security-scan

Audit Copilot CLI configurations for security vulnerabilities and misconfigurations.

19|4|Updated Mar 1, 2026

Search Tags:#security #vulnerability #audit #configuration #copilot #agent shield

Ready to run

npx skills add https://github.com/j7-dev/everything-github-copilot --skill security-scan-j7-dev

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: security-scan
Source: https://github.com/j7-dev/everything-github-copilot/tree/main/docs/ja-JP/skills/security-scan
Command: npx skills add https://github.com/j7-dev/everything-github-copilot --skill security-scan-j7-dev

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires ecc-agentshield, and includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill addresses the critical need to identify and mitigate security vulnerabilities within Copilot CLI configurations, preventing potential data breaches and unauthorized access.

Core Features & Use Cases

Vulnerability Detection: Scans .copilot/ configurations for hardcoded secrets, injection risks, and misconfigurations.
Compliance Auditing: Checks CLAUDE.md, settings.json, MCP servers, and agent definitions against security best practices.
Automated Remediation: Offers options to automatically fix identified security issues.
Use Case: Before committing changes to your Copilot CLI project, run this skill to ensure no sensitive API keys are exposed and that your agent permissions are strictly scoped, maintaining a secure development environment.

Quick Start

Run the security-scan skill to audit the current project's .copilot/ directory for security vulnerabilities.

Frequently Asked Questions about security-scan

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I scan Copilot CLI configurations for security vulnerabilities?▼

AgentShield detects prompt injection patterns and hardcoded secrets by auditing Copilot CLI configurations. It scans CLAUDE.md, settings.json, MCP servers, and agent definitions to identify injection risks, overly permissive access, and security misconfigurations.

Does the security audit check MCP servers and hooks for overly permissive access?▼

Yes, the security audit checks MCP servers and hooks for overly permissive access. It evaluates your Copilot CLI configurations against security best practices to ensure agent permissions are strictly scoped and safe.

Can I automatically fix misconfigurations found during a Copilot CLI security audit?▼

Yes, you can automatically fix misconfigurations found during a Copilot CLI security audit. The Skill provides detailed reports of identified vulnerabilities and offers optional automated remediation to resolve the security issues.

What do I need to audit my project's agent definitions for prompt injection risks?▼

To audit agent definitions for prompt injection risks, you need the AgentShield dependency installed in your environment. This allows the Skill to scan your .copilot/ directory and detect potentially malicious injection patterns.

When should I run a security scan on my Copilot CLI project?▼

You should run a security scan before committing changes to your Copilot CLI project. This ensures no sensitive API keys are exposed in your configurations and verifies that your agent permissions remain strictly scoped.