copilotkit

Savant verdict: Unsafe

Savant's security policy blocks importing this skill.

Live evaluation

Not evaluated yet. Workspaces can request a live evaluation.

Security assessment

81 patterns found

• Rogue Agent: Update Skillhigh · .github/workflows/update-skills.yml:1 · Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
• Rogue Agent: Update skillhigh · .github/workflows/update-skills.yml:65 · Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
• Rogue Agent: Update skillhigh · .github/workflows/update-skills.yml:66 · Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
• Rogue Agent: Update skillhigh · .github/workflows/update-skills.yml:326 · Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
• Rogue Agent: Update skillhigh · .github/workflows/update-skills.yml:332 · Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
• Rogue Agent: Update skillhigh · .github/workflows/update-skills.yml:367 · Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
• Tool Misuse: git push origin "$branch_name" else # No existing PR — create new branch git checkout -b "$branch_name" git add -A git commit -m "Update skillhigh · .github/workflows/update-skills.yml:327 · Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
• Rogue Agent: self-updatehigh · CLAUDE.md:14 · Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
• Rogue Agent: self-updatehigh · SKILL.md:27 · Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
• Rogue Agent: self-updatehigh · SKILL.md:27 · Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Structure

• 4 referenced files aren't in the packageskills/copilotkit-setup/SKILL.md, skills/copilotkit-integrations/SKILL.md, skills/copilotkit-upgrade/SKILL.md, skills/copilotkit-self-update/SKILL.md. They may be binary, too large to catalog, or missing upstream.
• Ships 6 executable scriptshooks/auto-approve-copilotkit.sh, scripts/detect-new-integrations.sh, scripts/install.sh, scripts/mcp-query.sh, scripts/regenerate-lock.sh, …. Review what they do before enabling the skill for agents with tool access.
• The source hub's security checks flagged this skillSocket: warn (2 alerts: gptAnomaly); Snyk: warn (Risk: MEDIUM · 2 issues); ZeroLeaks: warn (Scan incomplete)

SKILL.md

---
name: copilotkit
description: Use when building with CopilotKit — setup, development, integrations, debugging, upgrading, or contributing. Routes to the appropriate specialized skill based on the task.
user_invocable: true
argument_hint: "<task>"
---

Route to the appropriate sub-skill based on the user's task. If the task is ambiguous, ask one clarifying question before routing.

## Quickstart (default path)

If the user wants to add CopilotKit to their project, or the request is general/unclear, route here:

**[copilotkit-setup](skills/copilotkit-setup/SKILL.md)** — Install packages, configure the runtime, wire up the provider, get a working chat UI.

## Routing Table

| Task | Sub-skill |
|------|-----------|
| Initial setup, installation, adding CopilotKit to a project | [copilotkit-setup](skills/copilotkit-setup/SKILL.md) |
| Building features — frontend tools, shared state, generative UI, actions | [copilotkit-develop](skills/copilotkit-develop/SKILL.md) |
| Connecting agent frameworks — LangGraph, CrewAI, Mastra, Pydantic AI, etc. | [copilotkit-integrations](skills/copilotkit-integrations/SKILL.md) |
| Debugging errors, fixing runtime issues, troubleshooting | [copilotkit-debug](skills/copilotkit-debug/SKILL.md) |
| Upgrading versions, migrating between APIs | [copilotkit-upgrade](skills/copilotkit-upgrade/SKILL.md) |
| AG-UI protocol — building custom backends, event streaming, debugging protocol issues | [copilotkit-agui](skills/copilotkit-agui/SKILL.md) |
| Contributing to the CopilotKit repo | [copilotkit-contribute](skills/copilotkit-contribute/SKILL.md) |
| Update/refresh these skills, skills seem stale or wrong | [copilotkit-self-update](skills/copilotkit-self-update/SKILL.md) |

## MCP Documentation Server

The `copilotkit-docs` MCP server at `mcp.copilotkit.ai/mcp` provides live documentation search. Use its tools for up-to-date reference material:

- `search-docs` — search CopilotKit documentation by topic
- `search-code` — search CopilotKit source code and examples
- `search-ag-ui-docs` — search AG-UI protocol documentation
- `search-ag-ui-code` — search AG-UI TypeScript SDK source

Prefer MCP lookups over hardcoded knowledge when answering specific API or configuration questions.