copilot-sdk

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). The list includes one suspicious domain (https://api.githubcopilot.com/mcp/) that is not an official github.com host and resembles typosquatting/untrusted MCP endpoints, while the other URLs are official docs/repos or placeholders.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The GitHub Copilot SDK skill’s required runtime flow is “Client → Session → Message” where the application passes prompt/systemMessage (and potentially tool results/context) directly from caller/user text into session.sendAndWait(...), so outsider-authored free text can be ingested via the workflow’s user-input interface.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The MCP remote HTTP server URL "https://api.githubcopilot.com/mcp/" is configured at session creation (mcpServers) and would be contacted at runtime to provide tool capabilities that can directly influence agent behavior and execute remote tool logic.