Copilot CLI AI 代码分析

• Outcome: Review
• Latest audit: Sep 11, 2026 · 12:25 AM UTC
• Version: 1.0.1

Overview

This is a simple Copilot CLI guide, but it needs review because it recommends plaintext token storage and reduced-review execution without enough safety guidance.

Review this skill before installing. Use a fine-grained Copilot-only token, prefer an OS credential manager or restrictive file permissions if a file must be used, avoid `--yolo` outside disposable or well-backed-up workspaces, and do not run Copilot analysis on sensitive repositories unless your organization allows sending that context to GitHub Copilot services.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:96

Finding

GitHub Personal Access Token Stored in an Unprotected Plaintext File

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 12-14 and 94-98
Vulnerability Type: Plaintext sensitive-data storage
Risk Level: Medium

Vulnerable Code Snippet

markdown

2. **Set a GitHub Personal Access Token**
   - Visit https://github.com/settings/personal-access-tokens/new
   - Create a fine-grained token with the Copilot Requests permission
   - Save the token to `~/.copilot/github_token.txt`

bash

echo "new token" > ~/.copilot/github_token.txt

The snippets above are English translations of the corresponding instructions and command placeholder in the audited document.

Technical Analysis

The skill directs users to store a GitHub Personal Access Token in a regular plaintext file and provides a shell redirection command to create or replace that file. It does not require a restrictive umask, explicitly set file permissions, verify the permissions of the parent directory, or recommend an operating-system credential store.

Shell redirection creates the file according to the user's active umask. Under a commonly used 022 umask, a newly created file may be readable by other local users. If the file already exists, redirection preserves its existing permissions, meaning an already over-permissive token file remains exposed.

Subsequent examples read the token directly from this predictable location and place it in the COPILOT_GITHUB_TOKEN environment variable:

bash

COPILOT_GITHUB_TOKEN=$(cat ~/.copilot/github_token.txt) copilot -p "your question"

Consequently, any process or local account capable of reading the token file can recover and reuse the credential. Exploitation depends on local filesystem access and the effective permissions of the file and its parent directories.

Attack Path

1. A user follows the documented setup procedure and writes a valid GitHub token to ~/.copilot/github_token.txt.
2. The shell creates the file using the curre ...[truncated 1190 chars]

Remediation

View remediation

Remediation Suggestions

1. Store the token in an operating-system credential manager, such as macOS Keychain, Windows Credential Manager, or a Linux Secret Service implementation, rather than in a plaintext file.

2. Prefer an official authenticated GitHub CLI workflow where supported, so credential storage and renewal are delegated to a maintained authentication mechanism.

3. If file-based storage is unavoidable, create both the configuration directory and token file with explicit restrictive permissions:

   bash

   install -d -m 700 ~/.copilot
   umask 077
   install -m 600 /dev/null ~/.copilot/github_token.txt
   

4. Write the token using a non-echoing prompt rather than embedding it directly in a shell command:

   bash

   read -r -s -p "GitHub token: " COPILOT_TOKEN
   printf '\n'
   printf '%s' "$COPILOT_TOKEN" > ~/.copilot/github_token.txt
   unset COPILOT_TOKEN
   chmod 600 ~/.copilot/github_token.txt
   

5. Add a permissions check before loading the credential and reject files accessible by group or other users.

6. Document token rotation and immediate revocation procedures for suspected disclosure.

7. Continue requiring a fine-grained token with only the minimum Copilot permission, and explicitly warn users not to reuse a broader GitHub token.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 14)May include surrounding context.

brew install copilot-cli

text

2. **设置 GitHub Personal Access Token**
- 访问 https://github.com/settings/personal-access-tokens/new
- 创建 fine-grained token，权限：Copilot Requests
- Token 保存到 `~/.copilot/github_token.txt`

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 104)May include surrounding context.

brew install copilot-cli

text

2. **设置 GitHub Personal Access Token**
- 访问 https://github.com/settings/personal-access-tokens/new
- 创建 fine-grained token，权限：Copilot Requests
- Token 保存到 `~/.copilot/github_token.txt`

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documentation promotes copilot --yolo for automatic execution but does not clearly warn that autonomous command execution can modify files, run shell commands, or otherwise change the system without careful review. In a developer environment, this increases the chance of unintended destructive actions, unsafe code changes, or execution of AI-suggested commands that the user did not adequately inspect.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill explicitly instructs users to analyze a local project with GitHub Copilot CLI, which sends prompts and potentially code context to GitHub's remote API, but it never warns users that source code may leave the local machine. This creates a real privacy and compliance risk, especially for proprietary, regulated, or secret-bearing repositories where users may unknowingly disclose sensitive code or metadata to a third party.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

All user-facing instructions and prompt examples are provided in Chinese, with no indication that other languages are supported or that language can be chosen by the user. This can be a language/locale policy issue when a skill effectively forces a specific language without opt-in.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.