Audit History

All 28 external-command alerts are false positives caused by Markdown fences or JavaScript template literals. The reconnaissance alert is also false, but sending development content to Copilot and enabling all tools create two contextual medium risks.

All 29 static findings are false positives caused by Markdown code fences, JavaScript template literals, and a descriptive statement about direct access. The skill documents an optional broad tool-authorization setting; enabling it can violate least-privilege controls depending on the configured Copilot MCP server.

All 29 static findings are false positives caused by Markdown code fences, JavaScript template literals, and a descriptive statement about direct access. The skill documents an optional broad tool-authorization setting; enabling it can violate least-privilege controls depending on the configured Copilot MCP server.

All 29 static findings are false positives caused by Markdown code fences, JavaScript template literals, and a descriptive statement about direct access. The skill documents an optional broad tool-authorization setting; enabling it can violate least-privilege controls depending on the configured Copilot MCP server.

The static backtick findings are false positives caused by Markdown fences and JavaScript template literals in examples. No prompt injection or malicious execution instructions were found in SKILL.md. The review found contextual risks around broad Copilot tool delegation and sensitive code sent to an external AI service.

The static backtick findings are false positives caused by Markdown fences and JavaScript template literals in examples. No prompt injection or malicious execution instructions were found in SKILL.md. The review found contextual risks around broad Copilot tool delegation and sensitive code sent to an external AI service.

The static Ruby/shell backtick, weak cryptography, and network reconnaissance findings are false positives from Markdown examples and ordinary descriptive text. The skill has legitimate elevated risk because it sends user prompts or code to GitHub Copilot MCP tools and documents broad delegated tool access with allowAllTools.

This is a documentation-only skill containing no executable code. The static findings are all false positives: model names and repository URLs were misidentified as cryptographic algorithms and C2 keywords; JavaScript code examples with parentheses were flagged as backtick execution; and documentation text was misinterpreted. This skill provides only markdown documentation and metadata about GitHub Copilot MCP server integration.

This is a documentation-only skill containing no executable code. The static findings are all false positives: model names and repository URLs were misidentified as cryptographic algorithms and C2 keywords; JavaScript code examples with parentheses were flagged as backtick execution; and documentation text was misinterpreted. This skill provides only markdown documentation and metadata about GitHub Copilot MCP server integration.

This is a documentation-only skill (SKILL.md) providing metadata and prompt templates for GitHub Copilot MCP server integration. No executable code, scripts, network calls, or filesystem access is present. Pure documentation skill with no security concerns.

This is a documentation-only skill (SKILL.md) providing metadata and prompt templates for GitHub Copilot MCP server integration. No executable code, scripts, network calls, or filesystem access is present. Pure documentation skill with no security concerns.

This is a documentation-only skill (SKILL.md) providing metadata and prompt templates for GitHub Copilot MCP server integration. No executable code, scripts, network calls, or filesystem access is present. Pure documentation skill with no security concerns.