{"data":{"skill":{"slug":"sickn33-copilot-sdk","name":"copilot-sdk","icon":"📦","repo":"https://github.com/sickn33/antigravity-awesome-skills/tree/main/skills/copilot-sdk","status":"approved","author":"sickn33","authorVersion":null,"skillstoreRevision":2},"audit":{"id":"6d243703-653d-4bf5-a17b-052564a68b7a","skill_id":"389de734-9bca-4076-b19f-b06ba10e38ab","version":5,"content_hash":"v3:f9e2c34b4f19c7f3e6b0a1e93227b5f77cc12526:ca1af2be9119648164d387bde146c0f51451fbf207151d188dca195ffc381718:44603766467909de401d500e3e118a111940d662c4d16f6952badceeea6ebfdc:736b696c6c732f7369636b6e33332f636f70696c6f742d73646b:0863a15488515911b92163c0bb453fea","risk_level":"high","is_blocked":false,"safe_to_publish":false,"analysis_status":"ok","agent_auto_install_policy":"confirmation_required","manual_install_policy":"allowed","summary":"Static command, URL, credential, and reconnaissance alerts are documentation-context false positives. Two semantic issues remain: permissive automatic approvals and unpinned package execution in examples.","remediation":[{"issue":"The permission example approves broad tool requests and answers user prompts automatically.","severity":"high","suggestion":"Default to denial, use exact command and tool allowlists, validate arguments, and require human confirmation for sensitive or ambiguous actions."},{"issue":"The local MCP example executes an unversioned package through npx with automatic confirmation.","severity":"medium","suggestion":"Pin a reviewed package version, install it through a lockfile, and avoid automatic package execution in security-sensitive examples."}],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":15,"line_start":15},{"file":"SKILL.md","line_end":23,"line_start":23},{"file":"SKILL.md","line_end":24,"line_start":24},{"file":"SKILL.md","line_end":25,"line_start":25},{"file":"SKILL.md","line_end":26,"line_start":26},{"file":"SKILL.md","line_end":46,"line_start":36},{"file":"SKILL.md","line_end":50,"line_start":46},{"file":"SKILL.md","line_end":63,"line_start":50},{"file":"SKILL.md","line_end":67,"line_start":63},{"file":"SKILL.md","line_end":75,"line_start":67},{"file":"SKILL.md","line_end":79,"line_start":75},{"file":"SKILL.md","line_end":84,"line_start":79},{"file":"SKILL.md","line_end":90,"line_start":84},{"file":"SKILL.md","line_end":92,"line_start":90},{"file":"SKILL.md","line_end":101,"line_start":92},{"file":"SKILL.md","line_end":105,"line_start":101},{"file":"SKILL.md","line_end":117,"line_start":105},{"file":"SKILL.md","line_end":123,"line_start":117},{"file":"SKILL.md","line_end":124,"line_start":123},{"file":"SKILL.md","line_end":134,"line_start":124},{"file":"SKILL.md","line_end":151,"line_start":134},{"file":"SKILL.md","line_end":155,"line_start":151},{"file":"SKILL.md","line_end":167,"line_start":155},{"file":"SKILL.md","line_end":171,"line_start":167},{"file":"SKILL.md","line_end":173,"line_start":171},{"file":"SKILL.md","line_end":186,"line_start":173},{"file":"SKILL.md","line_end":190,"line_start":186},{"file":"SKILL.md","line_end":198,"line_start":190},{"file":"SKILL.md","line_end":208,"line_start":198},{"file":"SKILL.md","line_end":209,"line_start":208},{"file":"SKILL.md","line_end":210,"line_start":209},{"file":"SKILL.md","line_end":211,"line_start":210},{"file":"SKILL.md","line_end":212,"line_start":211},{"file":"SKILL.md","line_end":213,"line_start":212},{"file":"SKILL.md","line_end":217,"line_start":213},{"file":"SKILL.md","line_end":228,"line_start":217},{"file":"SKILL.md","line_end":234,"line_start":228},{"file":"SKILL.md","line_end":234,"line_start":234},{"file":"SKILL.md","line_end":236,"line_start":235},{"file":"SKILL.md","line_end":237,"line_start":236},{"file":"SKILL.md","line_end":238,"line_start":237},{"file":"SKILL.md","line_end":248,"line_start":238},{"file":"SKILL.md","line_end":254,"line_start":248},{"file":"SKILL.md","line_end":258,"line_start":254},{"file":"SKILL.md","line_end":269,"line_start":258},{"file":"SKILL.md","line_end":275,"line_start":269},{"file":"SKILL.md","line_end":275,"line_start":275},{"file":"SKILL.md","line_end":277,"line_start":276},{"file":"SKILL.md","line_end":278,"line_start":277},{"file":"SKILL.md","line_end":279,"line_start":278}]},{"factor":"network","evidence":[{"file":"SKILL.md","line_end":251,"line_start":251},{"file":"SKILL.md","line_end":310,"line_start":310},{"file":"SKILL.md","line_end":511,"line_start":511},{"file":"SKILL.md","line_end":512,"line_start":512},{"file":"SKILL.md","line_end":513,"line_start":513}]},{"factor":"env_access","evidence":[{"file":"SKILL.md","line_end":298,"line_start":298},{"file":"SKILL.md","line_end":312,"line_start":312},{"file":"SKILL.md","line_end":298,"line_start":298},{"file":"SKILL.md","line_end":312,"line_start":312},{"file":"SKILL.md","line_end":291,"line_start":291},{"file":"SKILL.md","line_end":298,"line_start":298},{"file":"SKILL.md","line_end":312,"line_start":312}]}],"critical_findings":[],"high_findings":[{"title":"Overly Permissive Tool Approval","locations":[{"file":"SKILL.md","line_end":429,"line_start":417}],"confidence":0.98,"description":"The example approves every non-shell request, accepts shell commands by prefix, and automatically answers user-input requests. Generated applications could authorize unintended actions.","review_kind":"security","source_category":"semantic","source_severity":"high","confidence_reasoning":"The handler explicitly returns approval for all non-shell requests and responds yes without user confirmation. The shell check also relies on an unsafe string prefix."}],"medium_findings":[{"title":"Unpinned Package Execution","locations":[{"file":"SKILL.md","line_end":265,"line_start":258}],"confidence":0.95,"description":"The local MCP example uses npx with automatic confirmation and no package version. Running it can download and execute changed dependency code.","review_kind":"security","source_category":"semantic","source_severity":"medium","confidence_reasoning":"The command and arguments clearly specify npx, automatic installation, and an unversioned package. This creates a direct dependency supply-chain exposure."}],"low_findings":[],"dangerous_patterns":[],"files_scanned":1,"total_lines":522,"audit_model":"codex","audited_at":"2026-07-23T21:33:54.076+00:00","created_at":"2026-07-26T07:23:35.845498+00:00","static_findings":[{"id":"external_commands:SKILL.md:15:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **GitHub Copilot CLI** installed and authenticated (`copilot --version` to verify)","category":"external_commands","line_end":15,"severity":"medium","line_start":15},{"id":"external_commands:SKILL.md:23:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Node.js | `@github/copilot-sdk` | `npm install @github/copilot-sdk` |","category":"external_commands","line_end":23,"severity":"medium","line_start":23},{"id":"external_commands:SKILL.md:24:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Python | `github-copilot-sdk` | `pip install github-copilot-sdk` |","category":"external_commands","line_end":24,"severity":"medium","line_start":24},{"id":"external_commands:SKILL.md:25:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Go | `github.com/github/copilot-sdk/go` | `go get github.com/github/copilot-sdk/go` |","category":"external_commands","line_end":25,"severity":"medium","line_start":25},{"id":"external_commands:SKILL.md:26:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| .NET | `GitHub.Copilot.SDK` | `dotnet add package GitHub.Copilot.SDK` |","category":"external_commands","line_end":26,"severity":"medium","line_start":26},{"id":"external_commands:SKILL.md:36:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```typescript","category":"external_commands","line_end":46,"severity":"medium","line_start":36},{"id":"external_commands:SKILL.md:46:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":50,"severity":"medium","line_start":46},{"id":"external_commands:SKILL.md:50:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```python","category":"external_commands","line_end":63,"severity":"medium","line_start":50},{"id":"external_commands:SKILL.md:63:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":67,"severity":"medium","line_start":63},{"id":"external_commands:SKILL.md:67:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```go","category":"external_commands","line_end":75,"severity":"medium","line_start":67},{"id":"external_commands:SKILL.md:75:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":79,"severity":"medium","line_start":75},{"id":"external_commands:SKILL.md:79:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```csharp","category":"external_commands","line_end":84,"severity":"medium","line_start":79},{"id":"external_commands:SKILL.md:84:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":90,"severity":"medium","line_start":84},{"id":"external_commands:SKILL.md:90:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Enable real-time output by setting `streaming: true` and subscribing to delta events.","category":"external_commands","line_end":92,"severity":"medium","line_start":90},{"id":"external_commands:SKILL.md:92:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```typescript","category":"external_commands","line_end":101,"severity":"medium","line_start":92},{"id":"external_commands:SKILL.md:101:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":105,"severity":"medium","line_start":101},{"id":"external_commands:SKILL.md:105:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```python","category":"external_commands","line_end":117,"severity":"medium","line_start":105},{"id":"external_commands:SKILL.md:117:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":123,"severity":"medium","line_start":117},{"id":"external_commands:SKILL.md:123:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `on(handler)` | Subscribe to all events; returns unsubscribe function |","category":"external_commands","line_end":124,"severity":"medium","line_start":123},{"id":"external_commands:SKILL.md:124:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `on(eventType, handler)` | Subscribe to specific event type (Node.js only) |","category":"external_commands","line_end":134,"severity":"medium","line_start":124},{"id":"external_commands:SKILL.md:134:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```typescript","category":"external_commands","line_end":151,"severity":"medium","line_start":134},{"id":"external_commands:SKILL.md:151:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":155,"severity":"medium","line_start":151},{"id":"external_commands:SKILL.md:155:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```python","category":"external_commands","line_end":167,"severity":"medium","line_start":155},{"id":"external_commands:SKILL.md:167:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":171,"severity":"medium","line_start":167},{"id":"external_commands:SKILL.md:171:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```go","category":"external_commands","line_end":173,"severity":"medium","line_start":171},{"id":"external_commands:SKILL.md:173:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"City string `json:\"city\" jsonschema:\"The city name\"`","category":"external_commands","line_end":186,"severity":"medium","line_start":173},{"id":"external_commands:SKILL.md:186:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":190,"severity":"medium","line_start":186},{"id":"external_commands:SKILL.md:190:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```csharp","category":"external_commands","line_end":198,"severity":"medium","line_start":190},{"id":"external_commands:SKILL.md:198:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":208,"severity":"medium","line_start":198},{"id":"external_commands:SKILL.md:208:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `onPreToolUse` | Before tool executes | Permission control, argument modification |","category":"external_commands","line_end":209,"severity":"medium","line_start":208},{"id":"external_commands:SKILL.md:209:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `onPostToolUse` | After tool executes | Result transformation, logging |","category":"external_commands","line_end":210,"severity":"medium","line_start":209},{"id":"external_commands:SKILL.md:210:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `onUserPromptSubmitted` | User sends message | Prompt modification, filtering |","category":"external_commands","line_end":211,"severity":"medium","line_start":210},{"id":"external_commands:SKILL.md:211:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `onSessionStart` | Session begins | Add context, configure session |","category":"external_commands","line_end":212,"severity":"medium","line_start":211},{"id":"external_commands:SKILL.md:212:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `onSessionEnd` | Session ends | Cleanup, analytics |","category":"external_commands","line_end":213,"severity":"medium","line_start":212},{"id":"external_commands:SKILL.md:213:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `onErrorOccurred` | Error happens | Custom error handling, retry logic |","category":"external_commands","line_end":217,"severity":"medium","line_start":213},{"id":"external_commands:SKILL.md:217:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```typescript","category":"external_commands","line_end":228,"severity":"medium","line_start":217},{"id":"external_commands:SKILL.md:228:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":234,"severity":"medium","line_start":228},{"id":"external_commands:SKILL.md:234:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `permissionDecision` | `\"allow\"` \\| `\"deny\"` \\| `\"ask\"` | Whether to allow the tool call |","category":"external_commands","line_end":234,"severity":"medium","line_start":234},{"id":"external_commands:SKILL.md:235:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `permissionDecisionReason` | string | Explanation for deny/ask |","category":"external_commands","line_end":236,"severity":"medium","line_start":235},{"id":"external_commands:SKILL.md:236:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `modifiedArgs` | object | Modified arguments to pass |","category":"external_commands","line_end":237,"severity":"medium","line_start":236},{"id":"external_commands:SKILL.md:237:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `additionalContext` | string | Extra context for conversation |","category":"external_commands","line_end":238,"severity":"medium","line_start":237},{"id":"external_commands:SKILL.md:238:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `suppressOutput` | boolean | Hide tool output from conversation |","category":"external_commands","line_end":248,"severity":"medium","line_start":238},{"id":"external_commands:SKILL.md:248:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```typescript","category":"external_commands","line_end":254,"severity":"medium","line_start":248},{"id":"external_commands:SKILL.md:254:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":258,"severity":"medium","line_start":254},{"id":"external_commands:SKILL.md:258:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```typescript","category":"external_commands","line_end":269,"severity":"medium","line_start":258},{"id":"external_commands:SKILL.md:269:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":275,"severity":"medium","line_start":269},{"id":"external_commands:SKILL.md:275:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `type` | `\"local\"` \\| `\"http\"` | Server transport type |","category":"external_commands","line_end":275,"severity":"medium","line_start":275},{"id":"external_commands:SKILL.md:276:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `command` | string | Executable path (local) |","category":"external_commands","line_end":277,"severity":"medium","line_start":276},{"id":"external_commands:SKILL.md:277:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `args` | string[] | Command arguments (local) |","category":"external_commands","line_end":278,"severity":"medium","line_start":277},{"id":"external_commands:SKILL.md:278:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `url` | string | Server URL (http) |","category":"external_commands","line_end":279,"severity":"medium","line_start":278},{"id":"external_commands:SKILL.md:279:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `tools` | string[] | `[\"*\"]` or specific tool names |","category":"external_commands","line_end":279,"severity":"medium","line_start":279},{"id":"external_commands:SKILL.md:280:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `env` | object | Environment variables |","category":"external_commands","line_end":281,"severity":"medium","line_start":280},{"id":"external_commands:SKILL.md:281:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `cwd` | string | Working directory (local) |","category":"external_commands","line_end":282,"severity":"medium","line_start":281},{"id":"external_commands:SKILL.md:282:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `timeout` | number | Timeout in milliseconds |","category":"external_commands","line_end":290,"severity":"medium","line_start":282},{"id":"external_commands:SKILL.md:290:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"1. **Explicit token** — `githubToken` in constructor","category":"external_commands","line_end":291,"severity":"medium","line_start":290},{"id":"external_commands:SKILL.md:291:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"2. **Environment variables** — `COPILOT_GITHUB_TOKEN` → `GH_TOKEN` → `GITHUB_TOKEN`","category":"external_commands","line_end":291,"severity":"medium","line_start":291},{"id":"external_commands:SKILL.md:292:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"3. **Stored OAuth** — From `copilot auth login`","category":"external_commands","line_end":293,"severity":"medium","line_start":292},{"id":"external_commands:SKILL.md:293:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"4. **GitHub CLI** — `gh auth` credentials","category":"external_commands","line_end":297,"severity":"medium","line_start":293},{"id":"external_commands:SKILL.md:297:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```typescript","category":"external_commands","line_end":299,"severity":"medium","line_start":297},{"id":"external_commands:SKILL.md:299:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":305,"severity":"medium","line_start":299},{"id":"external_commands:SKILL.md:305:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```typescript","category":"external_commands","line_end":315,"severity":"medium","line_start":305},{"id":"external_commands:SKILL.md:315:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":319,"severity":"medium","line_start":315},{"id":"external_commands:SKILL.md:319:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| OpenAI | `\"openai\"` | OpenAI API and compatible endpoints |","category":"external_commands","line_end":320,"severity":"medium","line_start":319},{"id":"external_commands:SKILL.md:320:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Azure OpenAI | `\"azure\"` | Native Azure endpoints (don't include `/openai/v1`) |","category":"external_commands","line_end":320,"severity":"medium","line_start":320},{"id":"external_commands:SKILL.md:321:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Azure AI Foundry | `\"openai\"` | OpenAI-compatible Foundry endpoints |","category":"external_commands","line_end":322,"severity":"medium","line_start":321},{"id":"external_commands:SKILL.md:322:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Anthropic | `\"anthropic\"` | Claude models |","category":"external_commands","line_end":323,"severity":"medium","line_start":322},{"id":"external_commands:SKILL.md:323:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Ollama | `\"openai\"` | Local models, no API key needed |","category":"external_commands","line_end":325,"severity":"medium","line_start":323},{"id":"external_commands:SKILL.md:325:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"**Wire API:** Use `\"responses\"` for GPT-5 series, `\"completions\"` (default) for others.","category":"external_commands","line_end":325,"severity":"medium","line_start":325},{"id":"external_commands:SKILL.md:333:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```typescript","category":"external_commands","line_end":343,"severity":"medium","line_start":333},{"id":"external_commands:SKILL.md:343:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":347,"severity":"medium","line_start":343},{"id":"external_commands:SKILL.md:347:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```typescript","category":"external_commands","line_end":351,"severity":"medium","line_start":347},{"id":"external_commands:SKILL.md:351:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":353,"severity":"medium","line_start":351},{"id":"external_commands:SKILL.md:353:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"**BYOK sessions:** Must re-provide `provider` config on resume (keys are not persisted).","category":"external_commands","line_end":359,"severity":"medium","line_start":353},{"id":"external_commands:SKILL.md:359:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```typescript","category":"external_commands","line_end":367,"severity":"medium","line_start":359},{"id":"external_commands:SKILL.md:367:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":375,"severity":"medium","line_start":367},{"id":"external_commands:SKILL.md:375:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```typescript","category":"external_commands","line_end":384,"severity":"medium","line_start":375},{"id":"external_commands:SKILL.md:384:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":392,"severity":"medium","line_start":384},{"id":"external_commands:SKILL.md:392:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```typescript","category":"external_commands","line_end":396,"severity":"medium","line_start":392},{"id":"external_commands:SKILL.md:396:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":404,"severity":"medium","line_start":396},{"id":"external_commands:SKILL.md:404:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```typescript","category":"external_commands","line_end":409,"severity":"medium","line_start":404},{"id":"external_commands:SKILL.md:409:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":417,"severity":"medium","line_start":409},{"id":"external_commands:SKILL.md:417:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```typescript","category":"external_commands","line_end":431,"severity":"medium","line_start":417},{"id":"external_commands:SKILL.md:431:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":439,"severity":"medium","line_start":431},{"id":"external_commands:SKILL.md:439:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":441,"severity":"medium","line_start":439},{"id":"external_commands:SKILL.md:441:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":443,"severity":"medium","line_start":441},{"id":"external_commands:SKILL.md:443:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```typescript","category":"external_commands","line_end":445,"severity":"medium","line_start":443},{"id":"external_commands:SKILL.md:445:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":453,"severity":"medium","line_start":445},{"id":"external_commands:SKILL.md:453:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `cliPath` | string | Path to Copilot CLI executable |","category":"external_commands","line_end":454,"severity":"medium","line_start":453},{"id":"external_commands:SKILL.md:454:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `cliUrl` | string | URL of external CLI server |","category":"external_commands","line_end":455,"severity":"medium","line_start":454},{"id":"external_commands:SKILL.md:455:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `githubToken` | string | GitHub token for auth |","category":"external_commands","line_end":456,"severity":"medium","line_start":455},{"id":"external_commands:SKILL.md:456:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `useLoggedInUser` | boolean | Use stored CLI credentials (default: true) |","category":"external_commands","line_end":457,"severity":"medium","line_start":456},{"id":"external_commands:SKILL.md:457:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `logLevel` | string | `\"none\"` \\| `\"error\"` \\| `\"warning\"` \\| `\"info\"` \\| `\"debug\"` |","category":"external_commands","line_end":457,"severity":"medium","line_start":457},{"id":"external_commands:SKILL.md:458:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `autoRestart` | boolean | Auto-restart CLI on crash (default: true) |","category":"external_commands","line_end":459,"severity":"medium","line_start":458},{"id":"external_commands:SKILL.md:459:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `useStdio` | boolean | Use stdio transport (default: true) |","category":"external_commands","line_end":465,"severity":"medium","line_start":459},{"id":"external_commands:SKILL.md:465:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `model` | string | Model to use (e.g., `\"gpt-4.1\"`) |","category":"external_commands","line_end":465,"severity":"medium","line_start":465},{"id":"external_commands:SKILL.md:466:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `sessionId` | string | Custom ID for resumable sessions |","category":"external_commands","line_end":467,"severity":"medium","line_start":466},{"id":"external_commands:SKILL.md:467:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `streaming` | boolean | Enable streaming responses |","category":"external_commands","line_end":468,"severity":"medium","line_start":467},{"id":"external_commands:SKILL.md:468:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `tools` | Tool[] | Custom tools |","category":"external_commands","line_end":469,"severity":"medium","line_start":468},{"id":"external_commands:SKILL.md:469:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `mcpServers` | object | MCP server configurations |","category":"external_commands","line_end":470,"severity":"medium","line_start":469},{"id":"external_commands:SKILL.md:470:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `hooks` | object | Session hooks |","category":"external_commands","line_end":471,"severity":"medium","line_start":470},{"id":"external_commands:SKILL.md:471:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `provider` | object | BYOK provider config |","category":"external_commands","line_end":472,"severity":"medium","line_start":471},{"id":"external_commands:SKILL.md:472:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `customAgents` | object[] | Custom agent definitions |","category":"external_commands","line_end":473,"severity":"medium","line_start":472},{"id":"external_commands:SKILL.md:473:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `systemMessage` | object | System message override |","category":"external_commands","line_end":474,"severity":"medium","line_start":473},{"id":"external_commands:SKILL.md:474:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `skillDirectories` | string[] | Directories to load skills from |","category":"external_commands","line_end":475,"severity":"medium","line_start":474},{"id":"external_commands:SKILL.md:475:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `disabledSkills` | string[] | Skills to disable |","category":"external_commands","line_end":476,"severity":"medium","line_start":475},{"id":"external_commands:SKILL.md:476:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `reasoningEffort` | string | Reasoning effort level |","category":"external_commands","line_end":477,"severity":"medium","line_start":476},{"id":"external_commands:SKILL.md:477:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `availableTools` | string[] | Restrict available tools |","category":"external_commands","line_end":478,"severity":"medium","line_start":477},{"id":"external_commands:SKILL.md:478:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `excludedTools` | string[] | Exclude specific tools |","category":"external_commands","line_end":479,"severity":"medium","line_start":478},{"id":"external_commands:SKILL.md:479:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `infiniteSessions` | object | Auto-compaction config |","category":"external_commands","line_end":480,"severity":"medium","line_start":479},{"id":"external_commands:SKILL.md:480:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `workingDirectory` | string | Working directory |","category":"external_commands","line_end":488,"severity":"medium","line_start":480},{"id":"external_commands:SKILL.md:488:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```typescript","category":"external_commands","line_end":490,"severity":"medium","line_start":488},{"id":"external_commands:SKILL.md:490:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":493,"severity":"medium","line_start":490},{"id":"external_commands:SKILL.md:493:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `CLI not found` → Install CLI or set `cliPath`","category":"external_commands","line_end":493,"severity":"medium","line_start":493},{"id":"external_commands:SKILL.md:494:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `Not authenticated` → Run `copilot auth login` or provide `githubToken`","category":"external_commands","line_end":494,"severity":"medium","line_start":494},{"id":"external_commands:SKILL.md:495:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `Session not found` → Don't use session after `destroy()`","category":"external_commands","line_end":495,"severity":"medium","line_start":495},{"id":"external_commands:SKILL.md:496:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `Connection refused` → Check CLI process, enable `autoRestart`","category":"external_commands","line_end":496,"severity":"medium","line_start":496},{"id":"external_commands:SKILL.md:504:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Node.js | `new CopilotClient()` | `client.createSession()` | `session.sendAndWait()` | `client.sto","category":"external_commands","line_end":504,"severity":"medium","line_start":504},{"id":"external_commands:SKILL.md:505:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Python | `CopilotClient()` | `client.create_session()` | `session.send_and_wait()` | `client.stop(","category":"external_commands","line_end":505,"severity":"medium","line_start":505},{"id":"external_commands:SKILL.md:506:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Go | `copilot.NewClient(nil)` | `client.CreateSession()` | `session.SendAndWait()` | `client.Stop(","category":"external_commands","line_end":506,"severity":"medium","line_start":506},{"id":"external_commands:SKILL.md:507:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| .NET | `new CopilotClient()` | `client.CreateSessionAsync()` | `session.SendAndWaitAsync()` | `cli","category":"external_commands","line_end":507,"severity":"medium","line_start":507},{"id":"network:SKILL.md:251:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"github: { type: \"http\", url: \"https://api.githubcopilot.com/mcp/\" },","category":"network","line_end":251,"severity":"low","line_start":251},{"id":"network:SKILL.md:310:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"baseUrl: \"https://your-resource.openai.azure.com/openai/v1/\",","category":"network","line_end":310,"severity":"low","line_start":310},{"id":"network:SKILL.md:511:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- [GitHub Copilot SDK](https://github.com/github/copilot-sdk)","category":"network","line_end":511,"severity":"low","line_start":511},{"id":"network:SKILL.md:512:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- [Copilot CLI Installation](https://docs.github.com/en/copilot/how-tos/set-up/install-copilot-cli)","category":"network","line_end":512,"severity":"low","line_start":512},{"id":"network:SKILL.md:513:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- [MCP Protocol Specification](https://modelcontextprotocol.io)","category":"network","line_end":513,"severity":"low","line_start":513},{"id":"env_access:SKILL.md:298:environment-variable-access-dot-notation","file":"SKILL.md","pattern":"Environment variable access (dot notation)","snippet":"const client = new CopilotClient({ githubToken: process.env.GITHUB_TOKEN });","category":"env_access","line_end":298,"severity":"low","line_start":298},{"id":"env_access:SKILL.md:312:environment-variable-access-dot-notation","file":"SKILL.md","pattern":"Environment variable access (dot notation)","snippet":"apiKey: process.env.FOUNDRY_API_KEY,","category":"env_access","line_end":312,"severity":"low","line_start":312},{"id":"env_access:SKILL.md:298:environment-variable-object","file":"SKILL.md","pattern":"Environment variable object","snippet":"const client = new CopilotClient({ githubToken: process.env.GITHUB_TOKEN });","category":"env_access","line_end":298,"severity":"low","line_start":298},{"id":"env_access:SKILL.md:312:environment-variable-object","file":"SKILL.md","pattern":"Environment variable object","snippet":"apiKey: process.env.FOUNDRY_API_KEY,","category":"env_access","line_end":312,"severity":"low","line_start":312},{"id":"env_access:SKILL.md:291:git-platform-tokens","file":"SKILL.md","pattern":"Git platform tokens","snippet":"2. **Environment variables** — `COPILOT_GITHUB_TOKEN` → `GH_TOKEN` → `GITHUB_TOKEN`","category":"env_access","line_end":291,"severity":"high","line_start":291},{"id":"env_access:SKILL.md:298:git-platform-tokens","file":"SKILL.md","pattern":"Git platform tokens","snippet":"const client = new CopilotClient({ githubToken: process.env.GITHUB_TOKEN });","category":"env_access","line_end":298,"severity":"high","line_start":298},{"id":"env_access:SKILL.md:312:generic-api-secret-keys","file":"SKILL.md","pattern":"Generic API/secret keys","snippet":"apiKey: process.env.FOUNDRY_API_KEY,","category":"env_access","line_end":312,"severity":"high","line_start":312},{"id":"sensitive:SKILL.md:298:environment-file-access","file":"SKILL.md","pattern":"Environment file access","snippet":"const client = new CopilotClient({ githubToken: process.env.GITHUB_TOKEN });","category":"sensitive","line_end":298,"severity":"high","line_start":298},{"id":"sensitive:SKILL.md:312:environment-file-access","file":"SKILL.md","pattern":"Environment file access","snippet":"apiKey: process.env.FOUNDRY_API_KEY,","category":"sensitive","line_end":312,"severity":"high","line_start":312},{"id":"blocker:SKILL.md:342:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"await resumed.sendAndWait({ prompt: \"What did we discuss?\" });","category":"blocker","line_end":342,"severity":"low","line_start":342},{"id":"blocker:SKILL.md:440:network-reconnaissance","file":"SKILL.md","pattern":"Network reconnaissance","snippet":"copilot --headless --port 4321","category":"blocker","line_end":440,"severity":"low","line_start":440}],"finding_verdicts":[{"id":"external_commands:SKILL.md:15:ruby-shell-backtick-execution","reason":"This is a documented CLI command shown in Markdown for setup or authentication. The backticks do not invoke a shell or perform command substitution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:23:ruby-shell-backtick-execution","reason":"This is an explicit package installation command displayed as Markdown documentation. The backticks format the command and do not execute it.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:24:ruby-shell-backtick-execution","reason":"This is an explicit package installation command displayed as Markdown documentation. The backticks format the command and do not execute it.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:25:ruby-shell-backtick-execution","reason":"This is an explicit package installation command displayed as Markdown documentation. The backticks format the command and do not execute it.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:26:ruby-shell-backtick-execution","reason":"This is an explicit package installation command displayed as Markdown documentation. The backticks format the command and do not execute it.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:36:ruby-shell-backtick-execution","reason":"The scanner matched Markdown backticks used for inline code or fenced examples, not Ruby or shell command substitution. The documentation does not execute this text.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:46:ruby-shell-backtick-execution","reason":"The scanner matched Markdown backticks used for inline code or fenced examples, not Ruby or shell command substitution. The documentation does not execute this text.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:50:ruby-shell-backtick-execution","reason":"The scanner matched Markdown backticks used for inline code or fenced examples, not Ruby or shell command substitution. The documentation does not execute this text.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:63:ruby-shell-backtick-execution","reason":"The scanner matched Markdown backticks used for inline code or fenced examples, not Ruby or shell command substitution. The documentation does not execute this text.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:67:ruby-shell-backtick-execution","reason":"The scanner matched Markdown backticks used for inline code or fenced examples, not Ruby or shell command substitution. The documentation does not execute this text.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:75:ruby-shell-backtick-execution","reason":"The scanner matched Markdown backticks used for inline code or fenced examples, not Ruby or shell command substitution. The documentation does not execute this text.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:79:ruby-shell-backtick-execution","reason":"The scanner matched Markdown backticks used for inline code or fenced examples, not Ruby or shell command substitution. The documentation does not execute this text.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:84:ruby-shell-backtick-execution","reason":"The scanner matched Markdown backticks used for inline code or fenced examples, not Ruby or shell command substitution. The documentation does not execute this text.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:90:ruby-shell-backtick-execution","reason":"The scanner matched Markdown backticks used for inline code or fenced examples, not Ruby or shell command substitution. The documentation does not execute this text.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:92:ruby-shell-backtick-execution","reason":"The scanner matched Markdown backticks used for inline code or fenced examples, not Ruby or shell command substitution. The documentation does not execute this text.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:101:ruby-shell-backtick-execution","reason":"The scanner matched Markdown backticks used for inline code or fenced examples, not Ruby or shell command substitution. The documentation does not execute this text.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:105:ruby-shell-backtick-execution","reason":"The scanner matched Markdown backticks used for inline code or fenced examples, not Ruby or shell command substitution. The documentation does not execute this text.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:117:ruby-shell-backtick-execution","reason":"The scanner matched Markdown backticks used for inline code or fenced examples, not Ruby or shell command substitution. The documentation does not execute this text.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:123:ruby-shell-backtick-execution","reason":"The scanner matched Markdown backticks used for inline code or fenced examples, not Ruby or shell command substitution. The documentation does not execute this text.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:124:ruby-shell-backtick-execution","reason":"The scanner matched Markdown backticks used for inline code or fenced examples, not Ruby or shell command substitution. The documentation does not execute this text.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:134:ruby-shell-backtick-execution","reason":"The scanner matched Markdown backticks used for inline code or fenced examples, not Ruby or shell command substitution. The documentation does not execute this text.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:151:ruby-shell-backtick-execution","reason":"The scanner matched Markdown backticks used for inline code or fenced examples, not Ruby or shell command substitution. The documentation does not execute this text.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:155:ruby-shell-backtick-execution","reason":"The scanner matched Markdown backticks used for inline code or fenced examples, not Ruby or shell command substitution. The documentation does not execute this text.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:167:ruby-shell-backtick-execution","reason":"The scanner matched Markdown backticks used for inline code or fenced examples, not Ruby or shell command substitution. The documentation does not execute this text.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:171:ruby-shell-backtick-execution","reason":"The scanner matched Markdown backticks used for inline code or fenced examples, not Ruby or shell command substitution. The documentation does not execute this text.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:173:ruby-shell-backtick-execution","reason":"The scanner matched Markdown backticks used for inline code or fenced examples, not Ruby or shell command substitution. The documentation does not execute this text.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:186:ruby-shell-backtick-execution","reason":"The scanner matched Markdown backticks used for inline code or fenced examples, not Ruby or shell command substitution. The documentation does not execute this text.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:190:ruby-shell-backtick-execution","reason":"The scanner matched Markdown backticks used for inline code or fenced examples, not Ruby or shell command substitution. The documentation does not execute this text.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:198:ruby-shell-backtick-execution","reason":"The scanner matched Markdown backticks used for inline code or fenced examples, not Ruby or shell command substitution. The documentation does not execute this text.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:208:ruby-shell-backtick-execution","reason":"The scanner matched Markdown backticks used for inline code or fenced examples, not Ruby or shell command substitution. The documentation does not execute this text.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:209:ruby-shell-backtick-execution","reason":"The scanner matched Markdown backticks used for inline code or fenced examples, not Ruby or shell command substitution. The documentation does not execute this text.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:210:ruby-shell-backtick-execution","reason":"The scanner matched Markdown backticks used for inline code or fenced examples, not Ruby or shell command substitution. The documentation does not execute this text.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:211:ruby-shell-backtick-execution","reason":"The scanner matched Markdown backticks used for inline code or fenced examples, not Ruby or shell command substitution. The documentation does not execute this text.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:212:ruby-shell-backtick-execution","reason":"The scanner matched Markdown backticks used for inline code or fenced examples, not Ruby or shell command substitution. The documentation does not execute this text.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:213:ruby-shell-backtick-execution","reason":"The scanner matched Markdown backticks used for inline code or fenced examples, not Ruby or shell command substitution. The documentation does not execute this text.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:217:ruby-shell-backtick-execution","reason":"The scanner matched Markdown backticks used for inline code or fenced examples, not Ruby or shell command substitution. The documentation does not execute this text.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:228:ruby-shell-backtick-execution","reason":"The scanner matched Markdown backticks used for inline code or fenced examples, not Ruby or shell command substitution. The documentation does not execute this text.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:234:ruby-shell-backtick-execution","reason":"The scanner matched Markdown backticks used for inline code or fenced examples, not Ruby or shell command substitution. The documentation does not execute this text.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:235:ruby-shell-backtick-execution","reason":"The scanner matched Markdown backticks used for inline code or fenced examples, not Ruby or shell command substitution. The documentation does not execute this text.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:236:ruby-shell-backtick-execution","reason":"The scanner matched Markdown backticks used for inline code or fenced examples, not Ruby or shell command substitution. The documentation does not execute this text.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:237:ruby-shell-backtick-execution","reason":"The scanner matched Markdown backticks used for inline code or fenced examples, not Ruby or shell command substitution. The documentation does not execute this text.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:238:ruby-shell-backtick-execution","reason":"The scanner matched Markdown backticks used for inline code or fenced examples, not Ruby or shell command substitution. The documentation does not execute this text.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:248:ruby-shell-backtick-execution","reason":"The scanner matched Markdown backticks used for inline code or fenced examples, not Ruby or shell command substitution. The documentation does not execute this text.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:254:ruby-shell-backtick-execution","reason":"The scanner matched Markdown backticks used for inline code or fenced examples, not Ruby or shell command substitution. The documentation does not execute this text.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:258:ruby-shell-backtick-execution","reason":"The scanner matched a Markdown fence around a TypeScript MCP configuration example, not shell backtick execution. Package execution risk is assessed separately as a semantic finding.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:269:ruby-shell-backtick-execution","reason":"The scanner matched Markdown backticks used for inline code or fenced examples, not Ruby or shell command substitution. The documentation does not execute this text.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:275:ruby-shell-backtick-execution","reason":"The scanner matched Markdown backticks used for inline code or fenced examples, not Ruby or shell command substitution. The documentation does not execute this text.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:276:ruby-shell-backtick-execution","reason":"The scanner matched Markdown backticks used for inline code or fenced examples, not Ruby or shell command substitution. The documentation does not execute this text.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:277:ruby-shell-backtick-execution","reason":"The scanner matched Markdown backticks used for inline code or fenced examples, not Ruby or shell command substitution. The documentation does not execute this text.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:278:ruby-shell-backtick-execution","reason":"The scanner matched Markdown backticks used for inline code or fenced examples, not Ruby or shell command substitution. The documentation does not execute this text.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:279:ruby-shell-backtick-execution","reason":"The scanner matched Markdown backticks used for inline code or fenced examples, not Ruby or shell command substitution. The documentation does not execute this text.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:280:ruby-shell-backtick-execution","reason":"The scanner matched Markdown backticks used for inline code or fenced examples, not Ruby or shell command substitution. The documentation does not execute this text.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:281:ruby-shell-backtick-execution","reason":"The scanner matched Markdown backticks used for inline code or fenced examples, not Ruby or shell command substitution. The documentation does not execute this text.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:282:ruby-shell-backtick-execution","reason":"The scanner matched Markdown backticks used for inline code or fenced examples, not Ruby or shell command substitution. The documentation does not execute this text.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:290:ruby-shell-backtick-execution","reason":"The scanner matched Markdown backticks used for inline code or fenced examples, not Ruby or shell command substitution. The documentation does not execute this text.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:291:ruby-shell-backtick-execution","reason":"The scanner matched Markdown backticks used for inline code or fenced examples, not Ruby or shell command substitution. The documentation does not execute this text.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:292:ruby-shell-backtick-execution","reason":"This is a documented CLI command shown in Markdown for setup or authentication. The backticks do not invoke a shell or perform command substitution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:293:ruby-shell-backtick-execution","reason":"This is a documented CLI command shown in Markdown for setup or authentication. The backticks do not invoke a shell or perform command substitution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:297:ruby-shell-backtick-execution","reason":"The scanner matched Markdown backticks used for inline code or fenced examples, not Ruby or shell command substitution. The documentation does not execute this text.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:299:ruby-shell-backtick-execution","reason":"The scanner matched Markdown backticks used for inline code or fenced examples, not Ruby or shell command substitution. The documentation does not execute this text.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:305:ruby-shell-backtick-execution","reason":"The scanner matched Markdown backticks used for inline code or fenced examples, not Ruby or shell command substitution. The documentation does not execute this text.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:315:ruby-shell-backtick-execution","reason":"The scanner matched Markdown backticks used for inline code or fenced examples, not Ruby or shell command substitution. The documentation does not execute this text.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:319:ruby-shell-backtick-execution","reason":"The scanner matched Markdown backticks used for inline code or fenced examples, not Ruby or shell command substitution. The documentation does not execute this text.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:320:ruby-shell-backtick-execution","reason":"The scanner matched Markdown backticks used for inline code or fenced examples, not Ruby or shell command substitution. The documentation does not execute this text.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:321:ruby-shell-backtick-execution","reason":"The scanner matched Markdown backticks used for inline code or fenced examples, not Ruby or shell command substitution. The documentation does not execute this text.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:322:ruby-shell-backtick-execution","reason":"The scanner matched Markdown backticks used for inline code or fenced examples, not Ruby or shell command substitution. The documentation does not execute this text.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:323:ruby-shell-backtick-execution","reason":"The scanner matched Markdown backticks used for inline code or fenced examples, not Ruby or shell command substitution. The documentation does not execute this text.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:325:ruby-shell-backtick-execution","reason":"The scanner matched Markdown backticks used for inline code or fenced examples, not Ruby or shell command substitution. The documentation does not execute this text.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:333:ruby-shell-backtick-execution","reason":"The scanner matched Markdown backticks used for inline code or fenced examples, not Ruby or shell command substitution. The documentation does not execute this text.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:343:ruby-shell-backtick-execution","reason":"The scanner matched Markdown backticks used for inline code or fenced examples, not Ruby or shell command substitution. The documentation does not execute this text.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:347:ruby-shell-backtick-execution","reason":"The scanner matched Markdown backticks used for inline code or fenced examples, not Ruby or shell command substitution. The documentation does not execute this text.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:351:ruby-shell-backtick-execution","reason":"The scanner matched Markdown backticks used for inline code or fenced examples, not Ruby or shell command substitution. The documentation does not execute this text.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:353:ruby-shell-backtick-execution","reason":"The scanner matched Markdown backticks used for inline code or fenced examples, not Ruby or shell command substitution. The documentation does not execute this text.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:359:ruby-shell-backtick-execution","reason":"The scanner matched Markdown backticks used for inline code or fenced examples, not Ruby or shell command substitution. The documentation does not execute this text.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:367:ruby-shell-backtick-execution","reason":"The scanner matched Markdown backticks used for inline code or fenced examples, not Ruby or shell command substitution. The documentation does not execute this text.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:375:ruby-shell-backtick-execution","reason":"The scanner matched Markdown backticks used for inline code or fenced examples, not Ruby or shell command substitution. The documentation does not execute this text.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:384:ruby-shell-backtick-execution","reason":"The scanner matched Markdown backticks used for inline code or fenced examples, not Ruby or shell command substitution. The documentation does not execute this text.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:392:ruby-shell-backtick-execution","reason":"The scanner matched Markdown backticks used for inline code or fenced examples, not Ruby or shell command substitution. The documentation does not execute this text.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:396:ruby-shell-backtick-execution","reason":"The scanner matched Markdown backticks used for inline code or fenced examples, not Ruby or shell command substitution. The documentation does not execute this text.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:404:ruby-shell-backtick-execution","reason":"The scanner matched Markdown backticks used for inline code or fenced examples, not Ruby or shell command substitution. The documentation does not execute this text.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:409:ruby-shell-backtick-execution","reason":"The scanner matched Markdown backticks used for inline code or fenced examples, not Ruby or shell command substitution. The documentation does not execute this text.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:417:ruby-shell-backtick-execution","reason":"The scanner matched Markdown backticks used for inline code or fenced examples, not Ruby or shell command substitution. The documentation does not execute this text.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:431:ruby-shell-backtick-execution","reason":"The scanner matched Markdown backticks used for inline code or fenced examples, not Ruby or shell command substitution. The documentation does not execute this text.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:439:ruby-shell-backtick-execution","reason":"This is a fenced Bash example for starting the required Copilot CLI service. The Markdown fence is not Ruby or shell backtick execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:441:ruby-shell-backtick-execution","reason":"The scanner matched Markdown backticks used for inline code or fenced examples, not Ruby or shell command substitution. The documentation does not execute this text.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:443:ruby-shell-backtick-execution","reason":"The scanner matched Markdown backticks used for inline code or fenced examples, not Ruby or shell command substitution. The documentation does not execute this text.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:445:ruby-shell-backtick-execution","reason":"The scanner matched Markdown backticks used for inline code or fenced examples, not Ruby or shell command substitution. The documentation does not execute this text.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:453:ruby-shell-backtick-execution","reason":"The scanner matched Markdown backticks used for inline code or fenced examples, not Ruby or shell command substitution. The documentation does not execute this text.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:454:ruby-shell-backtick-execution","reason":"The scanner matched Markdown backticks used for inline code or fenced examples, not Ruby or shell command substitution. The documentation does not execute this text.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:455:ruby-shell-backtick-execution","reason":"The scanner matched Markdown backticks used for inline code or fenced examples, not Ruby or shell command substitution. The documentation does not execute this text.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:456:ruby-shell-backtick-execution","reason":"The scanner matched Markdown backticks used for inline code or fenced examples, not Ruby or shell command substitution. The documentation does not execute this text.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:457:ruby-shell-backtick-execution","reason":"The scanner matched Markdown backticks used for inline code or fenced examples, not Ruby or shell command substitution. The documentation does not execute this text.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:458:ruby-shell-backtick-execution","reason":"The scanner matched Markdown backticks used for inline code or fenced examples, not Ruby or shell command substitution. The documentation does not execute this text.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:459:ruby-shell-backtick-execution","reason":"The scanner matched Markdown backticks used for inline code or fenced examples, not Ruby or shell command substitution. The documentation does not execute this text.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:465:ruby-shell-backtick-execution","reason":"The scanner matched Markdown backticks used for inline code or fenced examples, not Ruby or shell command substitution. The documentation does not execute this text.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:466:ruby-shell-backtick-execution","reason":"The scanner matched Markdown backticks used for inline code or fenced examples, not Ruby or shell command substitution. The documentation does not execute this text.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:467:ruby-shell-backtick-execution","reason":"The scanner matched Markdown backticks used for inline code or fenced examples, not Ruby or shell command substitution. The documentation does not execute this text.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:468:ruby-shell-backtick-execution","reason":"The scanner matched Markdown backticks used for inline code or fenced examples, not Ruby or shell command substitution. The documentation does not execute this text.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:469:ruby-shell-backtick-execution","reason":"The scanner matched Markdown backticks used for inline code or fenced examples, not Ruby or shell command substitution. The documentation does not execute this text.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:470:ruby-shell-backtick-execution","reason":"The scanner matched Markdown backticks used for inline code or fenced examples, not Ruby or shell command substitution. The documentation does not execute this text.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:471:ruby-shell-backtick-execution","reason":"The scanner matched Markdown backticks used for inline code or fenced examples, not Ruby or shell command substitution. The documentation does not execute this text.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:472:ruby-shell-backtick-execution","reason":"The scanner matched Markdown backticks used for inline code or fenced examples, not Ruby or shell command substitution. The documentation does not execute this text.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:473:ruby-shell-backtick-execution","reason":"The scanner matched Markdown backticks used for inline code or fenced examples, not Ruby or shell command substitution. The documentation does not execute this text.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:474:ruby-shell-backtick-execution","reason":"The scanner matched Markdown backticks used for inline code or fenced examples, not Ruby or shell command substitution. The documentation does not execute this text.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:475:ruby-shell-backtick-execution","reason":"The scanner matched Markdown backticks used for inline code or fenced examples, not Ruby or shell command substitution. The documentation does not execute this text.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:476:ruby-shell-backtick-execution","reason":"The scanner matched Markdown backticks used for inline code or fenced examples, not Ruby or shell command substitution. The documentation does not execute this text.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:477:ruby-shell-backtick-execution","reason":"The scanner matched Markdown backticks used for inline code or fenced examples, not Ruby or shell command substitution. The documentation does not execute this text.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:478:ruby-shell-backtick-execution","reason":"The scanner matched Markdown backticks used for inline code or fenced examples, not Ruby or shell command substitution. The documentation does not execute this text.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:479:ruby-shell-backtick-execution","reason":"The scanner matched Markdown backticks used for inline code or fenced examples, not Ruby or shell command substitution. The documentation does not execute this text.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:480:ruby-shell-backtick-execution","reason":"The scanner matched Markdown backticks used for inline code or fenced examples, not Ruby or shell command substitution. The documentation does not execute this text.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:488:ruby-shell-backtick-execution","reason":"The scanner matched Markdown backticks used for inline code or fenced examples, not Ruby or shell command substitution. The documentation does not execute this text.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:490:ruby-shell-backtick-execution","reason":"The scanner matched Markdown backticks used for inline code or fenced examples, not Ruby or shell command substitution. The documentation does not execute this text.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:493:ruby-shell-backtick-execution","reason":"The scanner matched Markdown backticks used for inline code or fenced examples, not Ruby or shell command substitution. The documentation does not execute this text.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:494:ruby-shell-backtick-execution","reason":"This is a documented CLI command shown in Markdown for setup or authentication. The backticks do not invoke a shell or perform command substitution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:495:ruby-shell-backtick-execution","reason":"The scanner matched Markdown backticks used for inline code or fenced examples, not Ruby or shell command substitution. The documentation does not execute this text.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:496:ruby-shell-backtick-execution","reason":"The scanner matched Markdown backticks used for inline code or fenced examples, not Ruby or shell command substitution. The documentation does not execute this text.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:504:ruby-shell-backtick-execution","reason":"The scanner matched Markdown backticks used for inline code or fenced examples, not Ruby or shell command substitution. The documentation does not execute this text.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:505:ruby-shell-backtick-execution","reason":"The scanner matched Markdown backticks used for inline code or fenced examples, not Ruby or shell command substitution. The documentation does not execute this text.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:506:ruby-shell-backtick-execution","reason":"The scanner matched Markdown backticks used for inline code or fenced examples, not Ruby or shell command substitution. The documentation does not execute this text.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:507:ruby-shell-backtick-execution","reason":"The scanner matched Markdown backticks used for inline code or fenced examples, not Ruby or shell command substitution. The documentation does not execute this text.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:251:hardcoded-url","reason":"The URL is the explicit GitHub Copilot MCP endpoint required by the documented integration. No covert destination or unrelated data transfer is present.","verdict":"false_positive","confidence":0.98},{"id":"network:SKILL.md:310:hardcoded-url","reason":"This is a placeholder Azure OpenAI endpoint containing 'your-resource', not an operational hardcoded destination. Users must replace it with their own provider URL.","verdict":"false_positive","confidence":0.98},{"id":"network:SKILL.md:511:hardcoded-url","reason":"This URL is a visible reference link to the GitHub Copilot SDK repository. It does not cause a network request during skill execution.","verdict":"false_positive","confidence":0.98},{"id":"network:SKILL.md:512:hardcoded-url","reason":"This URL is a visible reference link to official GitHub Copilot CLI documentation. It does not cause a network request during skill execution.","verdict":"false_positive","confidence":0.98},{"id":"network:SKILL.md:513:hardcoded-url","reason":"This URL is a visible reference link to the MCP specification. It does not cause a network request during skill execution.","verdict":"false_positive","confidence":0.98},{"id":"env_access:SKILL.md:298:environment-variable-access-dot-notation","reason":"The example reads GITHUB_TOKEN only to provide documented authentication to CopilotClient. It contains no logging, persistence, or unrelated transmission of the token.","verdict":"false_positive","confidence":0.98},{"id":"env_access:SKILL.md:312:environment-variable-access-dot-notation","reason":"The example reads FOUNDRY_API_KEY only for the configured BYOK provider. It contains no logging, persistence, or unrelated transmission of the key.","verdict":"false_positive","confidence":0.98},{"id":"env_access:SKILL.md:298:environment-variable-object","reason":"The process.env reference is a standard credential injection example for CopilotClient authentication. It does not enumerate the environment or expose the token.","verdict":"false_positive","confidence":0.98},{"id":"env_access:SKILL.md:312:environment-variable-object","reason":"The process.env reference injects one named provider key into the documented BYOK configuration. It does not enumerate or disclose environment data.","verdict":"false_positive","confidence":0.98},{"id":"env_access:SKILL.md:291:git-platform-tokens","reason":"This line documents supported authentication variable names and contains no token value or executable access. No secret is embedded or disclosed.","verdict":"false_positive","confidence":0.98},{"id":"env_access:SKILL.md:298:git-platform-tokens","reason":"The named GitHub token is read at runtime for its intended Copilot authentication purpose. No literal credential, logging, or unrelated recipient is present.","verdict":"false_positive","confidence":0.98},{"id":"env_access:SKILL.md:312:generic-api-secret-keys","reason":"The named API key is passed to the user-selected BYOK provider for authentication. No literal secret, logging, or unrelated recipient is present.","verdict":"false_positive","confidence":0.98},{"id":"sensitive:SKILL.md:298:environment-file-access","reason":"The example reads a named process environment variable; it does not open, parse, or search an environment file. The environment-file pattern is not present.","verdict":"false_positive","confidence":1},{"id":"sensitive:SKILL.md:312:environment-file-access","reason":"The example reads a named process environment variable; it does not open, parse, or search an environment file. The environment-file pattern is not present.","verdict":"false_positive","confidence":1},{"id":"blocker:SKILL.md:342:system-reconnaissance","reason":"The prompt asks a resumed Copilot session to recall prior conversation context. It does not inspect the host, operating system, files, or installed software.","verdict":"false_positive","confidence":0.98},{"id":"blocker:SKILL.md:440:network-reconnaissance","reason":"The command starts the Copilot CLI on a fixed local port for an explicitly documented client connection. It does not discover hosts, ports, or network services.","verdict":"false_positive","confidence":0.98}],"semantic_findings":[{"title":"Overly Permissive Tool Approval","severity":"high","locations":[{"file":"SKILL.md","line_end":429,"line_start":417}],"confidence":0.98,"description":"The example approves every non-shell request, accepts shell commands by prefix, and automatically answers user-input requests. Generated applications could authorize unintended actions.","confidence_reasoning":"The handler explicitly returns approval for all non-shell requests and responds yes without user confirmation. The shell check also relies on an unsafe string prefix."},{"title":"Unpinned Package Execution","severity":"medium","locations":[{"file":"SKILL.md","line_end":265,"line_start":258}],"confidence":0.95,"description":"The local MCP example uses npx with automatic confirmation and no package version. Running it can download and execute changed dependency code.","confidence_reasoning":"The command and arguments clearly specify npx, automatic installation, and an unversioned package. This creates a direct dependency supply-chain exposure."}],"subject_marketplace_commit_sha":"f9e2c34b4f19c7f3e6b0a1e93227b5f77cc12526","subject_content_hash":"ca1af2be9119648164d387bde146c0f51451fbf207151d188dca195ffc381718","subject_tree_hash":"44603766467909de401d500e3e118a111940d662c4d16f6952badceeea6ebfdc","subject_plugin_path":"skills/sickn33/copilot-sdk","audit_payload_hash":"0863a15488515911b92163c0bb453fea","confirmed_risk_level":"high","scanner_version":"3.0.0","policy_version":"skillstore-security-audit-policy-v1","subject":{"marketplaceCommitSha":"f9e2c34b4f19c7f3e6b0a1e93227b5f77cc12526","contentHash":"ca1af2be9119648164d387bde146c0f51451fbf207151d188dca195ffc381718","treeHash":"44603766467909de401d500e3e118a111940d662c4d16f6952badceeea6ebfdc","pluginPath":"skills/sickn33/copilot-sdk","auditPayloadHash":"0863a15488515911b92163c0bb453fea"},"scannerVersion":"3.0.0","policyVersion":"skillstore-security-audit-policy-v1"},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"issued","url":"/api/skills/sickn33-copilot-sdk/audits/5/attestation","status":"active"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"high","confirmedFindingCount":2,"capabilityReviewCount":0,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"confirmation_required","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"active","verificationState":"not_verified"},"isLatest":true}}