Skillv1.0.0

ClawScan security

Copilot Cli Skill · ClawHub's context-aware review of the artifact, metadata, and declared behavior.

Scanner verdict

SuspiciousMar 9, 2026, 4:17 PM

Verdict: suspicious
Confidence: medium
Model: gpt-5-mini
Summary: The skill's purpose (running GitHub Copilot CLI) matches its instructions, but the metadata omits required runtime dependencies (copilot binary and possible tokens) and the SKILL.md often recommends broad flags (--allow-all-tools) that grant Copilot wide shell capabilities — these mismatches and broad execution recommendations warrant caution.
Guidance: This skill appears to do what it says (run the GitHub Copilot CLI), but there are transparency and safety gaps you should consider before installing or using it: - Runtime requirements: The metadata does not declare them, but the skill requires the 'copilot' binary and may use COPILOT_GITHUB_TOKEN/GH_TOKEN for authentication. Ensure you only provide tokens with the minimal scopes Copilot needs, and confirm the binary is installed from an official source. - Dangerous flags: Many examples use --allow-all-tools, which lets Copilot run arbitrary shell tools (including destructive commands). Prefer scoped --allow-tool flags, use --deny-tool (e.g., 'shell(rm)', 'shell(git push)'), and always set exec.workdir to a non-sensitive repository. - Session behavior: Background sessions and automated process polling can run for a long time — monitor session activity and logs to avoid unintended actions. - Metadata hygiene: Ask the publisher to update the skill metadata to declare required binaries and any env vars so you can make an informed decision. If you want to proceed: only run the skill in isolated repos or CI sandboxes until you confirm its behavior; avoid granting broad tokens or using --allow-all-tools by default; and prefer explicit, minimal tool approvals.

Review Dimensions

Purpose & Capability: concernThe skill is clearly intended to run the GitHub Copilot CLI and the included files (SKILL.md, README, script) implement that. However the registry metadata claims no required binaries or env vars, while the instructions and example script explicitly require the 'copilot' binary and reference COPILOT_GITHUB_TOKEN/GH_TOKEN for authentication. The missing declaration of these runtime requirements is an incoherence (likely an oversight) that reduces transparency.
Instruction Scope: concernSKILL.md stays within the stated purpose (how to invoke copilot in a repo) but repeatedly recommends using --allow-all-tools and background sessions. --allow-all-tools grants Copilot CLI broad ability to run shell tools (including git, rm, push) which expands the skill's effective privileges beyond simple 'code assistance'. While the docs also mention using --deny-tool and preferring scoped --allow-tool, many examples default to allow-all, creating a real risk if the agent is used against sensitive directories or without strict workdir control.
Install Mechanism: okThis is an instruction-only skill with no install spec and includes a small helper script. There is no bundle download or remote install executed by the skill itself, which keeps on-disk modification risk low. The README simply references standard Copilot install commands (npm/brew/winget) but the skill does not perform installs.
Credentials: concernThe registry metadata lists no required environment variables, but both the README and references mention COPILOT_GITHUB_TOKEN / GH_TOKEN / GITHUB_TOKEN as possible ways to authenticate Copilot. The skill's runtime behavior legitimately may need these tokens; their absence from declared requirements is an inconsistency and harms the user's ability to judge credential exposure. No unrelated credentials are requested, but the omission is notable.
Persistence & Privilege: okThe skill is not always-enabled and is user-invocable; it does not request persistent privileges or alter other skills. Autonomous invocation is allowed by platform default, but there's no 'always: true' or other elevated persistence in the manifest.