Fix instruction file tells the agent to bypass its own controls in GitHub Copilot
An instruction file matches one of a small, enumerated set of shapes: disregarding prior instructions, skipping the permission prompt, exfiltrating credentials, or fetching and executing remote content. A heuristic over prose - it runs in `deep`, not in `quick`, and it can never exceed `possible`.
medium possible GitHub Copilot CWE-77 / ASI ASI01
The vulnerable pattern in GitHub Copilot
This finding comes from the GitHub Copilot fixture in the owlwarden test suite. This file is loaded into the model's context as authoritative. Text that asks it to act without the approval step is not a project instruction; it is an attempt to reach past whoever reviewed this file.
The corrected configuration
Remove it from `.github/copilot-instructions.md`. That file is prepended to every request, so a bypass instruction there applies to every completion anyone in the repository generates.
// .github/copilot-instructions.md
Use TypeScript. Prefer named exports.If you are not using GitHub Copilot
Delete the sentence. If it was written in good faith - a shortcut for a noisy prompt - say what the project actually needs instead: which commands are safe to run, which directories to leave alone. An instruction file should describe the project, never the agent's own controls.
Check your own repository
npx owlwarden scan
npx owlwarden explain agent-instructions-directiveRuns on your machine. No account, no telemetry, no network unless you ask. In CI, SARIF uploads to code scanning and the exit code is the gate.
Other GitHub Copilot checks
Rules with a tested GitHub Copilot example.
agent-instructions-directive for every agent host / All rules / owlwarden