copilot — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited copilot (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Drive the GitHub Copilot CLI and coding agent. Three modes:
| Mode | Invocation | Purpose |
|---|---|---|
review | /copilot review <pr> | Review a PR, route fixes to Copilot via inline comments. |
delegate | /copilot delegate <task> | Create a gh agent-task, monitor until it produces a PR. |
setup | /copilot setup | One-time bootstrap of .github/copilot-instructions.md and friends. |
Routine work is review and delegate. Read references/setup.md only when the user explicitly says "copilot setup", "generate copilot instructions", or "bootstrap copilot for this repo" — never for routine review/delegate work, since it adds ~12 KB of repo-bootstrap content irrelevant to those modes.
Parse the first positional argument as the mode. If no mode is given, ask the user which mode they want via your harness's interactive-prompt mechanism; if none, ask in plain text and stop for the answer. Never silently default — each mode has very different side effects.
| First arg | Mode |
|---|---|
review (with optional PR number / URL after) | review |
delegate followed by a task description | delegate |
setup | setup (load references/setup.md) |
Bare PR URL (https://github.com/...) | review |
| Anything else (bare integer, ambiguous, missing) | ask via your harness's prompt |
A bare integer is ambiguous — it could be a PR number, a gh agent-task ID, or noise. Always ask before assuming review mode.
Review a PR and post Copilot-actionable fixes as inline review comments.
Determine the PR number. If the argument is a PR URL, extract the number. If a bare integer was passed, confirm with the user it is a PR number (it could equally be a gh agent-task ID). If no number was provided, run gh pr list and ask which PR.
PR=<number>
gh pr view "$PR" --json title,body,author,baseRefName,headRefName,url,number,additions,deletions,changedFiles
gh pr diff "$PR"
OWNER_REPO=$(gh repo view --json nameWithOwner --jq '.nameWithOwner')
gh api "repos/${OWNER_REPO}/pulls/${PR}/files" \
--jq '.[] | {filename, status, additions, deletions, patch}'Present a brief summary (title, author, base ← head, files changed, additions/deletions) before continuing.
Invoke whatever code-review skill your harness provides (e.g. age, code-review, or similar). The review must surface findings with confidence scores so phase 3 can triage. If no review skill is available, ask the user to point at one before continuing — do not guess at findings.
For each finding, assign a disposition:
COPILOT_FIX — straightforward fix Copilot can handle (add validation,fix logic, delete dead code, inline a wrapper, remove a docstring that restates the function name).
FUTURE_TASK — broader context needed, architectural decision, or amulti-file refactor.
Present a per-file table:
### path/to/file.ts
| # | Score | Line | Category | Issue | Disposition |
|---|-------|------|----------|-----------------------------|-------------|
| 1 | 95 | 42 | BUG | Null check missing | COPILOT_FIX |
| 2 | 80 | 78 | COUPLING | Domain imports HTTP client | FUTURE_TASK |Then show the full comment body for each item.
`COPILOT_FIX` body:
**[CATEGORY]**: <issue description>
**Why this matters:** <teaching moment — the principle behind the fix>
@copilot fix this`FUTURE_TASK` body:
**[CATEGORY]**: <issue description>
**Why this matters:** <teaching moment — the principle behind the suggestion>
_Noted for future work — not a Copilot fix._Ask the user which to post, which to skip, which to edit, and whether any disposition should change. Never post without explicit approval.
Build a single review payload and submit it:
cat > /tmp/copilot-review-payload.json <<'JSON'
{
"body": "Automated review — items marked for @copilot are actionable fixes.",
"event": "COMMENT",
"comments": [
{
"path": "path/to/file.ts",
"line": 42,
"side": "RIGHT",
"body": "**BUG**: Null check missing...\n\n@copilot fix this"
}
]
}
JSON
gh api --method POST \
"repos/${OWNER_REPO}/pulls/${PR}/reviews" \
--input /tmp/copilot-review-payload.json
rm -f /tmp/copilot-review-payload.jsonPrint a summary: total posted, COPILOT_FIX count, FUTURE_TASK count, PR link.
PR fetch + Copilot formatting only.
Create a gh agent-task, poll until the Copilot coding agent opens a PR, then optionally hand off to review mode.
The coding agent runs on Auto model selection. The CLI has no --model flag. Optimize the task description:
src/auth/login.ts, validateToken should…"AppError).When confirming the task with the user (phase 1 step 3), check the description against these criteria. Suggest concrete improvements if it is vague or under-specified.
gh repo view --json nameWithOwner --jq '.nameWithOwner'.repo, and ask whether a non-default base branch is needed.
gh agent-task create "<task description>".gh agent-task list --limit 1. Parsethe tab-separated row (description \t #PR \t repo \t status \t timestamp) and extract the PR number and status.
(https://github.com/<repo>/pull/<number>).
Poll every 90 seconds, up to a 15-minute timeout.
sleep 90
gh agent-task list --limit 5Find the row matching the captured PR number. Branch on status:
time. Continue.
gh agent-task view <PR#> and stop.On 15-minute timeout, tell the user the task is still running, give the PR link, and ask whether to wait another 10 minutes or stop and review later.
Print a completion summary (PR number, link, final status, elapsed time) and ask "Run /copilot review on PR #N?". On yes, invoke this skill in review mode with the PR number. On no, print the link and exit.
gh agent-task create fails, surface the errorand stop.
gh agent-task list output.setup is a one-time bootstrap that writes .github/copilot-instructions.md and the per-language / per-role files under .github/instructions/.
For pure instruction-file authoring or auditing — adding or refining .github/copilot-instructions.md and .github/instructions/*.instructions.md without driving a review or delegation — use /github-copilot-repo-instructions instead; this setup mode is the bootstrap-from-scratch path.
See references/setup.md — read only when the user explicitly says "copilot setup", "generate copilot instructions", or "bootstrap copilot for this repo". It contains the full walkthrough: project-type detection, tooling detection, overwrite gating, the global instructions template, the code-review instructions template, language-specific stubs, and the coding-agent instructions. Loading it costs ~12 KB of context and is irrelevant to routine review / delegate work.
git push, open PRs, or merge — that is /gh's job./commit's job.review mode delegates to whateverreview skill the environment provides (e.g. age, code-review).
.github/ during setup.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.