Security-first when developing GitHub Copilot Skills. Here's how to meet enterprise requirements and compliance standards.

Security Basics

Understanding Attack Vectors

Input Injection:

• Malicious Prompts
• Parameter Manipulation
• Code Injection

Data Leakage:

• Sensitive data in responses
• Logging of secrets
• Caching issues

Authentication Bypass:

• Token theft
• Session hijacking
• Privilege escalation

Authentication Best Practices

OAuth 2.0 Implementation

const authConfig = {
  authority: 'https://login.microsoftonline.com/{tenant}',
  clientId: process.env.CLIENT_ID,
  clientSecret: process.env.CLIENT_SECRET,
  scopes: ['api://copilot-skill/.default']
};

const tokenProvider = new ConfidentialClientApplication(authConfig);

Token Validation

const validateToken = async (token: string) => {
  const decoded = jwt.verify(token, publicKey, {
    algorithms: ['RS256'],
    issuer: 'https://copilot.github.com',
    audience: 'your-skill-id'
  });
  
  if (decoded.exp < Date.now() / 1000) {
    throw new Error('Token expired');
  }
  
  return decoded;
};

Managed Identity (Azure)

import { DefaultAzureCredential } from '@azure/identity';

const credential = new DefaultAzureCredential();
// No secrets in code

Authorization

Role-Based Access Control

const checkPermission = (user: User, action: string) => {
  const permissions = {
    'admin': ['read', 'write', 'delete', 'deploy'],
    'developer': ['read', 'write'],
    'viewer': ['read']
  };
  
  return permissions[user.role]?.includes(action);
};

Attribute-Based Access Control

const canAccessResource = (user: User, resource: Resource) => {
  // Check department
  if (resource.department !== user.department) return false;
  
  // Check classification
  if (resource.classification > user.clearanceLevel) return false;
  
  return true;
};

Input Validation

Parameter Sanitization

import { z } from 'zod';

const querySchema = z.object({
  searchTerm: z.string()
    .max(200)
    .regex(/^[a-zA-Z0-9\s-]+$/),
  limit: z.number()
    .int()
    .min(1)
    .max(100)
});

const validateInput = (params: unknown) => {
  return querySchema.safeParse(params);
};

SQL Injection Prevention

// Never do this:
const query = `SELECT * FROM users WHERE name = '${userInput}'`;

// Always do this:
const result = await db.query(
  'SELECT * FROM users WHERE name = $1',
  [userInput]
);

Audit Logging

What to Log?

interface AuditLog {
  timestamp: Date;
  userId: string;
  action: string;
  resource: string;
  parameters: object; // Without sensitive data!
  result: 'success' | 'failure';
  duration: number;
  clientIp: string;
}

How to Log?

const auditLogger = async (log: AuditLog) => {
  // Remove sensitive data
  const sanitized = removeSensitiveData(log);
  
  // Send to SIEM
  await siemClient.send(sanitized);
  
  // Local retention
  await writeToSecureStorage(sanitized);
};

Compliance Requirements

SOC 2

Trust Principles:

• Security – Access control
• Availability – Uptime monitoring
• Confidentiality – Data encryption
• Processing Integrity – Input validation
• Privacy – Data minimization

GDPR / DSG

Requirements:

• Data minimization
• Purpose limitation
• Deletion concept
• Right to access

Implementation: ``typescript // Do not collect unnecessary data const minimalResponse = { id: user.id, name: user.displayName // Not: email, phone, address... }; ``

Secrets Management

Azure Key Vault

import { SecretClient } from '@azure/keyvault-secrets';

const client = new SecretClient(
  'https://my-vault.vault.azure.net/',
  new DefaultAzureCredential()
);

const apiKey = await client.getSecret('external-api-key');

GitHub Secrets

# In GitHub Actions
- name: Run Skill
  env:
    API_KEY: ${{ secrets.API_KEY }}

Security Testing

SAST

# Code analysis
npm run lint:security
snyk code test

DAST

# Runtime tests
npm run test:security
owasp-zap scan

Penetration Testing

• Annual external audits
• Bug bounty program
• Red team exercises

Incident Response

Playbook

1. 1Detect – Anomaly detected
2. 2Contain – Disable skill
3. 3Investigate – Analyze logs
4. 4Remediate – Deploy fix
5. 5Recover – Restore service
6. 6Learn – Post-mortem

CNEXT Security Services

We offer:

1. 1Security Review – Skill audit
2. 2Compliance Assessment – Gap analysis
3. 3Penetration Testing – Identify vulnerabilities
4. 4Incident Response – Incident support

Conclusion

Security is not a feature but a foundation. With these practices, you can develop Copilot Skills that meet enterprise requirements.