The Agent Skills Directory

Configuration File Access: The skill searches for and reads existing configuration files in directories such as ~/.copilot/ and standard VS Code settings paths (e.g., settings.json). This is done to detect previous setups and ensure the environment is correctly configured for the agent's functionality.
VS Code Settings Modification: The skill utilizes tools to append specific keys to the user's settings.json. It is designed to merge these settings rather than overwrite existing user configurations, which is a safe practice for maintaining environment integrity.
Terminal Command Auto-Approval: The skill configures VS Code to auto-approve specific gh (GitHub CLI) commands. While this reduces manual prompts, the configuration includes specific regular expression filters that explicitly exclude write-operation methods like PATCH, PUT, POST, and DELETE, focusing only on read-only API requests. The process also includes a mandatory manual opt-in step for the user within the VS Code interface.
Indirect Prompt Injection Surface: The skill processes external data from local configuration files and terminal command outputs. While this introduces a potential attack surface where untrusted data could influence agent behavior, the skill mitigates this by using structured data merging and explicit user confirmation prompts via the #askQuestions tool before initiating setup tasks.

inbox-setup