Copilot CLI

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:01 AM UTC
• Version: 1.1.1

Overview

This is a reference-only Copilot CLI skill, but it repeatedly recommends broad unattended permissions and unsafe copy-paste setup patterns without enough scoping or warnings.

Install only if you want a Copilot CLI reference skill and will treat its automation examples as high-risk recipes. Prefer npm/Homebrew/WinGet or verified release installs, pin MCP package versions, avoid `--yolo`/`--allow-all`/`--no-ask-user` except in disposable trusted environments, scope tools and paths explicitly, avoid plaintext API keys, and redact hook logs before any external notification.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads

Findings (5)

T03 · Remote Payload Retrieval and Execution

Error

• Location: references/getting-started.md:39
• Finding: Unverified Remote Installer Executed Directly by a Shell<![CDATA[ ## Vulnerability Details **File Location**: `references/getting-started.md:39-42` **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High ```bash ### Install Script (macOS/Linux) ```bash curl -fsSL https://gh.io/copilot-install | bash # Custom: VERSION="v0.0.369" PREFIX="$HOME/custom" bash ``` ``` ### Technical Analysis The installation command streams mutable content from an external URL directly into Bash. The user cannot inspect the downloaded script before execution, and the command performs no checksum or signature verification. Although `gh.io` is associated with GitHub and HTTPS protects transport under ordinary conditions, neither property guarantees that the effective script remains identical to the version reviewed during this audit. A compromised redirect, hosting account, release process, DNS/TLS path, or upstream script could change the executed payload. The use of `curl -f` and `-sS` only controls HTTP error handling and output; it does not validate the script's authenticity or integrity. ### Attack Path 1. An attacker compromises or gains control over the redirected installer, its hosting location, or its release pipeline. 2. The attacker replaces the expected installer with a malicious shell script. 3. A user follows the Skill's documented installation command. 4. `curl` retrieves the modified content. 5. Bash immediately executes the content without review or integrity verification. 6. The payload acts with all privileges available to the invoking user. ### Impact Assessment The remote script can run arbitrary commands with the user's privileges. Potential impact includes modification or deletion of user files, credential theft, installation of persistent components, execution of additional payloads, and compromise of source repositories accessible to the user. The command does not include `sudo`, so root access is not obtained automatically. However, the impact remains broad for the current user a ...[truncated 84 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Prefer the official npm, Homebrew, WinGet, or signed release installation methods. - If a script is necessary, download it to a file rather than piping it into a shell. - Pin the installer or release to an immutable version. - Verify a vendor-published cryptographic signature or SHA-256 checksum before execution. - Let the user inspect the downloaded script before running it. - Execute the installer with the minimum required privileges and never recommend running it through `sudo` unless strictly necessary. - Replace the current example with a workflow similar to: ```bash curl -fL -o copilot-install.sh 'IMMUTABLE_VERSIONED_URL' echo 'EXPECTED_SHA256 copilot-install.sh' | sha256sum -c - less copilot-install.sh bash copilot-install.sh ``` ]]>

T08 · Insecure Dependencies

Error

• Location: references/customization.md:123
• Finding: Unpinned MCP Package Is Executed Through npx with Broad Tool Access<![CDATA[ ## Vulnerability Details **File Location**: `references/customization.md:123-138` **Vulnerability Type**: Unsafe and unpinned third-party dependency execution **Risk Level**: High ```json { "mcpServers": { "playwright": { "type": "local", "command": "npx", "args": ["@playwright/mcp@latest"], "env": {}, "tools": ["*"] }, "remote-api": { "type": "http", "url": "https://mcp.example.com/mcp", "headers": { "API_KEY": "..." }, "tools": ["*"] } } } ``` ### Technical Analysis The local MCP configuration invokes `npx` with `@playwright/mcp@latest`. The `latest` tag is mutable, so future executions may retrieve and run code that was not present when the configuration was reviewed. The example also grants the server every exposed MCP tool through `"tools": ["*"]`. Package installation and startup code execute with the privileges of the Copilot CLI user. If the package, maintainer account, registry publication process, or dependency chain is compromised, malicious code can execute locally. The wildcard tool configuration increases the capabilities available through the MCP integration. This is necessary only to the extent that an MCP server must run for the documented integration. Neither a mutable package version nor unrestricted tool access is necessary for that functionality. ### Attack Path 1. An attacker compromises the package, a transitive dependency, the publisher account, or the package registry. 2. A malicious version becomes the target of the mutable `latest` tag. 3. Copilot starts the configured MCP server through `npx`. 4. `npx` retrieves and executes the changed package. 5. The package operates with the user's local process permissions. 6. The wildcard MCP configuration exposes all server tools to agent-driven use, potentially amplifying access to data or browser operations. ### Impact Assessment A compromised package could read files accessible to the user, inspect en ...[truncated 356 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Pin the MCP package to an exact reviewed version rather than using `@latest`. - Install it as a locked project dependency and execute the local binary. - Commit and enforce an appropriate lockfile. - Use package-manager integrity metadata and verify provenance or signatures where available. - Review the package and its dependency tree before enabling it. - Replace `"tools": ["*"]` with an explicit list of tools required by the workflow. - Run third-party MCP servers in a sandbox or container with restricted filesystem, environment, and network access. - Establish a controlled update process that reviews version changes before deployment. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: references/hooks.md:124
• Finding: Hook Example Sends Unredacted Tool Failure Output by Email<![CDATA[ ## Vulnerability Details **File Location**: `references/hooks.md:124-134` **Vulnerability Type**: Sensitive data exposure through external logging **Risk Level**: High ```bash #!/bin/bash INPUT=$(cat) TOOL_NAME=$(echo "$INPUT" | jq -r '.toolName') RESULT_TYPE=$(echo "$INPUT" | jq -r '.toolResult.resultType') echo "$(date),${TOOL_NAME},${RESULT_TYPE}" >> tool-stats.csv if [ "$RESULT_TYPE" = "failure" ]; then RESULT_TEXT=$(echo "$INPUT" | jq -r '.toolResult.textResultForLlm') echo "FAILURE: $TOOL_NAME - $RESULT_TEXT" | mail -s "Agent Tool Failed" [e-mail] fi ``` ### Technical Analysis The post-tool hook extracts the complete `textResultForLlm` value and transmits it through email whenever a tool fails. Tool output may contain source code, command output, filesystem paths, stack traces, configuration content, authentication material, or environment-derived secrets. The document later advises users to redact secrets, but the executable example does not implement redaction, size limits, field allowlisting, or user consent before transmission. Users who copy the example may therefore establish an unintended exfiltration channel. Email delivery can also pass through multiple relays and archives, expanding the number of systems retaining the sensitive output. ### Attack Path 1. The user installs the example as a `postToolUse` hook. 2. A tool operation fails while processing confidential data or emits a secret in its error output. 3. Copilot supplies the failure text to the hook as `toolResult.textResultForLlm`. 4. The hook copies the complete value into an email message. 5. The local mail system sends the message to an external recipient. 6. The sensitive content is retained in mailboxes, relays, logs, or archives. An attacker able to influence tool output could deliberately cause a failure containing selected repository data or secrets, causing the hook to transmit that content. ### Impact Assessment The hook may disclose repository so ...[truncated 424 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Do not transmit raw `toolResult.textResultForLlm` content by default. - Log only allowlisted metadata such as timestamp, tool name, result type, and a non-sensitive event identifier. - Implement structured redaction for tokens, authorization headers, environment variables, private keys, connection strings, and known secret formats. - Apply strict message-length limits and remove source-code and command-output fields. - Require explicit user or administrator consent before enabling external notifications. - Prefer local logs protected with restrictive filesystem permissions. - If external alerts are required, send only a reference ID and keep detailed output in an access-controlled local or centralized logging system. - Add tests proving that representative secrets are removed before any network transmission. ]]>

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:85
• Finding: Unattended Agent Execution Is Granted Blanket Tools, Paths, and URL Permissions<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:85-95` **Vulnerability Type**: Excessive permissions and disabled approval controls **Risk Level**: High ```markdown **OpenClaw Integration (programmatic exec):** - Copilot requires a real TTY — pipe/stdout redirection causes `EPIPE` crashes - Use `pty: true` on exec calls to avoid output fragmentation - Set `timeout: 120` minimum (MCP startup ~3s + inference ~25s+) - Use `--allow-all` (or `--yolo`) for file write permissions in `--no-ask-user` mode - Working formula: ```bash copilot -p "<prompt>" --no-ask-user --allow-all --max-autopilot-continues 3 # + exec options: pty=true, timeout=120 ``` - The `--add-dir <path>` flag grants access to specific directories without full `--allow-all` ``` ### Technical Analysis The recommended formula combines `--no-ask-user` with `--allow-all`. According to the project's own permission documentation, `--allow-all` grants access to all tools, paths, and URLs. `--no-ask-user` suppresses interactive questions, removing the opportunity for the user to approve sensitive operations. This combination is especially hazardous for an AI coding agent because repository files, custom instructions, plugins, MCP results, web content, or task input may contain prompt-injection content. If such content influences the agent, blanket permissions permit immediate shell execution, filesystem changes, and network access without confirmation. The document acknowledges narrower alternatives such as `--add-dir` and elsewhere provides scoped `--allow-tool` examples. Therefore, blanket permissions exceed the minimum privileges necessary for many declared tasks. ### Attack Path 1. A user opens or pre-trusts a repository containing malicious instructions or adversarial content. 2. The user invokes Copilot through the recommended unattended command. 3. The agent reads attacker-controlled repository content as part of its context. 4. The content induces the agent to run command ...[truncated 800 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Make narrowly scoped `--allow-tool` and `--add-dir` configurations the default. - Grant only the specific shell command families and write paths required for each task. - Deny access to credential files, home-directory configuration, SSH material, environment files, and unrelated repositories. - Deny network access by default and allowlist only required domains. - Retain user approval for destructive commands, new network destinations, privilege-sensitive operations, and writes outside the working tree. - Run unattended agents inside disposable containers or virtual machines with no host credentials. - Mount only the target repository and use a low-privilege operating-system account. - Avoid using `--allow-all` on untrusted or externally contributed repositories. - Clearly label blanket-permission examples as exceptional and unsafe rather than as the standard working formula. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: references/customization.md:132
• Finding: MCP Configuration Example Encourages Plaintext API Key Storage<![CDATA[ ## Vulnerability Details **File Location**: `references/customization.md:132-138` **Vulnerability Type**: Plaintext credential storage in configuration **Risk Level**: Medium ```json "remote-api": { "type": "http", "url": "https://mcp.example.com/mcp", "headers": { "API_KEY": "..." }, "tools": ["*"] } ``` ### Technical Analysis The example places an API key directly in the MCP JSON configuration. A user is likely to replace the placeholder with a real credential, leaving it in plaintext under `~/.copilot/mcp-config.json`. Plaintext configuration can be exposed through backups, support archives, accidental file sharing, overly broad filesystem permissions, malware, or other local processes operating under the same user. The example provides no environment-variable interpolation, credential-store integration, file-permission guidance, or rotation procedure. Access to the MCP configuration path is legitimate for the Skill's declared customization functionality. The issue is the demonstrated secret-storage pattern, not the mere use of `~/.copilot/mcp-config.json`. ### Attack Path 1. A user copies the example into the MCP configuration file. 2. The placeholder is replaced with a valid API key. 3. The key remains stored as plaintext on disk. 4. Another local process, user with sufficient filesystem access, backup operator, or recipient of a copied configuration obtains the file. 5. The attacker extracts the key and authenticates to the associated remote API. 6. The attacker performs operations allowed by the key until it is revoked or expires. ### Impact Assessment The attacker gains the API privileges assigned to the exposed key. Depending on the remote service, this could include reading sensitive data, invoking paid operations, modifying remote resources, or accessing organization-level integrations. The local impact is limited to disclosure of the stored secret, but the downstream service impact depends on the credential's scope. The wi ...[truncated 109 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Do not place real API keys directly in committed or long-lived JSON configuration. - Use environment-variable references or an operating-system credential manager if supported. - If the MCP client cannot reference a secure store directly, use a minimal wrapper that retrieves the secret at runtime without logging it. - Restrict configuration permissions to the owning user, such as mode `0600` on Unix-like systems. - Keep configuration files out of repositories, shared archives, and support bundles. - Use narrowly scoped, short-lived credentials with rotation and revocation procedures. - Replace `"tools": ["*"]` with an explicit list of required remote operations. - Document how to remove and rotate a key after suspected exposure. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation

Findings (32)

Ae1

High

• Category: analysis-evasion

Content

| `hooks.md` | Hook types (command + prompt), config, denial responses, PowerShell support |

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

External Script Fetching

High

• Category: Supply Chain

Content

### Install Script (macOS/Linux)
```bash
curl -fsSL https://gh.io/copilot-install | bash
# Custom: VERSION="v0.0.369" PREFIX="$HOME/custom" bash
```

• Confidence: 98% confidence
• Finding: `curl -fsSL https://gh.io/copilot-install | bash` is a classic external-script execution pattern that directly feeds network content into a shell. This creates a high-risk arbitrary code execution path if the remote content changes unexpectedly, the redirect target is compromised, or transport/trust assumptions fail.

Chaining Abuse

High

• Category: Tool Misuse

Content

### Install Script (macOS/Linux)
```bash
curl -fsSL https://gh.io/copilot-install | bash
# Custom: VERSION="v0.0.369" PREFIX="$HOME/custom" bash
```

• Confidence: 96% confidence
• Finding: The `| bash` chaining pattern removes any review boundary between download and execution, increasing the blast radius of a compromised or malicious response. In a getting-started guide, this is especially risky because users are likely to copy-paste it verbatim, making exploitation straightforward.

Missing User Warnings

High

• Confidence: 96% confidence
• Finding: This section explicitly instructs users to use `--allow-all` and states that `--no-ask-user` alone does not grant file write access, but it omits a warning that `--allow-all` grants broad permissions to the CLI agent. In an orchestration environment like OpenClaw, this is especially risky because it encourages unattended execution with elevated action scope, which could lead to destructive filesystem changes or unsafe tool use if prompts or surrounding inputs are untrusted.

Memory Manipulation

High

• Category: Memory Poisoning

Content

| Command | Purpose |
|---------|---------|
| `/clear`, `/new` | Reset context |
| `/resume` | Resume previous session |
| `/session` | Show session info |
| `/session checkpoints` | List compaction checkpoints |

• Confidence: 80% confidence
• Finding: Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill includes non-interactive examples using `--yolo` and `--no-ask-user`, which can authorize autonomous command execution and file modifications without human confirmation. In a reference skill, presenting these patterns without an adjacent warning or scoped-safe alternative increases the chance that downstream agents or users will copy unsafe defaults into automation.

Session Persistence

Medium

• Category: Rogue Agent

Content

- Copilot requires a real TTY — pipe/stdout redirection causes `EPIPE` crashes
- Use `pty: true` on exec calls to avoid output fragmentation
- Set `timeout: 120` minimum (MCP startup ~3s + inference ~25s+)
- Use `--allow-all` (or `--yolo`) for file write permissions in `--no-ask-user` mode
- Working formula:
  ```bash
  copilot -p "<prompt>" --no-ask-user --allow-all --max-autopilot-continues 3

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The guidance explicitly recommends `--allow-all` or `--yolo` in `--no-ask-user` mode and even labels it a 'working formula,' normalizing broad unattended privileges. If copied into CI/CD or agent automation, this can enable unrestricted file writes and shell actions in trusted directories, magnifying the blast radius of prompt mistakes, agent misuse, or compromised inputs.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The examples explicitly show unattended execution with file-writing and broad tool permissions (`--yolo`, `--no-ask-user`, `write`) but provide no nearby warning about the risk of autonomous modification or command execution. In a reference skill, this can normalize unsafe copy-paste usage and lead users to run high-privilege automation in the wrong repository or environment.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The batch example combines iteration over many files with `--allow-all-tools`, which grants sweeping capabilities across repeated runs without user confirmation. This materially increases blast radius: a bad prompt, tool misuse, or unsafe agent behavior can affect multiple files or invoke arbitrary tools at scale.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The GitHub Actions example shows unattended execution in CI with a repository secret token and write-capable tools, but does not warn about credential exposure, unintended repository changes, or PR-triggered abuse paths. In CI, these examples are especially sensitive because they may run automatically in privileged contexts and can persist changes at scale.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The autopilot section says 'Enable all permissions (recommended)' without a balancing warning that autonomous execution with full permissions can make destructive changes or run sensitive commands without step-by-step review. Because the feature is specifically about autonomous continuation, recommending full permissions amplifies risk beyond a normal interactive workflow.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The delegation section states that unstaged changes are committed, a branch is created, and a draft PR is opened, but it does not prominently warn users that local, possibly unintended work will be included and pushed into a tracked artifact. This can expose sensitive or unfinished changes and surprises users about persistence and publication of local state.

Session Persistence

Medium

• Category: Rogue Agent

Content

### Creating Agents

Use `/agent` → **Create new agent** → choose Project (`.github/agents/`) or User (`~/.copilot/agents/`). Options:
- **Copilot-assisted:** Describe expertise and Copilot generates the profile. Review, edit, continue.
- **Manual:** Guided prompts for name, description, instructions, and tool selection.

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The documentation recommends executing a remote installation script via `curl ... | bash` without any integrity verification, pinning guidance, or warning about the risks of running downloaded code. Even in reference documentation, this normalizes a dangerous practice that could lead to arbitrary code execution if the shortlink, hosting, or delivery path is compromised.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The file documents `--allow-all`, `--yolo`, unrestricted tool access, path access, and URL access without an adjacent safety warning describing the consequences. In the context of an autonomous CLI agent, encouraging blanket permission bypass can let prompts or mistakes trigger destructive shell commands, broad filesystem reads/writes, or network exfiltration.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The examples encourage capturing hook inputs, tool arguments, tool results, and emailing failure details, which can include sensitive prompts, file paths, command contents, secrets, or proprietary data. Although the page briefly mentions redacting secrets in best practices, the concrete logging examples do not demonstrate minimization or redaction, making it likely that users will implement unsafe audit trails that leak sensitive data to local logs or external mail systems.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: Lines L27-L31 state that the CLI receives VS Code editor selections in real time and accesses live diagnostics, which can include sensitive code or error content. The reference explains the feature behavior but does not warn users that this data is transmitted to the CLI/agent context or advise caution when sensitive material is selected.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The documentation explicitly shows how to pre-populate `trusted_folders` and then run `copilot --yolo --no-ask-user`, which reduces or eliminates interactive safety/trust checks. In an automation/agent workflow skill, this guidance can normalize bypassing user confirmation and trust boundaries, increasing the chance that unreviewed code runs in a directory the user did not explicitly approve.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The document tells users they can share research output via gist or file, but it does not warn that reports are generated from the codebase, GitHub repos, and the web and may therefore include proprietary or sensitive information. Because this is a markdown reference file, missing disclosure about privacy-impacting sharing behavior fits the missing user warnings category.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The file explains that Chronicle analyzes sessions, prompts, and history and provides commands to share or export sessions, but it does not caution users that this material may reveal sensitive work patterns, prompts, branch names, or other project details. For markdown files, omitting warnings about privacy-affecting behavior is reportable under this rule.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

| 403 / policy denied | Check Copilot subscription; ask org admin to enable CLI policy |
| Classic PAT (`ghp_`) rejected | Use fine-grained PAT (`github_pat_`) instead |
| Wrong account | Unset unintended env vars (`COPILOT_GITHUB_TOKEN`, `GH_TOKEN`); use `/user switch` |
| Keychain unavailable (Linux) | Install `libsecret`: `sudo apt install libsecret-1-0 gnome-keyring`; or accept plaintext |

### Keychain Diagnostics

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: This markdown file includes a command that deletes the Copilot CLI keychain entry and forces re-authentication, but it provides no warning that the action is destructive or may remove stored credentials. Under the markdown-file criteria for missing user warnings, operations that can affect user data or system state should be accompanied by a clear caution.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The guidance recommends non-interactive automation with powerful flags like `--yolo --no-ask-user` as a fallback, but does not explain that these settings reduce or remove user confirmation safeguards. In an agent-orchestrated context, this can normalize running autonomous actions without review, increasing the chance of unintended file changes or command execution.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The recommended cleanup command uses `lsof -ti:PORT | xargs kill -9`, which forcefully terminates whatever process owns the port, without warning that the process may be unrelated to Copilot or the intended background server. In shared dev environments or reused ports, this can cause unintended denial of service or terminate important local processes.

Static analysis

No suspicious patterns detected.