suggest-awesome-github-copilot-agents
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches configuration and agent files from official GitHub repositories (
github.com/github/awesome-copilot). Since these references target a trusted organization's infrastructure, the downloads are considered safe and routine for the skill's purpose. - [COMMAND_EXECUTION]: The skill uses
curlvia a terminal tool to download and update agent assets into the.github/agents/directory. This operation is limited to managing internal agent configurations from trusted sources. - [INDIRECT_PROMPT_INJECTION]: The skill ingests and processes content from remote Markdown files to provide suggestions. While this creates a theoretical surface for instructions embedded in external data to influence the agent, the reliance on a trusted source significantly mitigates this risk.
- Ingestion points: Fetches remote agent definitions from
github.comand reads local agent files in.github/agents/. - Boundary markers: No specific delimiters or safety instructions are defined for the fetched content.
- Capability inventory: Utilizes
fetchfor data retrieval and terminal commands for file management. - Sanitization: No explicit filtering or validation of the fetched Markdown content is mentioned.
Audit Metadata