Security audit
Security checks for vulnerabilities and agentic risk
This is a small Copilot CLI helper, but it instructs use of a local GitHub Copilot token without enough credential-safety guidance.
Review this before installing if you are uncomfortable with skills that reference local tokens. Only use it if the GitHub Copilot token file has restrictive permissions, avoid logging or sharing the command output/environment, and prefer the official CLI authentication flow when available.
The manifest description and body text are written in Chinese, indicating a fixed language experience, but the file does not state that the skill is intended specifically for Chinese-speaking users or offer any language choice. Per policy, language constraints should be opt-in or clearly justified as region- or audience-specific.
The skill instructs users to load a GitHub Copilot token directly from a local file into an environment variable without any warning about credential sensitivity, storage protections, shell history, or process exposure. This creates a real credential-handling risk because users may normalize unsafe token usage patterns and accidentally expose the token through logs, screenshots, shared terminals, or weak file permissions.
No suspicious patterns detected.
