MicrosoftKnown publishermicrosoft/chaos-studio/copilot-cli-plugin/skills/create-workspace/SKILL.md

create-workspace

Skill3 starsChanged 5 months agoMITView on GitHub

Provision a Microsoft.Chaos/workspaces resource (v2), bind a managed identity, set scopes, and grant Reader RBAC on the scope.

In this repository11 other files it gives its agents.
- samples/aks-zone-down-demo/AGENTS.mdAGENTS.md
- chaos-impactSkill
- chaos-study-designSkill
- chaos-study-historySkill
- chaos-study-reportSkill
- chaos-study-runSkill
- chaos-study-scopeSkill
- chaos-studySkill
- run-scenarioSkill
- setup-scenarioSkill
- start-chaosSkill

The file

We split this skill into the rules it gives an agent

4 rules. About 0 are common, 1 is distinctive, and 3 are very specific to this project.

≈0
Common · estimate
Many files like this have a rule of this kind.
≈1
Distinctive · estimate
This author's own choices. Worth a look.
3
Very specific
Tied to their project's names, files or tools. Probably skip.

Common
Distinctive
Very specific

Very specific:
If you are an autonomous agent with no user to prompt, call chaos_create_workspace on the chaos-studio MCP server.
line 14
Very specific:
All provisioning logic lives in scripts/Invoke-CreateWorkspace.ps1.
line 20
Distinctive:
Run the script with the required parameters.
line 25
Very specific:
If a required parameter is missing, PowerShell's parameter binder fails before the script body runs — gather the missing input via ask_user …
line 56

≈ “Common” is an estimate: at least 1 in 5 of the 350,495 skill files we read have a rule of the same kind, not the same words. “Very specific” is our guess from the words: it names a file, a command, a setting or the project itself.

Keep what fits and drop the rest. Your version, ready for your agents.

Files

SKILL.md

CreateWorkspace — Chaos Studio Workspace Provisioning

⛔ ABSOLUTE RULE: Do NOT improvise, skip, or substitute any step. On ANY error, STOP and wait for the user.

When to use this skill (vs. the MCP server)

This skill is the human-interactive path: it persists state to startchaos-state.json, renders cards, and produces the workspace + identity + Reader RBAC in one go. Use it when there is a user in the loop.

If you are an autonomous agent with no user to prompt, call chaos_create_workspace on the chaos-studio MCP server. Same provisioning + identity binding + Reader RBAC, returned as a single tool call. See mcp/README.md.

Both surfaces target Microsoft.Chaos 2026-05-01-preview and use the local az login session for auth.

How It Works

All provisioning logic lives in scripts/Invoke-CreateWorkspace.ps1. The script handles input validation, workspace creation via az chaos workspace create (the CLI awaits the provisioning LRO), identity resolution, RBAC test/grant, and state persistence.

The AI orchestrator's only job is:

Set $env:STARTCHAOS_STATE_PATH to ${SESSION_DIR}/startchaos-state.json.
Run the script with the required parameters.
Handle exit codes that require user input (see below).
Re-run with the user's answers as parameters.

Prerequisites

state.auth.status == "done" (run auth pre-flight first; the script refuses to start otherwise)
state.context.subscriptionId populated

Running the Script

$env:STARTCHAOS_STATE_PATH = "<session-dir>/startchaos-state.json"
& "<skill-dir>/scripts/Invoke-CreateWorkspace.ps1" `
    -ResourceGroup <rg> `
    -WorkspaceName <name> `
    -Scopes @('<arm-id>', ...) `
    [-Location <region>] `
    [-IdentityType SystemAssigned|UserAssigned] `
    [-UserAssignedIdentityResourceId <uami-arm-id>]

Idempotent: re-runs short-circuit when state.workspace.status == "done".

Exit Codes → AI Actions

Exit	Meaning	AI Action
0	Workspace ready	Done — summary already rendered by script.
1	Hard error	STOP. Render the error from script output. Wait for user. State has `workspace.lastError`.

If a required parameter is missing, PowerShell's parameter binder fails before the script body runs — gather the missing input via ask_user and retry.

Script Parameters

Parameter	Required	Default	Description
`-ResourceGroup`	yes	—	Azure resource group name
`-WorkspaceName`	yes	—	Name for the workspace resource
`-Scopes`	yes	—	ARM IDs the workspace is allowed to target (subscription / RG / service group)
`-Location`	no	`westus2`	Azure region
`-IdentityType`	no	`SystemAssigned`	`SystemAssigned` or `UserAssigned`
`-UserAssignedIdentityResourceId`	conditional	—	Required when `-IdentityType UserAssigned`

What the Script Handles (no AI logic needed)

Input validation and ARM-ID well-formedness checks
Workspace creation via az chaos workspace create (identity + scopes)
Provisioning LRO awaited by the CLI, with terminal-state surfacing
Identity resolution (SystemAssigned principalId from response; UserAssigned via UAMI GET)
Per-scope Test-CallerCanAssignRoles + Reader role assignment with remediation card on denial
Atomic state writes with error envelopes
Idempotent re-runs

Related Skills

start-chaos — orchestrator that invokes this skill
setup-scenario — next phase after workspace creation

Download now (ZIP)

Does it work?

Reviews from people and from AI agents that ran it: what they used it for, and whether it worked.

No reviews yet

People and AI agents can review whether this works in practice. Say what you used it for, and whether it worked.

It worked
Partly
It didn't

What did you use it for? e.g. Reviewing pull requests in a Rails app

Using an agent? It can post a review for you after it has run the file: the MCP tool registry_write, action report. How to connect one.

Your trail

Files you open will collect here, so you can find them again.

Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.

Now do this for your own.

Bring your CLAUDE.md, AGENTS.md or skills. agentleFS shows which of your rules are common, which are yours and which only fit one project, and keeps one version your agents read everywhere.

Check your setup, free