All skills & plugins / Awesome Copilot plugins (GitHub)

github-security

Security extension for GitHub Copilot App with a canvas to work on GHAS findings.

Type: Plugin
Catalog: Awesome Copilot plugins (GitHub)
Source: github/awesome-copilot/plugins/github-security (73 files scanned)
Install and details: Agent Skills Index entry
License: not stated in the folder or manifest (the repository license may apply)
Signals: Bundled scriptsNetwork calls in codeSpawns processes

Pre-approved tools

No allowed-tools or tools list in its SKILL.md, command or agent files, so the agent asks before using tools as usual.

Hooks

No hooks.

MCP servers and apps

None.

Bundled code

61 code files (JavaScript); first 40 listed:

Network calls

2 files with a network call pattern. First match per file:

extensions/github-security/extension.mjs:173

const response = await fetch(new URL(url, this.apiBaseUrl).toString(), {

extensions/github-security/assets/php-CFAKXfaU.js:8

var lang = Object.freeze(JSON.parse("{\"displayName\":\"PHP\",\"name\":\"php\",\"patterns\":[{\"include\":\"#attribute\"},{\"include\":\"#co

Starts other programs

2 files. First match per file:

extensions/github-security/extension.mjs:5

import { execFile } from "node:child_process";

extensions/github-security/assets/php-CFAKXfaU.js:8

var lang = Object.freeze(JSON.parse("{\"displayName\":\"PHP\",\"name\":\"php\",\"patterns\":[{\"include\":\"#attribute\"},{\"include\":\"#co

Credentials referenced

No key, token or secret environment variable found in code or MCP config.

Static scan of commit d75b418 on 2026-10-27. Signals are patterns found in the files, not a verdict: a network call can be the whole point of a skill. Read the linked lines before you decide. How the scan works.