The Agent Skills Directory

[COMMAND_EXECUTION]: The skill is designed to execute the GitHub Copilot CLI (copilot), which acts as an AI implementer capable of modifying code and running project tools. The --allow-all-tools flag explicitly grants the implementer full autonomy to run arbitrary shell commands in the local environment, which is a high-risk capability by design.\n- [REMOTE_CODE_EXECUTION]: The scripts/relay.mjs script is vulnerable to command injection on Windows systems. It uses child_process.spawn with shell: true and a custom quotePath function that wraps paths in double quotes but does not escape existing quotes within the path. If an argument such as --out-dir or --brief contains a malicious path string (e.g., carrying shell operators like " & calc.exe & "), it can break out of the intended command and execute arbitrary code on the host system.\n- [CREDENTIALS_UNSAFE]: The skill handles sensitive GitHub authentication tokens (COPILOT_GITHUB_TOKEN, GH_TOKEN, GITHUB_TOKEN). While this is necessary for the copilot CLI to function, these credentials are inherited by child processes and stored in the environment.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes 'briefs'—instructions for the AI implementer—which are untrusted data sources. These could be manipulated to contain instructions to bypass security controls. While the skill documentation emphasizes manual review of changes, the risk of the implementer performing unauthorized actions remains inherent in the delegation model.

copilot-delegate