The Agent Skills Directory

[COMMAND_EXECUTION]: The mcpServers configuration supports a local transport type that allows for the execution of arbitrary system commands and binaries (e.g., npx) with user-defined arguments.
[COMMAND_EXECUTION]: The cliPath parameter in the CopilotClient configuration allows specifying a path to an executable file that will be run by the SDK, providing a direct vector for command execution.
[EXTERNAL_DOWNLOADS]: The documentation instructs users to install packages such as @github/copilot-sdk and github-copilot-sdk which are not standard official releases from GitHub, posing a potential supply chain risk.
[PROMPT_INJECTION]: The skill presents an indirect prompt injection surface.
Ingestion points: External logic and data are ingested via the skillDirectories feature and remote mcpServers (SKILL.md).
Boundary markers: The documentation does not specify the use of delimiters or 'ignore' instructions when loading external skill content.
Capability inventory: The SDK facilitates local command execution via MCP and binary execution via cliPath (SKILL.md).
Sanitization: The onPreToolUse hook is provided for manual inspection and filtering of tool calls, though its implementation is optional.
[REMOTE_CODE_EXECUTION]: The skillDirectories feature enables the loading of external code and instructions into the agent's runtime environment, which could lead to the indirect execution of untrusted logic.
[DATA_EXFILTRATION]: The skill allows configuring external HTTP-based MCP servers and Bring Your Own Key (BYOK) providers, which involves transmitting potentially sensitive context and credentials to remote endpoints.

copilot-sdk