T03 · Remote Payload Retrieval and Execution
Error
- Location
references/getting-started.md:39- Finding
Unverified Remote Installer Executed Directly by a Shell
- Content
View full analysis
- Remediation
View remediation
Security audit
Copilot CLI
Security checks for vulnerabilities and agentic risk
Overview
This is a reference-only Copilot CLI skill, but it repeatedly recommends broad unattended permissions and unsafe copy-paste setup patterns without enough scoping or warnings.
Install only if you want a Copilot CLI reference skill and will treat its automation examples as high-risk recipes. Prefer npm/Homebrew/WinGet or verified release installs, pin MCP package versions, avoid `--yolo`/`--allow-all`/`--no-ask-user` except in disposable trusted environments, scope tools and paths explicitly, avoid plaintext API keys, and redact hook logs before any external notification.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Findings (5)
T08 · Insecure Dependencies
Error
- Location
references/customization.md:123- Finding
Unpinned MCP Package Is Executed Through npx with Broad Tool Access
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
references/hooks.md:124- Finding
Hook Example Sends Unredacted Tool Failure Output by Email
- Content
View full analysis
> tool-stats.csv if [ "$RESULT_TYPE" = "failure" ]; then RESULT_TEXT=$(echo "$INPUT" | jq -r '.toolResult.textResultForLlm') echo "FAILURE: $TOOL_NAME - $RESULT_TEXT" | mail -s "Agent Tool Failed" admin@example.com fi ``` ### Technical Analysis The post-tool hook extracts the complete `textResultForLlm` value and transmits it through email whenever a tool fails. Tool output may contain source code, command output, filesystem paths, stack traces, configuration content, authentication material, or environment-derived secrets. The document later advises users to redact secrets, but the executable example does not implement redaction, size limits, field allowlisting, or user consent before transmission. Users who copy the example may therefore establish an unintended exfiltration channel. Email delivery can also pass through multiple relays and archives, expanding the number of systems retaining the sensitive output. ### Attack Path 1. The user installs the example as a `postToolUse` hook. 2. A tool operation fails while processing confidential data or emits a secret in its error output. 3. Copilot supplies the failure text to the hook as `toolResult.textResultForLlm`. 4. The hook copies the complete value into an email message. 5. The local mail system sends the message to an external recipient. 6. The sensitive content is retained in mailboxes, relays, logs, or archives. An attacker able to influence tool output could deliberately cause a failure containing selected repository data or secrets, causing the hook to transmit that content. ### Impact Assessment The hook may disclose repository so ...[truncated 424 chars]- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
SKILL.md:85- Finding
Unattended Agent Execution Is Granted Blanket Tools, Paths, and URL Permissions
- Content
View full analysis
" --no-ask-user --allow-all --max-autopilot-continues 3 # + exec options: pty=true, timeout=120 ``` - The `--add-dir ` flag grants access to specific directories without full `--allow-all` ``` ### Technical Analysis The recommended formula combines `--no-ask-user` with `--allow-all`. According to the project's own permission documentation, `--allow-all` grants access to all tools, paths, and URLs. `--no-ask-user` suppresses interactive questions, removing the opportunity for the user to approve sensitive operations. This combination is especially hazardous for an AI coding agent because repository files, custom instructions, plugins, MCP results, web content, or task input may contain prompt-injection content. If such content influences the agent, blanket permissions permit immediate shell execution, filesystem changes, and network access without confirmation. The document acknowledges narrower alternatives such as `--add-dir` and elsewhere provides scoped `--allow-tool` examples. Therefore, blanket permissions exceed the minimum privileges necessary for many declared tasks. ### Attack Path 1. A user opens or pre-trusts a repository containing malicious instructions or adversarial content. 2. The user invokes Copilot through the recommended unattended command. 3. The agent reads attacker-controlled repository content as part of its context. 4. The content induces the agent to run command ...[truncated 800 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
references/customization.md:132- Finding
MCP Configuration Example Encourages Plaintext API Key Storage
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
Findings (32)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | `hooks.md` | Hook types (command + prompt), config, denial responses, PowerShell support |
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 98% confidence
- Finding
curl -fsSL https://gh.io/copilot-install | bashis a classic external-script execution pattern that directly feeds network content into a shell. This creates a high-risk arbitrary code execution path if the remote content changes unexpectedly, the redirect target is compromised, or transport/trust assumptions fail.- Content
Install Script (macOS/Linux)
bash curl -fsSL https://gh.io/copilot-install | bash # Custom: VERSION="v0.0.369" PREFIX="$HOME/custom" bash
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 96% confidence
- Finding
The
| bashchaining pattern removes any review boundary between download and execution, increasing the blast radius of a compromised or malicious response. In a getting-started guide, this is especially risky because users are likely to copy-paste it verbatim, making exploitation straightforward.- Content
Install Script (macOS/Linux)
bash curl -fsSL https://gh.io/copilot-install | bash # Custom: VERSION="v0.0.369" PREFIX="$HOME/custom" bash
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
This section explicitly instructs users to use
--allow-alland states that--no-ask-useralone does not grant file write access, but it omits a warning that--allow-allgrants broad permissions to the CLI agent. In an orchestration environment like OpenClaw, this is especially risky because it encourages unattended execution with elevated action scope, which could lead to destructive filesystem changes or unsafe tool use if prompts or surrounding inputs are untrusted.- Content
Memory Manipulation
High
- Category
- Memory Poisoning
- Confidence
- 80% confidence
- Finding
Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.
- Content
md | Command | Purpose | |---------|---------| | `/clear`, `/new` | Reset context | | `/resume` | Resume previous session | | `/session` | Show session info | | `/session checkpoints` | List compaction checkpoints |
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill includes non-interactive examples using
--yoloand--no-ask-user, which can authorize autonomous command execution and file modifications without human confirmation. In a reference skill, presenting these patterns without an adjacent warning or scoped-safe alternative increases the chance that downstream agents or users will copy unsafe defaults into automation.- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
- Copilot requires a real TTY — pipe/stdout redirection causes
EPIPEcrashes - Use
pty: trueon exec calls to avoid output fragmentation - Set
timeout: 120minimum (MCP startup ~3s + inference ~25s+) - Use
--allow-all(or--yolo) for file write permissions in--no-ask-usermode - Working formula:
bash copilot -p "<prompt>" --no-ask-user --allow-all --max-autopilot-continues 3
- Copilot requires a real TTY — pipe/stdout redirection causes
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The guidance explicitly recommends
--allow-allor--yoloin--no-ask-usermode and even labels it a 'working formula,' normalizing broad unattended privileges. If copied into CI/CD or agent automation, this can enable unrestricted file writes and shell actions in trusted directories, magnifying the blast radius of prompt mistakes, agent misuse, or compromised inputs.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The examples explicitly show unattended execution with file-writing and broad tool permissions (
--yolo,--no-ask-user,write) but provide no nearby warning about the risk of autonomous modification or command execution. In a reference skill, this can normalize unsafe copy-paste usage and lead users to run high-privilege automation in the wrong repository or environment.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The batch example combines iteration over many files with
--allow-all-tools, which grants sweeping capabilities across repeated runs without user confirmation. This materially increases blast radius: a bad prompt, tool misuse, or unsafe agent behavior can affect multiple files or invoke arbitrary tools at scale.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The GitHub Actions example shows unattended execution in CI with a repository secret token and write-capable tools, but does not warn about credential exposure, unintended repository changes, or PR-triggered abuse paths. In CI, these examples are especially sensitive because they may run automatically in privileged contexts and can persist changes at scale.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The autopilot section says 'Enable all permissions (recommended)' without a balancing warning that autonomous execution with full permissions can make destructive changes or run sensitive commands without step-by-step review. Because the feature is specifically about autonomous continuation, recommending full permissions amplifies risk beyond a normal interactive workflow.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The delegation section states that unstaged changes are committed, a branch is created, and a draft PR is opened, but it does not prominently warn users that local, possibly unintended work will be included and pushed into a tracked artifact. This can expose sensitive or unfinished changes and surprises users about persistence and publication of local state.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md ### Creating Agents Use `/agent` → **Create new agent** → choose Project (`.github/agents/`) or User (`~/.copilot/agents/`). Options: - **Copilot-assisted:** Describe expertise and Copilot generates the profile. Review, edit, continue. - **Manual:** Guided prompts for name, description, instructions, and tool selection.
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The documentation recommends executing a remote installation script via
curl ... | bashwithout any integrity verification, pinning guidance, or warning about the risks of running downloaded code. Even in reference documentation, this normalizes a dangerous practice that could lead to arbitrary code execution if the shortlink, hosting, or delivery path is compromised.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The file documents
--allow-all,--yolo, unrestricted tool access, path access, and URL access without an adjacent safety warning describing the consequences. In the context of an autonomous CLI agent, encouraging blanket permission bypass can let prompts or mistakes trigger destructive shell commands, broad filesystem reads/writes, or network exfiltration.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The examples encourage capturing hook inputs, tool arguments, tool results, and emailing failure details, which can include sensitive prompts, file paths, command contents, secrets, or proprietary data. Although the page briefly mentions redacting secrets in best practices, the concrete logging examples do not demonstrate minimization or redaction, making it likely that users will implement unsafe audit trails that leak sensitive data to local logs or external mail systems.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
Lines L27-L31 state that the CLI receives VS Code editor selections in real time and accesses live diagnostics, which can include sensitive code or error content. The reference explains the feature behavior but does not warn users that this data is transmitted to the CLI/agent context or advise caution when sensitive material is selected.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The documentation explicitly shows how to pre-populate
trusted_foldersand then runcopilot --yolo --no-ask-user, which reduces or eliminates interactive safety/trust checks. In an automation/agent workflow skill, this guidance can normalize bypassing user confirmation and trust boundaries, increasing the chance that unreviewed code runs in a directory the user did not explicitly approve.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The document tells users they can share research output via gist or file, but it does not warn that reports are generated from the codebase, GitHub repos, and the web and may therefore include proprietary or sensitive information. Because this is a markdown reference file, missing disclosure about privacy-impacting sharing behavior fits the missing user warnings category.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The file explains that Chronicle analyzes sessions, prompts, and history and provides commands to share or export sessions, but it does not caution users that this material may reveal sensitive work patterns, prompts, branch names, or other project details. For markdown files, omitting warnings about privacy-affecting behavior is reportable under this rule.
- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
md | 403 / policy denied | Check Copilot subscription; ask org admin to enable CLI policy | | Classic PAT (`ghp_`) rejected | Use fine-grained PAT (`github_pat_`) instead | | Wrong account | Unset unintended env vars (`COPILOT_GITHUB_TOKEN`, `GH_TOKEN`); use `/user switch` | | Keychain unavailable (Linux) | Install `libsecret`: `sudo apt install libsecret-1-0 gnome-keyring`; or accept plaintext | ### Keychain Diagnostics
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
This markdown file includes a command that deletes the Copilot CLI keychain entry and forces re-authentication, but it provides no warning that the action is destructive or may remove stored credentials. Under the markdown-file criteria for missing user warnings, operations that can affect user data or system state should be accompanied by a clear caution.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The guidance recommends non-interactive automation with powerful flags like
--yolo --no-ask-useras a fallback, but does not explain that these settings reduce or remove user confirmation safeguards. In an agent-orchestrated context, this can normalize running autonomous actions without review, increasing the chance of unintended file changes or command execution.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The recommended cleanup command uses
lsof -ti:PORT | xargs kill -9, which forcefully terminates whatever process owns the port, without warning that the process may be unrelated to Copilot or the intended background server. In shared dev environments or reused ports, this can cause unintended denial of service or terminate important local processes.- Content