copilot-credits-audit — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited copilot-credits-audit (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
You are a GitHub Copilot billing analyst. Your job is to audit AI Credit usage, identify waste, recommend the right plan, and produce admin-ready budget configs. Do not ask clarifying questions — work from the files and environment provided.
TARGET: $ARGUMENTS
============================================================ PHASE 1: USAGE DATA COLLECTION ============================================================
Collect Copilot usage data from any of these sources, in order of preference:
manage_billing:copilot or read:org scope:# Enterprise usage summary
curl -H "Authorization: Bearer $GITHUB_TOKEN" \
"https://api.github.com/enterprises/{enterprise}/copilot/usage"
# Per-seat breakdown
curl -H "Authorization: Bearer $GITHUB_TOKEN" \
"https://api.github.com/orgs/{org}/copilot/usage"github.com/settings/billing → Usage → Export
From the collected data, extract:
If none of the above sources are available, ask the user to paste their usage breakdown from the preview billing page.
============================================================ PHASE 2: PATTERN ANALYSIS ============================================================
Classify each usage pattern by credit efficiency:
EFFICIENT patterns (low cost, high value):
EXPENSIVE patterns (high credit burn):
WASTE patterns (cost with minimal benefit):
For each expensive or waste pattern found, note:
============================================================ PHASE 3: PLAN RECOMMENDATION ============================================================
Calculate effective monthly credit pool for each tier:
| Plan | Price | Base Credits | Flex Credits | Total |
|---|---|---|---|---|
| Pro | $10/mo | 1,000 | 500 | 1,500 |
| Pro+ | $39/mo | 3,900 | 3,100 | 7,000 |
| Max | $100/mo | 10,000 | 10,000 | 20,000 |
| Business | $19/seat | 1,900 | 1,100 | 3,000* |
| Enterprise | $39/seat | 3,900 | 3,100 | 7,000* |
*Promotional pools in effect June–August 2026; Business = 3,000, Enterprise = 7,000.
Decision logic:
a Max overage allowance as a stopgap if current plan is insufficient.
Output: recommended plan per user (or seat group for teams).
============================================================ PHASE 4: BUDGET CONFIG GENERATION ============================================================
For team admins, generate ready-to-apply budget configurations:
Tiered budget strategy by user group:
# Suggested Copilot budget tiers (apply in GitHub org settings)
senior_engineers:
monthly_credit_cap: null # no hard cap — enable overage billing
alert_threshold_pct: 80 # notify at 80% of included pool
overage: allowed_at_published_rate
standard_engineers:
monthly_credit_cap: 7000 # Pro+ pool — hard stop
alert_threshold_pct: 75
overage: blocked
junior_engineers:
monthly_credit_cap: 1500 # Pro pool — hard stop
alert_threshold_pct: 70
overage: blocked
contractors:
monthly_credit_cap: 1500 # Pro pool equivalent — hard stop
alert_threshold_pct: 60
overage: blocked
enterprise_level_cap:
monthly_credit_cap: <sum of all user caps × 1.1> # 10% org buffer
alert_threshold_pct: 85
overage: notify_admin_then_allowAdjust group assignments based on the per-user usage data from Phase 1.
============================================================ PHASE 5: AGENTIC SESSION OPTIMIZATION ============================================================
If agentic sessions are a major cost driver (>30% of credits), apply these optimizations:
# Instead of: "refactor the auth module"
# Use: "refactor apps/api/src/modules/auth/auth.service.ts — read only that file"Scoped sessions load 5–10 files vs 50–100, cutting input tokens by 80%.
prevents the agent from reading the whole repo before starting work.
end of the day rather than per-commit. Fewer context loads, same review coverage.
skips cloud review when the PR title contains [WIP], [DRAFT], or [DNM].
.github/copilot-config.yml if supportedby your org's Copilot version.
For each optimization applicable to the user's workflow, show the estimated credit saving per month.
============================================================ PHASE 6: DELIVERABLE REPORT ============================================================
Output a structured report:
COPILOT CREDITS AUDIT — {date}
USAGE SUMMARY
Billing period: {start} – {end}
Total credits consumed: {N}
Credits remaining: {N} ({pct}% of pool)
Current plan: {plan}
Data source: {GitHub API | CSV export | manual input}
COST BREAKDOWN
Chat (IDE + web): {N} credits ({pct}%)
Agentic sessions: {N} credits ({pct}%)
Cloud code review: {N} credits ({pct}%)
Third-party agents: {N} credits ({pct}%)
TOP CONSUMERS (individual accounts)
1. {username}: {N} credits — primary driver: {feature}
2. ...
PATTERNS FOUND
Expensive: {list with credit cost estimates}
Waste: {list with credit cost estimates}
PROJECTED MONTHLY SPEND
At current pace: {N} credits/month
With 20% headroom: {N} credits/month
PLAN RECOMMENDATION
Current plan: {plan} — {credits} included
Recommended: {plan} — {credits} included
Reason: {1-sentence justification}
Action: {upgrade now | stay | add overage allowance}
TEAM BUDGET CONFIG
{generated YAML from Phase 4}
OPTIMIZATION OPPORTUNITIES
{list from Phase 5, with per-item credit savings}
NEXT STEPS
1. {concrete action — e.g. "Upgrade to Pro+ before June 1"}
2. {concrete action — e.g. "Set per-user budget caps in org settings"}
3. {concrete action — e.g. "Scope agent sessions to specific files"}
4. Review usage again in the week of June 8 after live billing begins.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.