal Microsoft path leaked into the shipped source. Both electron/skillbuilder/scout-catalog.ts (line 8) and electron/automationbuilder/scout-automation-catalog.ts (line 9) carry the comment "authored by inspecting ~/projects/m", which is the path to the internal Scout repository on the author's machine. Two built-in skills in the catalogue are also marked "(internal builds only)". This is harmless to function but is exactly the kind of provenance detail that should be scrubbed before a public MIT release.

The tool is eight days old with a break-fix release cadence and unfinished targets. The repository was created 2026-07-29. Four releases shipped on day one (v0.1.0, v0.2.0, v0.2.1, v0.3.0), two of which carry Windows-installer warnings. v0.3.1 patched the v0.3.0 defect on day two. The third architecture target, Copilot Studio, is present in the UI but disabled. This is an early-access v0.3.x tool, not a stabilized v1.0, and the rapid patch sequence confirms it.

Smoke Test Results

Tested on a macOS host (26.5.2, aarch64), Node v24.13.1, npm 11.8.0. The repository was shallow-cloned then unshallowed for full history (11 MB, 172 files excluding .git, 5 git tags). Dependencies installed via npm ci into an isolated checkout. The eval suite was run against the bundled Copilot CLI using an existing Copilot account.

Run A. Fresh sandbox, no deps preinstalled

$ git clone --depth 1 https://github.com/microsoft/skill-recorder && cd skill-recorder

Cloning into 'skill-recorder'...

PASS (clone succeeds, 11 MB, default branch main)

$ node --version && npm --version

v24.13.1

11.8.0

PASS (meets the documented Node 24 requirement)

$ npm ci --no-audit --no-fund

added 495 packages in 1m

PASS (lockfile-resolved install, no audit failures)

$ npm run typecheck

tsc --noEmit

(clean exit, zero errors)

PASS

Pass rate: 4 of 4. A clean clone on a machine with only Node 24 reaches a typechecking build with no manual intervention. The lockfile is honored and npm ci (not npm install) is enforced by the docs.

Run B. Sandbox with deps preinstalled

$ npm test

tests 75, suites 0, pass 75, fail 0, cancelled 0, skipped 0, duration_ms 930

PASS (full unit suite green: recording-privacy, sessions, compliance, frames, narration, controller, debug-bundle)

$ npx vite build

renderer: 106 modules transformed, dist/index.html 0.53 kB, assets/index.js 334.51 kB (96.60 kB gzip)

electron main: 142 modules transformed, dist-electron/main.js 310.81 kB (83.08 kB gzip)

built in 405ms

PASS

$ git tag --list

v0.1.0, v0.2.0, v0.2.1, v0.3.0, v0.3.1

PASS (5 tagged releases, all source-only)

$ grep -n 'SKILL_RECORDER_COMMIT' install.sh | head -3

enforces ^[0-9a-fA-F]{40}$, lowercases, dies otherwise

PASS (mutable-ref rejection confirmed in source)

Pass rate: 4 of 4. The badge number is 4 of 4. The unit suite is green, the production build is clean for both the renderer and the Electron main process, releases are tagged, and the installer's commit-pinning logic is verifiable by inspection.

Run C. Functional verification (does it do what it claims?)

$ npm run eval

9 scenario(s)

[Pipeline] bundle: 6 steps, 12 events -> description.md (deterministic stage)

[Describer] listModels failed: 403 "unauthorized: not authorized to use this Copilot feature"

error: Analysis run failed: You are not authorized to use this Copilot feature,

it requires an enterprise or organization policy to be enabled.

FAIL (all 9 scenarios, identical 403 enterprise-policy error, 0/9 passed)

$ grep -rin 'hermes\|openclaw\|claude code\|cursor' --include='*.ts' --include='*.md' --include='*.json' .

(only unrelated getCursorScreenPoint match)

FAIL (no integration with any non-Microsoft agent; output is Scout/Cowork-only)

$ grep -n 'projects/m' electron/skillbuilder/scout-catalog.ts electron/automationbuilder/scout-automation-catalog.ts

"authored by inspecting ~/projects/m" (internal path, both files)

FAIL (internal Microsoft path leaked into shipped source)

$ head -3 SUPPORT.md

"# TODO: The maintainer of this repo has not yet edited this file"

FAIL (support doc ships as the unedited Microsoft template)

Functional pass rate: 1 of 5. The one pass is structural (the deterministic pipeline stage runs for all scenarios). The Copilot-backed analysis, the core product feature, is blocked by an enterprise-or-organization Copilot policy requirement that a personal subscription does not satisfy. The non-Microsoft-agent gap, the leaked internal path, and the template SUPPORT.md are confirmed by direct inspection.

What the runs tell you

The local half of Skill Recorder (capture, pipeline, build, install integrity, tests) is production-grade and verifiable. The cloud half (Analyze and Build, both driven by the GitHub Copilot CLI through @github/copilot-sdk) could not be exercised because the Copilot API returned a 403 enterprise-policy error on every call. Combined with the Scout-and-Cowork-only output target, this means a reviewer outside a Microsoft-enterprise Copilot tenant can confirm the tool is well built but cannot confirm it produces a usable skill end to end. Anyone evaluating it for purchase should first confirm their Copilot entitlement includes the specific policy the API enforces.

Setup Walkthrough

1. Confirm prerequisites. You need macOS (primary target), Windows 11 x64 or ARM64, or Ubuntu; a Node.js 24 runtime (the installer downloads a pinned one for you); and a GitHub account with Copilot access. Critically, confirm with your Copilot admin that the enterprise or organization policy the Copilot CLI requires is enabled, because a personal Copilot subscription produced a 403 in testing.
2. Pick the latest release at github.com/microsoft/skill-recorder/releases/latest and copy the command for your platform. Each release publishes the exact 40-character commit SHA and the SHA-256 of both installer scripts. The commit appears twice in the command on purpose: it pins both the script and the source.
3. On macOS or Ubuntu, run commit="<40-char-release-commit>"; curl -fsSL "https://raw.githubusercontent.com/microsoft/skill-recorder/$commit/install.sh" | SKILL_RECORDER_COMMIT="$commit" bash. On Windows PowerShell, run $commit="<40-char-release-commit>"; $env:SKILL_RECORDER_COMMIT=$commit; irm "https://raw.githubusercontent.com/microsoft/skill-recorder/$commit/install.ps1" | iex. The installer downloads a pinned Node.js runtime, verifies it against nodejs.org SHASUMS256.txt, fetches the exact source commit from GitHub Codeload, runs npm ci, runs the license-compliance check (which fails closed on any unresolved dependency), builds locally, and creates a Skill Recorder (Source) app entry.
4. Prefer the inspect-first procedure in INSTALL.md if your policy blocks piping a downloaded script to a shell. It downloads the script, prints its SHA-256 for comparison against the release, lets you read it, and only then executes it.
5. Launch Skill Recorder (Source). On first launch, grant macOS Screen Recording permission. Record a task with the global hotkey (Cmd+Shift+R on macOS, Ctrl+Shift+R on Windows), then click Analyze. The first Analyze offers a Sign in to Copilot flow if the bundled CLI is not yet authenticated.
6. To develop from source instead, clone, run npm ci, run npm run compliance:licenses, then npm run dev for hot-reload or npm run build for a typechecked production build. The eval suites require the same Copilot entitlement as the app.

The main gotcha is the Copilot entitlement. If Analyze returns the enterprise-policy 403, no amount of reinstalling helps. The second gotcha is target compatibility: the produced SKILL.md lands in ~/.copilot/skills/ and its body references Scout or Cowork tools, so it is not directly consumable by Hermes, OpenClaw, Claude Code, Cursor, or Codex.

Alternatives

1. Authoring a SKILL.md by hand or with a meta-skill - FrancyJGLisboa/agent-skill-creator or getsentry/skills' skill-writer produce portable skills for any agent that reads the Agent Skills format. More manual, but agent-agnostic and not gated on a specific Copilot entitlement.
2. A general screen-recording and macro tool (Macro Recorder, Automator, n8n) - Captures and replays UI interactions without the LLM reconstruction step. Replays clicks rather than generalizing intent to native tools, so it does not produce a reusable agent skill, but it runs anywhere and needs no cloud LLM.
3. vercel-labs/skills (npx skills) - The package manager and runtime for the open agent skills ecosystem. It does not record sessions, but it installs and manages portable SKILL.md skills across 73 agents including Hermes and OpenClaw, which is the distribution step Skill Recorder does not address.