AI SECURITYLABS

Security for Copilot Development: Check a repository before you trust it

Part 11 of 16

Check a repository before you trust it

Trusting a folder lets its configuration act for you. Before trusting a repository you didn’t create:

  • Read .vscode/settings.json and stop at anything touching chat.*, Workspace Trust or the sandbox.
  • Read .vscode/mcp.json, .mcp.json and .github/mcp.json: workspace MCP servers start as local processes once the folder is trusted.
  • Read the instruction files, agents and prompts in .github/, plus AGENTS.md and CLAUDE.md, and check them for hidden Unicode (Pillar Security).
  • Read .github/hooks/ and .github/copilot/settings.json, whose hooks and plugins apply to every Copilot CLI user.
  • List every symlink, and re-clone repositories that arrived with their own .git/config.