Github Copilot Cli

PassAudited by ClawScan on May 1, 2026.

Overview

This is a coherent instruction-only guide for using GitHub Copilot CLI, with expected caution around sharing code context with Copilot and relying on an undeclared local CLI dependency.

Before installing, confirm you are comfortable using GitHub Copilot CLI on the target repository, use narrow `--path` scopes, avoid secrets or restricted code, verify the official `gh copilot` tooling is installed, and manually review any generated suggestions before applying or merging them.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Note

ASI02: Tool Misuse and Exploitation

What this means

Copilot may produce code suggestions that affect a project if the user later applies them.

Why it was flagged

The skill instructs use of local Copilot CLI commands to generate or review code-related suggestions. This is central to the stated purpose and is scoped to paths, but users should still review outputs before applying changes.

Skill content

gh copilot suggest "Add logging when translation fallback is used" --path services/translation

Recommendation

Keep prompts and `--path` scopes narrow, inspect diffs and tests, and do not automatically merge generated changes.

Note

ASI07: Insecure Inter-Agent Communication

What this means

Private repository content or implementation details could be processed by the Copilot service when these commands are run.

Why it was flagged

The workflow sends or provides local code-path context to GitHub Copilot CLI for analysis. This is expected for the skill, but it can involve private source code or project context.

Skill content

gh copilot explain "What does this service do?" --path src/

Recommendation

Use the skill only on repositories and files approved for Copilot use, avoid including secrets, and follow your organization's GitHub Copilot data policy.

Note

ASI04: Agentic Supply Chain Vulnerabilities

What this means

Users must provide their own GitHub CLI/Copilot installation, so a malicious or unofficial local binary would affect command behavior.

Why it was flagged

The skill depends on the `gh copilot` command, while the provided metadata declares no required binaries and no install spec. This is an under-declared dependency rather than hidden code.

Skill content

gh copilot suggest "As a backend engineer, propose a minimal fix for mixed-language carryover" --path src/

Recommendation

Install GitHub CLI and any Copilot extension from official sources and verify which `gh` binary is on the PATH before use.