copilot-sdk
Pass
Audited by Gen Agent Trust Hub on Oct 28, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill serves as a technical reference guide for the GitHub Copilot SDK, facilitating integration with official services and following industry-standard patterns for library usage and API interaction.\n- [EXTERNAL_DOWNLOADS]: Setup instructions refer to official packages from standard registries, including @github/copilot-sdk for Node.js and github-copilot-sdk for Python.\n- [COMMAND_EXECUTION]: Examples for local MCP servers utilize standard CLI tools and include specific guidance on maintaining restricted working directories and sandboxed execution environments.\n- [CREDENTIALS_UNSAFE]: The skill advocates for secure token management by using environment variables (e.g., GITHUB_TOKEN) for programmatic authentication, avoiding the risk of hardcoded secrets.\n- [INDIRECT_PROMPT_INJECTION]: The guide includes implementation patterns for permission and input handlers, ensuring human-in-the-loop validation for tool invocations and mitigating risks associated with processing model-generated data.
Audit Metadata