copilot-sdk
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDYNAMIC_EXECUTION
Full Analysis
- Indirect Prompt Injection Surface: The skill documentation describes how to process external data via user prompts, tool outputs, and MCP (Model Context Protocol) servers. As with any agent-based system, this creates a surface where external data could potentially contain instructions intended to influence the agent's behavior. The SDK provides mechanisms to mitigate this, such as user prompt hooks and tool result redaction.
- External Package Integration: The skill references several software packages, such as
@github/copilot-sdk,github-copilot-sdk, and MCP servers like@modelcontextprotocol/server-filesystem. These dependencies are sourced from official registries and established organizations, aligning with standard development practices for this SDK. - Command and Tool Execution Capabilities: The skill demonstrates how to execute shell commands and interface with external tools via the SDK's runtime environment. It correctly emphasizes security controls, such as implementing permission handlers (
onPermissionRequest) and validating inputs to ensure the agent operates within expected boundaries. - Runtime Subprocess Management: The SDK architecture involves spawning the Copilot CLI as a subprocess and potentially executing local MCP servers using tools like
npx. This dynamic execution is a core feature of the SDK's integration model and is presented with guidance on configuring working directories and environment variables safely.
Audit Metadata