You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
CodeRabbit raised a 🟠 Major Security & Privacy finding on plugins/github/skills/github-issues/references/milestones.md:27
(#115): the documented pattern
gh api repos/{owner}/{repo}/milestones -X POST -f title="Milestone title"
shows an agent how to build a gh call by substituting a value into a double-quoted shell
string, where $, backticks and \ expand. An agent following it literally with a user-supplied
title can be induced to expand a variable or break out of the quoting.
Why it could not be fixed where it was found
The skill is a synced artifact, not an authoring surface here — its frontmatter carries metadata.github-repo: https://github.com/github/awesome-copilot, and the update-agent-skills
workflow re-pulls it. An edit committed in this repository is overwritten on the next sync with no
conflict, no CI failure and no signal, so it would read as fixed while changing nothing.
The upstream is a third party, so proposing the fix there is gated on the maintainer confirming
the repository is unrelated to professional work and explicitly approving an upstream issue/PR.
Audience and impact
Every agent in this deployment that loads the bundled github-issues skill. Impact is bounded — this
deployment's own contract already forbids untrusted content from determining tool arguments — but the
bundled doc teaches the unsafe shape without the caveat, which is exactly the kind of instruction
drift a marketplace bundle should not propagate.
Options
Ask upstream — propose the hardening to github/awesome-copilot. Needs the two approvals above.
Local hardening layer — carry a deployment-side note/override so the synced doc is
accompanied by the quoting caveat without editing the synced file.
Accept — record that the deployment's own untrusted-input rule already covers it and close.
Acceptance criteria
A decision recorded among the three options above.
If (1) or (2): the change shipped and verified to survive an update-agent-skills run.
Evidence
CodeRabbit raised a 🟠 Major Security & Privacy finding on
plugins/github/skills/github-issues/references/milestones.md:27(#115): the documented pattern
gh api repos/{owner}/{repo}/milestones -X POST -f title="Milestone title"shows an agent how to build a
ghcall by substituting a value into a double-quoted shellstring, where
$, backticks and\expand. An agent following it literally with a user-suppliedtitle can be induced to expand a variable or break out of the quoting.
Why it could not be fixed where it was found
The skill is a synced artifact, not an authoring surface here — its frontmatter carries
metadata.github-repo: https://github.com/github/awesome-copilot, and theupdate-agent-skillsworkflow re-pulls it. An edit committed in this repository is overwritten on the next sync with no
conflict, no CI failure and no signal, so it would read as fixed while changing nothing.
The upstream is a third party, so proposing the fix there is gated on the maintainer confirming
the repository is unrelated to professional work and explicitly approving an upstream issue/PR.
Audience and impact
Every agent in this deployment that loads the bundled
github-issuesskill. Impact is bounded — thisdeployment's own contract already forbids untrusted content from determining tool arguments — but the
bundled doc teaches the unsafe shape without the caveat, which is exactly the kind of instruction
drift a marketplace bundle should not propagate.
Options
github/awesome-copilot. Needs the two approvals above.accompanied by the quoting caveat without editing the synced file.
Acceptance criteria
update-agent-skillsrun.Rough size: S (decision) + S–M (whichever path is chosen).