copilot-cli-agent
Pass
Audited by Gen Agent Trust Hub on May 24, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the
Bashtool to invoke thecopilotCLI. It builds command lines dynamically to pipe input files and instructions. Instructions inSKILL.mdandreferences/fallback-tree.mdmandate environment verification via smoke tests and discourage the use of high-privilege flags like--allow-all-tools. - [PROMPT_INJECTION]: The skill processes untrusted data (file content) by piping it to an LLM sub-agent, creating an indirect injection surface.
- Ingestion points:
cat <INPUT> | copilot ...inSKILL.md. - Boundary markers: Commands are prefixed with isolation instructions ("Do NOT use tools. Do NOT search filesystem.") to mitigate injection risks.
- Capability inventory: The skill utilizes
Bash,Read, andWritecapabilities across its scripts. - Sanitization: Input content is piped directly without transformation; security relies on the sub-agent's prompt constraints.
Audit Metadata