copilot-cli — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited copilot-cli (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Delegate selected tasks from Claude Code to GitHub Copilot CLI using non-interactive commands, explicit model selection, safe permission flags, and shareable outputs.
This skill standardizes delegation to GitHub Copilot CLI (copilot) for cases where a different model may be more suitable for a task. It covers:
-p / --prompt--model--allow-tool, --allow-all-tools, --allow-all-paths, --allow-all-urls, --yolo)--silent--share--resumeUse this skill only when delegation to Copilot is explicitly requested or clearly beneficial.
Use this skill when:
Trigger phrases:
# CLI availability
copilot --version
# GitHub authentication status
gh auth statusIf copilot is unavailable, ask the user to install/setup GitHub Copilot CLI before proceeding.
All delegated prompts to Copilot CLI must be in English.
Prompt template:
Task: <clear objective>
Context: <project/module/files>
Constraints: <do/don't constraints>
Expected output: <format + depth>
Validation: <tests/checks to run or explain>Pick a model based on task type and user preference.
Use exact model names available in the local Copilot CLI model list.
Default to the minimum required capability.
--allow-tool '<tool>' when task scope is narrow--allow-all-tools only when multiple tools are clearly needed--allow-all-paths only if task requires broad filesystem access--allow-all-urls only if external URLs are required--yolo unless the user explicitly requests full permissionsBase pattern:
copilot -p "<english prompt>" --model <model-name> --allow-all-tools --silentAdd optional flags only as needed:
# Capture session to markdown
copilot -p "<english prompt>" --model <model-name> --allow-all-tools --share
# Resume existing session
copilot --resume <session-id> --allow-all-tools
# Strictly silent scripted output
copilot -p "<english prompt>" --model <model-name> --allow-all-tools --silentAfter command execution:
--share is used, provide generated markdown pathWhen requested, run the same prompt with multiple models and compare:
Keep the comparison objective and concise.
Input:
Ask Copilot to refactor this service using GPT-5.2 and return only concrete code changes.Command:
copilot -p "Refactor the payment service in src/services/payment.ts to reduce duplication. Keep public behavior unchanged, keep TypeScript strict typing, and output a patch-style response." \
--model gpt-5.2 \
--allow-all-tools \
--silentOutput:
Copilot proposes extracting three private helpers, consolidating error mapping, and provides a patch for payment.ts with unchanged API signatures.Input:
Use Copilot CLI with Sonnet to review this module and share the session in markdown.Command:
copilot -p "Review src/modules/auth for security and correctness. Report only high-confidence findings with severity and file references." \
--model claude-sonnet-4.6 \
--allow-all-tools \
--shareOutput:
Review completed. Session exported to ./copilot-session-<id>.md.Input:
Continue the previous Copilot analysis session.Command:
copilot --resume <session-id> --allow-all-toolsOutput:
Session resumed and continued from prior context.--share when auditability matters--allow-all-tools, --allow-all-paths, --allow-all-urls, and --yolo increase risk; use only when justifiedFor additional option details, see references/cli-command-reference.md.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.