copilot-spaces
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and act upon instructions provided within external Copilot Spaces, creating a vulnerability surface where a malicious space could attempt to influence agent behavior.
- Ingestion points: External directives and data are loaded through the
mcp__github__get_copilot_spacetool and subsequent breadcrumb-following fetches. - Boundary markers: The instructions do not define specific delimiters or security guardrails to distinguish between the space's content and the agent's core instructions.
- Capability inventory: The skill possesses capabilities for reading repository files, fetching issue data, and performing write operations (creation, update, deletion of spaces) via the GitHub CLI.
- Sanitization: There are no documented procedures for sanitizing or validating the contents of a space before the agent processes it.
- [COMMAND_EXECUTION]: The skill utilizes the
gh apicommand-line utility for managing Copilot Spaces. These commands are standard applications of the official GitHub CLI to interact with the platform's API and are consistent with the skill's stated purpose and authorship.
Audit Metadata