Imran Siddique and Copilot
03290d78d0
fix: add applyTo field to agent-safety instructions frontmatter
...
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com >
2026-02-18 14:51:18 -08:00
Imran Siddique and Copilot
070cb0222e
fix: address Copilot PR review comments on agent-governance skill
...
- Use context manager and path validation for file reading example
- Block directory traversal attacks with os.path.realpath check
- Update terminology: whitelist/blacklist -> allowlist/blocklist
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com >
2026-02-18 14:50:40 -08:00
Imran Siddique and Copilot
32d8f7f622
fix: address Copilot PR review comments on governance-audit hook
...
- Switch from colon to tab delimiter to handle colons in evidence text
- Base64-encode evidence to prevent parsing issues
- Use MAX_SEVERITY in log output and JSON events
- Narrow regex patterns to reduce false positives:
- third[_-]?party instead of third.?party
- Role reassignment scoped to AI terms
- System prompt injection requires 'you are' context
- Fix session-end stats to scope to current session only
- Update privacy statement to clarify evidence snippets are logged
- Rename credential description to 'Possible hardcoded credential'
- Fix database destruction regex to also match semicolons
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com >
2026-02-18 14:49:17 -08:00
Imran Siddique and Copilot
33b7464774
feat: add agent-safety instructions and governance reviewer agent
...
- instructions/agent-safety.instructions.md: Guidelines for building safe,
governed AI agent systems (tool access controls, content safety,
multi-agent safety, audit patterns, framework-specific notes)
- agents/agent-governance-reviewer.agent.md: Expert agent that reviews code
for governance gaps and helps implement policy enforcement
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com >
2026-02-18 13:30:30 -08:00
Imran Siddique and Copilot
4a4b9343d5
feat: add governance-audit hook — threat detection for Copilot sessions
...
Add real-time governance audit hook that scans prompts for threat signals:
- 5 threat categories: data exfiltration, privilege escalation,
system destruction, prompt injection, credential exposure
- 4 governance levels: open, standard, strict, locked
- Append-only JSON audit trail (logs/copilot/governance/audit.log)
- Session summary with threat counts at session end
- Privacy-aware: logs decisions and metadata, never prompt content
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com >
2026-02-18 13:29:41 -08:00
Imran Siddique and Copilot
dcfae78fa4
feat: add agent-governance skill
...
Add governance patterns and techniques for AI agent systems:
- Policy definition with allowlists, blocklists, and content filters
- Semantic intent classification for threat detection
- Tool-level governance decorator pattern
- Trust scoring with temporal decay for multi-agent systems
- Append-only audit trail design
- Framework integration examples (PydanticAI, CrewAI, OpenAI Agents)
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com >
2026-02-18 13:28:25 -08:00
Imran SiddiqueandCopilot