install-devcontainer
Pass
Audited by Gen Agent Trust Hub on Jun 23, 2026
Risk Level: SAFEREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill downloads and executes an installation script from the author's repository using
curl -fsSL https://raw.githubusercontent.com/yldgio/copilot-devcontainer/main/install.sh | bash. This pattern executes remote code directly in the user's shell environment. - [REMOTE_CODE_EXECUTION]: For Windows systems, the skill uses
irm https://raw.githubusercontent.com/yldgio/copilot-devcontainer/main/install.ps1 | iex(Invoke-RestMethod piped to Invoke-Expression) to execute a PowerShell script from the author's GitHub account. - [EXTERNAL_DOWNLOADS]: The skill utilizes
npx github:yldgio/copilot-devcontainerto download and run the setup package directly from the author's GitHub repository. - [COMMAND_EXECUTION]: The skill provides instructions to run post-installation shell scripts (
.devcontainer/scripts/setup-copilot.shand.devcontainer/scripts/install-plugins.sh) that are included in the downloaded repository content.
Audit Metadata