github

Security Findings (176)

• HighAS-003

  🔀Scope Mismatch

  get_copilot_space:tool name "get_copilot_space" implies read-only operation but declares exec permission

  Fix: Ensure tool names, descriptions, and permission declarations are internally consistent. Use explicit naming conventions that fully reflect actual capabilities.

• LowAS-011

  ℹ️Missing Rate-Limit / Timeout ×36

  tool performs network or execution operations but declares no rate-limit, timeout, or retry configuration

  actions_getactions_listactions_run_triggeradd_comment_to_pending_reviewadd_issue_commentadd_reply_to_pull_request_commentassign_copilot_to_issuecreate_gistcreate_or_update_filecreate_pull_requestcreate_pull_request_with_copilotcreate_repositoryget_copilot_job_statusget_copilot_spacegithub_support_docs_searchissue_readissue_writelabel_writelist_pull_requestsmerge_pull_requestprojects_getprojects_listprojects_writepull_request_readpull_request_review_writerequest_copilot_reviewsearch_codesearch_issuessearch_orgssearch_pull_requestssearch_repositoriessearch_userssub_issue_writeupdate_gistupdate_pull_requestupdate_pull_request_branch

  Fix: Declare explicit rate-limit, timeout, and retry configuration for all network and execution tools. Implement exponential back-off and surface resource state to the calling agent.

• LowAS-002

  ⚠️Excessive Permissions ×3

  input schema exposes 13 properties (threshold: 10)

  issue_write

  input schema exposes 11 properties (threshold: 10)

  list_global_security_advisories

  input schema exposes 15 properties (threshold: 10)

  projects_write

  Fix: Tool requests broad permissions (exec/fs/network). Validate input parameters using Enums where possible, and restrict file system operations to explicit allowed directories.

• InfoAS-002

  ⚠️Excessive Permissions ×49

  declared capabilities: HTTP requests

  actions_getactions_listactions_run_triggeradd_issue_commentissue_readprojects_getprojects_list

  declared capabilities: filesystem access, HTTP requests

  add_comment_to_pending_reviewissue_writeprojects_writesub_issue_write

  declared capabilities: network access, HTTP requests

  add_reply_to_pull_request_commentmerge_pull_requestpull_request_read

  declared capabilities: network access

  assign_copilot_to_issueget_copilot_job_statusgithub_support_docs_searchrequest_copilot_reviewsearch_codesearch_issuessearch_orgssearch_pull_requestssearch_repositories

  declared capabilities: filesystem access

  create_branchdelete_filefork_repositoryget_file_contentsget_meget_repository_treelist_discussionslist_issueslist_org_repository_security_advisorieslist_repository_security_advisorieslist_starred_repositoriespush_filesrun_secret_scanning

  declared capabilities: code/command execution, filesystem access

  create_gistcreate_repositoryupdate_gist

  declared capabilities: network access, filesystem access

  create_or_update_filecreate_pull_request_with_copilotlist_pull_requestssearch_usersupdate_pull_request_branch

  declared capabilities: network access, filesystem access, HTTP requests

  create_pull_requestpull_request_review_writeupdate_pull_request

  declared capabilities: code/command execution

  get_copilot_space

  declared capabilities: code/command execution, filesystem access, HTTP requests

  label_write

  Fix: Tool requests broad permissions (exec/fs/network). Validate input parameters using Enums where possible, and restrict file system operations to explicit allowed directories.

• InfoAS-014

  ℹ️Dependency Inventory Unavailable ×86

  Tool did not expose metadata.dependencies or repo_url, so supply-chain coverage is limited.

  actions_getactions_listactions_run_triggeradd_comment_to_pending_reviewadd_issue_commentadd_reply_to_pull_request_commentassign_copilot_to_issuecreate_branchcreate_gistcreate_or_update_filecreate_pull_requestcreate_pull_request_with_copilotcreate_repositorydelete_filedismiss_notificationfork_repositoryget_code_scanning_alertget_commitget_copilot_job_statusget_copilot_spaceget_dependabot_alertget_discussionget_discussion_commentsget_file_contentsget_gistget_global_security_advisoryget_job_logsget_labelget_latest_releaseget_meget_notification_detailsget_release_by_tagget_repository_treeget_secret_scanning_alertget_tagget_team_membersget_teamsgithub_support_docs_searchissue_readissue_writelabel_writelist_brancheslist_code_scanning_alertslist_commitslist_copilot_spaceslist_dependabot_alertslist_discussion_categorieslist_discussionslist_gistslist_global_security_advisorieslist_issue_typeslist_issueslist_labellist_notificationslist_org_repository_security_advisorieslist_pull_requestslist_releaseslist_repository_security_advisorieslist_secret_scanning_alertslist_starred_repositorieslist_tagsmanage_notification_subscriptionmanage_repository_notification_subscriptionmark_all_notifications_readmerge_pull_requestprojects_getprojects_listprojects_writepull_request_readpull_request_review_writepush_filesrequest_copilot_reviewrun_secret_scanningsearch_codesearch_issuessearch_orgssearch_pull_requestssearch_repositoriessearch_usersstar_repositorysub_issue_writetriage_issueunstar_repositoryupdate_gistupdate_pull_requestupdate_pull_request_branch

  Fix: Review and remediate the identified issue.

• InfoAS-010

  🔑Insecure Secret Handling

  list_secret_scanning_alerts:input parameter "secret_type" accepts a credential (informational; not evidence of insecure handling)

  Fix: Avoid accepting raw credentials as input parameters. Use secret managers (e.g. 1Password CLI, AWS Secrets Manager) and ensure credentials are never logged or stored in agent traces.