← 返回 Skills 市场
336
总下载
1
收藏
0
当前安装
1
版本数
在 OpenClaw 中安装
/install copilot-cli-skill
功能描述
Run GitHub Copilot CLI from OpenClaw for coding tasks in a target project directory. Use when the user asks OpenClaw to use Copilot for implementation, debug...
使用说明 (SKILL.md)
GitHub Copilot CLI Operator
Use this skill to reliably call Copilot CLI from OpenClaw.
Core rules
- Verify Copilot CLI exists (
copilot --version) before first task. - Always run Copilot through OpenClaw
execwithpty:true. - Always set explicit
workdirto the target repository. - For long tasks, use
background:trueand track viaprocess. - Report clear milestones: started, waiting-input, finished/failed.
Execution patterns
One-shot coding task
Use:
exec.command:copilot -p "\x3Ctask>" --allow-all-toolsexec.pty:trueexec.workdir:\x3Crepo path>
Scoped tool approval
Use --allow-tool and --deny-tool to control what Copilot can do:
exec.command:copilot -p "\x3Ctask>" --allow-tool 'shell(git)' --allow-tool 'write'exec.pty:trueexec.workdir:\x3Crepo path>
To block dangerous operations:
copilot -p "\x3Ctask>" --allow-all-tools --deny-tool 'shell(rm)' --deny-tool 'shell(git push)'
Interactive session
Use:
exec.command:copilotexec.pty:trueexec.workdir:\x3Crepo path>
Long-running background task
- Start with
exec(background:true, pty:true, workdir, command:"copilot -p '...' --allow-all-tools") - Record returned
sessionId. - Poll with
process action:poll. - Read output with
process action:log. - If Copilot asks for input, use
process action:submit.
Resume a previous session
Use:
exec.command:copilot --resume(select from list)exec.command:copilot --continue(resume most recent)
Recommended prompts
- "Implement \x3Cfeature> with tests, run tests, and summarize changed files."
- "Find root cause for failing CI in this repo and propose minimal fix."
- "Review current branch diff and list high-risk issues first."
- "Work on issue https://github.com/owner/repo/issues/123 in a new branch."
- "Create a PR that updates the README with the latest API usage."
Guardrails
- Do not claim files were changed unless logs show completion.
- If
copilotis missing or auth fails, return exact remediation steps. - Keep OpenClaw tool config (
pty/workdir/background) separate from CLI args. - Prefer
--allow-toolwith specific scopes over--allow-all-toolsfor safety. - Use
--deny-tool 'shell(rm)'when working in directories with important data.
References
references/copilot-doc-summary.mdreferences/copilot-usage-recipes.mdscripts/run-copilot-example.sh
安全使用建议
This skill appears to do what it says (run the GitHub Copilot CLI), but there are transparency and safety gaps you should consider before installing or using it:
- Runtime requirements: The metadata does not declare them, but the skill requires the 'copilot' binary and may use COPILOT_GITHUB_TOKEN/GH_TOKEN for authentication. Ensure you only provide tokens with the minimal scopes Copilot needs, and confirm the binary is installed from an official source.
- Dangerous flags: Many examples use --allow-all-tools, which lets Copilot run arbitrary shell tools (including destructive commands). Prefer scoped --allow-tool flags, use --deny-tool (e.g., 'shell(rm)', 'shell(git push)'), and always set exec.workdir to a non-sensitive repository.
- Session behavior: Background sessions and automated process polling can run for a long time — monitor session activity and logs to avoid unintended actions.
- Metadata hygiene: Ask the publisher to update the skill metadata to declare required binaries and any env vars so you can make an informed decision.
If you want to proceed: only run the skill in isolated repos or CI sandboxes until you confirm its behavior; avoid granting broad tokens or using --allow-all-tools by default; and prefer explicit, minimal tool approvals.
功能分析
Type: OpenClaw Skill
Name: copilot-cli-skill
Version: 1.0.0
The skill provides a wrapper for the GitHub Copilot CLI, enabling an AI agent to perform complex coding and system tasks. It is classified as suspicious because the instructions in `SKILL.md` and `references/copilot-usage-recipes.md` explicitly encourage the use of high-risk execution flags like `--allow-all-tools`, which grants the underlying Copilot agent broad authority to execute shell commands and modify the filesystem. While these capabilities are necessary for the stated purpose, the lack of enforced safety boundaries and the promotion of full autonomy represent a significant security risk if the agent is targeted by prompt injection.
能力评估
Purpose & Capability
The skill is clearly intended to run the GitHub Copilot CLI and the included files (SKILL.md, README, script) implement that. However the registry metadata claims no required binaries or env vars, while the instructions and example script explicitly require the 'copilot' binary and reference COPILOT_GITHUB_TOKEN/GH_TOKEN for authentication. The missing declaration of these runtime requirements is an incoherence (likely an oversight) that reduces transparency.
Instruction Scope
SKILL.md stays within the stated purpose (how to invoke copilot in a repo) but repeatedly recommends using --allow-all-tools and background sessions. --allow-all-tools grants Copilot CLI broad ability to run shell tools (including git, rm, push) which expands the skill's effective privileges beyond simple 'code assistance'. While the docs also mention using --deny-tool and preferring scoped --allow-tool, many examples default to allow-all, creating a real risk if the agent is used against sensitive directories or without strict workdir control.
Install Mechanism
This is an instruction-only skill with no install spec and includes a small helper script. There is no bundle download or remote install executed by the skill itself, which keeps on-disk modification risk low. The README simply references standard Copilot install commands (npm/brew/winget) but the skill does not perform installs.
Credentials
The registry metadata lists no required environment variables, but both the README and references mention COPILOT_GITHUB_TOKEN / GH_TOKEN / GITHUB_TOKEN as possible ways to authenticate Copilot. The skill's runtime behavior legitimately may need these tokens; their absence from declared requirements is an inconsistency and harms the user's ability to judge credential exposure. No unrelated credentials are requested, but the omission is notable.
Persistence & Privilege
The skill is not always-enabled and is user-invocable; it does not request persistent privileges or alter other skills. Autonomous invocation is allowed by platform default, but there's no 'always: true' or other elevated persistence in the manifest.
如何使用
- 确保已安装 OpenClaw(本地或 Docker 部署)
- 在对话框中输入安装命令:
/install copilot-cli-skill - 安装完成后,直接呼叫该 Skill 的名称或使用
/copilot-cli-skill触发 - 根据 Skill 的参数说明提供必要输入,即可获得结构化输出
版本历史
v1.0.0
Initial release
元数据
常见问题
Copilot Cli Skill 是什么?
Run GitHub Copilot CLI from OpenClaw for coding tasks in a target project directory. Use when the user asks OpenClaw to use Copilot for implementation, debug... 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件,目前累计下载 336 次。
如何安装 Copilot Cli Skill?
在 OpenClaw 或 Claude Code 对话框中运行命令「/install copilot-cli-skill」即可一键安装,无需额外配置。
Copilot Cli Skill 是免费的吗?
是的,Copilot Cli Skill 完全免费,采用 MIT-0 许可证,可自由下载、安装和使用。
Copilot Cli Skill 支持哪些平台?
Copilot Cli Skill 跨平台运行,可在任意部署了 OpenClaw / Claude Code 的环境中使用(cross-platform)。
谁开发了 Copilot Cli Skill?
由 saiph(@cecwxf)开发并维护,当前版本 v1.0.0。
推荐 Skills