GitHub Copilot CLI - AI 代码分析

This is an instruction-only Copilot CLI helper and is broadly consistent with its purpose, but it instructs the agent to read a local file (~/.copilot/github_token.txt) to obtain your COPILOT_GITHUB_TOKEN while not declaring that credential — treat this as a transparency issue. Before installing or using: (1) verify you trust the copilot-cli package from Homebrew and confirm its origin; (2) avoid storing tokens in plaintext files where possible — use the platform's secret store or an environment variable set by you at runtime; (3) if you must use a file-stored token, create a dedicated token with the minimal scopes needed and restrict file permissions; (4) prefer to supply the token via your agent platform's secret mechanism rather than letting an agent run cat on your home directory. If you want stronger assurance, ask the skill author to declare the required credential in metadata and to provide a safer authentication example (prompting the user or using a secret store) instead of reading a file path.

Type: OpenClaw Skill Name: macclaw-copilot-cli Version: 1.0.2 The skill is classified as suspicious due to its direct access to a sensitive credential file (`~/.copilot/github_token.txt`) within `SKILL.md`. While this action is plausibly needed for the stated purpose of using the GitHub Copilot CLI, accessing credential files represents a risky capability. There is no evidence of malicious intent such as exfiltration or unauthorized use of the token, but the direct handling of sensitive data elevates it beyond benign.