Copilot Cli Skill

• Outcome: Review
• Latest audit: Sep 11, 2026 · 12:26 PM UTC
• Version: 1.0.0

Overview

This skill is a coherent Copilot CLI wrapper, but its default examples and runner grant broad autonomous tool access without enough scoping or confirmation.

Install only if you are comfortable letting Copilot operate inside your repositories. Prefer explicit `--allow-tool` permissions, avoid `--allow-all-tools` unless you are in a disposable or tightly scoped workspace, monitor background sessions, and use least-privilege GitHub tokens that are not stored in project files or prompts.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/run-copilot-example.sh:21

Finding

Copilot CLI Is Granted Excessive Tool Permissions by Default

Content

View full analysis

Vulnerability Details

File Location: scripts/run-copilot-example.sh:21
Additional Locations: SKILL.md:21, SKILL.md:39, references/copilot-usage-recipes.md:8, references/copilot-usage-recipes.md:24, references/copilot-usage-recipes.md:36
Vulnerability Type: Excessive delegated-agent permissions
Risk Level: High

Vulnerable Code

bash

cd "$PROJECT_DIR"
copilot -p "$TASK" --allow-all-tools

The same unsafe authorization pattern is recommended throughout the documentation:

text

copilot -p "<task>" --allow-all-tools

A documented alternative adds only a limited deny list:

text

copilot -p "<task>" --allow-all-tools --deny-tool 'shell(rm)' --deny-tool 'shell(git push)'

Technical Analysis

The --allow-all-tools option grants the delegated Copilot agent broad access to its available tools instead of applying least privilege. In the executable example, this authorization is enabled unconditionally for every supplied task. There is no task-specific allowlist, confirmation boundary, repository trust check, or restriction on authenticated GitHub operations.

Quoting "$PROJECT_DIR" and "$TASK" prevents direct shell argument injection into the wrapper itself, but it does not address semantic prompt injection. Instructions supplied through the task or encountered in an untrusted repository can influence Copilot after broad tool access has already been granted.

The optional denial of shell(rm) and shell(git push) is insufficient as a general security boundary. It covers only two command patterns and does not comprehensively prevent alternative destructive commands, file modification, sensitive-file access, network communication, or other repository and GitHub mutations.

Attack Path

1. A user invokes the script or follows a documented recipe against an untrusted or compromised repository.
2. The supplied task or repository content contains instructions that influence Copilot to perform actions beyo ...[truncated 979 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove --allow-all-tools from the executable script and all default usage examples.
2. Require explicit, task-specific --allow-tool entries. For example, a read-only review should receive only the minimum Git or file-reading capabilities it requires.
3. Deny shell execution, network access, repository publication, and destructive operations by default. Enable them only after explicit user confirmation.
4. Add confirmation checkpoints before any command that modifies files, invokes package managers, communicates externally, changes Git state, pushes commits, or creates and edits GitHub resources.
5. Validate that PROJECT_DIR resolves to an intended repository under an approved root, and reject unexpected or sensitive paths.
6. Treat repository files and task text as untrusted input. Warn users that repository-level instructions can influence the delegated agent.
7. Where broad autonomy is genuinely required, execute Copilot in an isolated container or sandbox with a dedicated workspace, minimal environment variables, no unrelated credentials, restricted network access, and a narrowly scoped GitHub token.
8. If deny rules are retained as defense in depth, expand them beyond shell(rm) and shell(git push); do not treat pattern-based denials as a replacement for a positive allowlist.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (10)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill explicitly instructs use of powerful Copilot CLI modes such as --allow-all-tools, background execution, session resume/continue, and repository-affecting workflows like creating branches and PRs, but it does not require a prominent user-facing warning or confirmation before potentially destructive actions. In this context, an operator could trigger broad shell/write capabilities in a target repository and possibly the surrounding system environment, increasing the chance of unintended file modification, command execution, or data loss.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The document explicitly recommends using --allow-all-tools for full autonomy without any caution, constraints, or preference for least-privilege alternatives. In the context of a coding agent operating in a target repository with shell and GitHub access, unrestricted tool approval can enable destructive shell actions, credential misuse, data exfiltration, or unauthorized repository changes if prompts, context, or downstream agent behavior are compromised.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The quick implementation recipe encourages execution of a powerful autonomous coding command without warning that it may modify repository contents or invoke broad tools. Lack of user-facing warnings or consent language increases the likelihood of surprise changes, unsafe execution, and misuse in sensitive repositories.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

Recommending --allow-all-tools grants the Copilot CLI broad execution capability, potentially enabling arbitrary shell commands and file modifications beyond the user's intended coding task. In this skill context, that is dangerous because the wrapper is explicitly designed to run inside a target repository where unrestricted tools can alter code, secrets, git state, and local environment.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The GitHub issue workflow recipe omits notice that Copilot may create a branch and modify repository contents automatically while also relying on a remote issue URL as task input. In this context, users may unknowingly authorize both local code changes and remote-context-driven actions without understanding the extent of automation.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The recipes extend the skill from local coding assistance into GitHub issue and PR operations, which can trigger network actions, branch creation, and publication workflows outside the stated scope of working in a target project directory. This scope expansion increases the chance of unintended external side effects, especially when combined with an autonomous CLI agent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The background execution recipe allows a long-running autonomous process to continue operating unattended, potentially making ongoing repository or environment changes until manually stopped. This is especially risky when paired with --allow-all-tools, because harmful or erroneous actions can accumulate before an operator notices them.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The script invokes copilot with --allow-all-tools, which grants broad tool execution capability to an AI-driven coding workflow without presenting any warning, confirmation, or scope restriction to the user. In the context of a script that runs inside an arbitrary project directory and accepts a free-form task prompt, this can enable unintended file modification, command execution, or destructive project changes if the prompt is unsafe, ambiguous, or adversarially influenced.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

Mentioning COPILOT_GITHUB_TOKEN without guidance on secure handling can lead users to place sensitive credentials in shell history, logs, or other insecure locations. Even though this is documentation rather than code, it can still normalize unsafe secret-management practices around a tool that may spawn subprocesses.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

Advising users to set COPILOT_GITHUB_TOKEN introduces credential handling into a skill whose primary purpose is coding assistance, creating risk of insecure storage, accidental logging, or leakage through subprocesses. While common operational guidance, it still broadens the trust boundary and should be handled explicitly and carefully.

Content

No source excerpt is available for this finding.