The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes the vardoger CLI to perform file system operations. It includes explicit instructions for the user to override platform security settings and grant the tool write access outside the current workspace sandbox to modify directories such as ~/.copilot/ and ~/.vardoger/.
[DATA_EXFILTRATION]: The skill accesses highly sensitive user data by reading the conversation history of GitHub Copilot CLI sessions stored at ~/.copilot/session-state/.
[EXTERNAL_DOWNLOADS]: The instructions recommend installing the vardoger utility from a third-party GitHub repository (dstrupl/vardoger) that is not owned by the skill's vendor. This introduces a supply chain dependency on an external tool for processing sensitive history data.
[PERSISTENCE]: The skill modifies ~/.copilot/copilot-instructions.md, which serves as a persistent configuration file for the GitHub Copilot CLI. This allows behavioral instructions to persist across all future assistant sessions.
[INDIRECT_PROMPT_INJECTION]:
Ingestion points: The skill processes raw data from the ~/.copilot/session-state/ directory, which contains untrusted text from past AI conversations.
Boundary markers: The output uses markdown comments () to delimit content, but these do not prevent the agent from being influenced by malicious prompts embedded within the history being analyzed.
Capability inventory: The assistant summarizes and synthesizes user data and writes it back to local configuration files via shell commands.
Sanitization: There is no mechanism described to sanitize or filter the summarized history, meaning malicious content in past conversations could be written into the permanent instruction set, affecting future agent behavior.

vardoger-analyze