brag-sheet
Pass
Audited by Gen Agent Trust Hub on Oct 3, 2026
Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- Local File Access: The skill scans
~/.copilot/session-state/to reconstruct work history from Copilot CLI session logs. While central to the skill's purpose, this represents an interaction with local user session data. - Command Execution via System Tools: The skill utilizes standard command-line tools (
git,gh) to fetch commit and PR history. These commands are assembled using user-provided parameters such as time ranges and author names. - Indirect Prompt Injection Surface: The agent ingests and processes external content like commit messages and Pull Request titles. This represents a potential surface where embedded instructions in processed data could influence agent behavior, a common consideration for data-summarization tools.
- Vendor Resource Integration: The skill references an external repository (
microsoft/copilot-brag-sheet) belonging to the vendor for enhanced tracking features. This resource is consistent with the skill's origin and intended use case.
Audit Metadata