← Back to Skills Marketplace
cecwxf

Copilot Cli Skill

by saiph · GitHub ↗ · v1.0.0 · MIT-0
cross-platform ⚠ suspicious
336
Downloads
1
Stars
0
Active Installs
1
Versions
Install in OpenClaw
/install copilot-cli-skill
Description
Run GitHub Copilot CLI from OpenClaw for coding tasks in a target project directory. Use when the user asks OpenClaw to use Copilot for implementation, debug...
README (SKILL.md)

GitHub Copilot CLI Operator

Use this skill to reliably call Copilot CLI from OpenClaw.

Core rules

  1. Verify Copilot CLI exists (copilot --version) before first task.
  2. Always run Copilot through OpenClaw exec with pty:true.
  3. Always set explicit workdir to the target repository.
  4. For long tasks, use background:true and track via process.
  5. Report clear milestones: started, waiting-input, finished/failed.

Execution patterns

One-shot coding task

Use:

  • exec.command: copilot -p "\x3Ctask>" --allow-all-tools
  • exec.pty: true
  • exec.workdir: \x3Crepo path>

Scoped tool approval

Use --allow-tool and --deny-tool to control what Copilot can do:

  • exec.command: copilot -p "\x3Ctask>" --allow-tool 'shell(git)' --allow-tool 'write'
  • exec.pty: true
  • exec.workdir: \x3Crepo path>

To block dangerous operations:

  • copilot -p "\x3Ctask>" --allow-all-tools --deny-tool 'shell(rm)' --deny-tool 'shell(git push)'

Interactive session

Use:

  • exec.command: copilot
  • exec.pty: true
  • exec.workdir: \x3Crepo path>

Long-running background task

  1. Start with exec(background:true, pty:true, workdir, command:"copilot -p '...' --allow-all-tools")
  2. Record returned sessionId.
  3. Poll with process action:poll.
  4. Read output with process action:log.
  5. If Copilot asks for input, use process action:submit.

Resume a previous session

Use:

  • exec.command: copilot --resume (select from list)
  • exec.command: copilot --continue (resume most recent)

Recommended prompts

  • "Implement \x3Cfeature> with tests, run tests, and summarize changed files."
  • "Find root cause for failing CI in this repo and propose minimal fix."
  • "Review current branch diff and list high-risk issues first."
  • "Work on issue https://github.com/owner/repo/issues/123 in a new branch."
  • "Create a PR that updates the README with the latest API usage."

Guardrails

  • Do not claim files were changed unless logs show completion.
  • If copilot is missing or auth fails, return exact remediation steps.
  • Keep OpenClaw tool config (pty/workdir/background) separate from CLI args.
  • Prefer --allow-tool with specific scopes over --allow-all-tools for safety.
  • Use --deny-tool 'shell(rm)' when working in directories with important data.

References

  • references/copilot-doc-summary.md
  • references/copilot-usage-recipes.md
  • scripts/run-copilot-example.sh
Usage Guidance
This skill appears to do what it says (run the GitHub Copilot CLI), but there are transparency and safety gaps you should consider before installing or using it: - Runtime requirements: The metadata does not declare them, but the skill requires the 'copilot' binary and may use COPILOT_GITHUB_TOKEN/GH_TOKEN for authentication. Ensure you only provide tokens with the minimal scopes Copilot needs, and confirm the binary is installed from an official source. - Dangerous flags: Many examples use --allow-all-tools, which lets Copilot run arbitrary shell tools (including destructive commands). Prefer scoped --allow-tool flags, use --deny-tool (e.g., 'shell(rm)', 'shell(git push)'), and always set exec.workdir to a non-sensitive repository. - Session behavior: Background sessions and automated process polling can run for a long time — monitor session activity and logs to avoid unintended actions. - Metadata hygiene: Ask the publisher to update the skill metadata to declare required binaries and any env vars so you can make an informed decision. If you want to proceed: only run the skill in isolated repos or CI sandboxes until you confirm its behavior; avoid granting broad tokens or using --allow-all-tools by default; and prefer explicit, minimal tool approvals.
Capability Analysis
Type: OpenClaw Skill Name: copilot-cli-skill Version: 1.0.0 The skill provides a wrapper for the GitHub Copilot CLI, enabling an AI agent to perform complex coding and system tasks. It is classified as suspicious because the instructions in `SKILL.md` and `references/copilot-usage-recipes.md` explicitly encourage the use of high-risk execution flags like `--allow-all-tools`, which grants the underlying Copilot agent broad authority to execute shell commands and modify the filesystem. While these capabilities are necessary for the stated purpose, the lack of enforced safety boundaries and the promotion of full autonomy represent a significant security risk if the agent is targeted by prompt injection.
Capability Assessment
Purpose & Capability
The skill is clearly intended to run the GitHub Copilot CLI and the included files (SKILL.md, README, script) implement that. However the registry metadata claims no required binaries or env vars, while the instructions and example script explicitly require the 'copilot' binary and reference COPILOT_GITHUB_TOKEN/GH_TOKEN for authentication. The missing declaration of these runtime requirements is an incoherence (likely an oversight) that reduces transparency.
Instruction Scope
SKILL.md stays within the stated purpose (how to invoke copilot in a repo) but repeatedly recommends using --allow-all-tools and background sessions. --allow-all-tools grants Copilot CLI broad ability to run shell tools (including git, rm, push) which expands the skill's effective privileges beyond simple 'code assistance'. While the docs also mention using --deny-tool and preferring scoped --allow-tool, many examples default to allow-all, creating a real risk if the agent is used against sensitive directories or without strict workdir control.
Install Mechanism
This is an instruction-only skill with no install spec and includes a small helper script. There is no bundle download or remote install executed by the skill itself, which keeps on-disk modification risk low. The README simply references standard Copilot install commands (npm/brew/winget) but the skill does not perform installs.
Credentials
The registry metadata lists no required environment variables, but both the README and references mention COPILOT_GITHUB_TOKEN / GH_TOKEN / GITHUB_TOKEN as possible ways to authenticate Copilot. The skill's runtime behavior legitimately may need these tokens; their absence from declared requirements is an inconsistency and harms the user's ability to judge credential exposure. No unrelated credentials are requested, but the omission is notable.
Persistence & Privilege
The skill is not always-enabled and is user-invocable; it does not request persistent privileges or alter other skills. Autonomous invocation is allowed by platform default, but there's no 'always: true' or other elevated persistence in the manifest.
How to Use
  1. Make sure OpenClaw is installed (local or Docker)
  2. Run the install command in chat: /install copilot-cli-skill
  3. After installation, invoke the skill by name or use /copilot-cli-skill
  4. Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.0.0
Initial release
Metadata
Slug copilot-cli-skill
Version 1.0.0
License MIT-0
All-time Installs 0
Active Installs 0
Total Versions 1
Frequently Asked Questions

What is Copilot Cli Skill?

Run GitHub Copilot CLI from OpenClaw for coding tasks in a target project directory. Use when the user asks OpenClaw to use Copilot for implementation, debug... It is an AI Agent Skill for Claude Code / OpenClaw, with 336 downloads so far.

How do I install Copilot Cli Skill?

Run "/install copilot-cli-skill" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.

Is Copilot Cli Skill free?

Yes, Copilot Cli Skill is completely free, licensed under MIT-0. You can download, install and use it at no cost.

Which platforms does Copilot Cli Skill support?

Copilot Cli Skill is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).

Who created Copilot Cli Skill?

It is built and maintained by saiph (@cecwxf); the current version is v1.0.0.

💬 Comments