The Agent Skills Directory

[Indirect Prompt Injection] (HIGH): The skill is designed to pass untrusted strings directly to a CLI that has execution capabilities.
Ingestion points: The -p argument in copilot -p "..." (referenced in SKILL.md).
Boundary markers: None. The prompt is interpolated directly into the shell command.
Capability inventory: The copilot CLI, as described, can perform code generation, debugging, and 'delegating coding tasks' which typically involves file writes and shell execution.
Sanitization: None. The documentation explicitly recommends using --allow-all-tools, which bypasses the tool's internal security prompts.
[Remote Code Execution] (HIGH): The combination of prompt-based input and the --allow-all-tools flag creates a direct path for arbitrary code execution. If an attacker influences the prompt passed to this skill, they can execute any shell command the copilot utility is capable of running.
[Command Execution] (MEDIUM): The allowed-tools policy Bash(copilot *) is overly broad. It grants the agent permission to execute any subcommand or flag of the copilot utility, including those that might be used for data exfiltration or persistence if supported by the CLI.

ask-copilot