plugin GitHub Copilot official · GitHub

github-security — GitHub Copilot plugin: what it does, how to install

Q: How to install github-security in GitHub Copilot?

Run `copilot plugin install github-security@awesome-copilot` from your configured marketplace, then open the Security canvas in a repository session.

Adds an interactive Security canvas to GitHub Copilot App for investigating GHAS code scanning alerts and local security findings.

Install into GitHub Copilot · Command from the source All methods and platforms ↓

copilot plugin install github-security@awesome-copilot

Open on GitHub

What github-security does

The plugin adds a dedicated Security canvas inside your repository session. You can inspect GitHub Advanced Security code scanning alerts alongside local security findings. From the canvas, Copilot explains the problem or generates a fix.

You need GitHub Copilot App to run it. Standalone Copilot CLI is not supported. Loading GHAS alerts requires repository access to code scanning in the linked GitHub account. Keep in mind that generated fixes require human review, as automated checks do not guarantee an exploit-free repository.

This extension makes sense if you manage security findings inside GitHub Copilot App and want to patch alerts without switching context.

What it helps with

inspect GHAS code scanning alerts inside an interactive canvas
ask Copilot to explain specific security findings
generate automated fixes for local security issues
recheck selected local code findings

Example prompts for the agent

Explain this code scanning alert
Fix the selected security finding
Recheck this local finding in the canvas

How to install github-security

Command from the source

copilot plugin install github-security@awesome-copilot

From the same set554

The whole set →

git-commit official github This skill reviews Git changes, stages related files, and creates Conventional Commits. Use it when you want an agent to make one commit or split work into separate commits. GitHub Copilot 47,165installs excalidraw-diagram-generator official github Turn a plain-language description into an Excalidraw diagram. Useful for mapping processes, system structure, and relationships between entities. GitHub Copilot 31,639installs multi-stage-dockerfile official github This skill guides GitHub Copilot in writing multi-stage Dockerfiles for different languages and frameworks. Use it when the final runtime image should contain fewer build dependencies. GitHub Copilot 29,688installs documentation-writer official github Skill that turns the agent into a technical writer following the Diátaxis framework: tutorials, how-to guides, reference, and explanation. Proposes structure before writing. GitHub Copilot 27,757installs prd official github Turns a feature idea into a structured PRD with user stories, technical requirements, and risks. Use it when planning a software feature or an AI-powered one. GitHub Copilot 24,035installs refactor official github This skill reshapes existing code without changing its external behavior. Use it for gradual cleanup of large functions, duplication, weak types, and code smells. GitHub Copilot 22,321installs java-springboot official github Gives GitHub Copilot Spring Boot development practices, from project layout to tests and security. Use it when writing or reviewing Java application code. GitHub Copilot 21,272installs create-readme official github This skill reviews a project and creates a structured README.md. Use it when the repository needs clear documentation based on its actual files and code. GitHub Copilot 19,081installs

Questions about github-security

How to install github-security in GitHub Copilot?

Run copilot plugin install github-security@awesome-copilot from your configured marketplace, then open the Security canvas in a repository session.

What does the github-security plugin do?

It provides a Security canvas inside GitHub Copilot App. You can inspect GHAS code scanning alerts, ask for explanations, and generate code fixes.

Does github-security work with standalone Copilot CLI?

No. The plugin requires GitHub Copilot App, and standalone Copilot CLI is not supported.

Source text

github-security · MIT

# Security extension

The Security extension for GitHub Copilot App provides a canvas for reviewing
GitHub Advanced Security code scanning alerts and local security findings.
Use the canvas to inspect findings and ask Copilot to explain, fix, or recheck
selected local findings.

## Requirements

- GitHub Copilot App. Standalone Copilot CLI is not supported.
- Access to code scanning alerts in the selected repository when loading
  GitHub Advanced Security findings.

## Getting started

Install the `github-security` plugin from your configured marketplace, then
open the **Security** canvas in a repository session. GitHub access uses the
repository's GitHub account in Copilot App.

Security findings and generated fixes require review; they do not guarantee
that a repository is free of vulnerabilities.

## Third-party notices

The bundled dependencies' versions, licenses, and notices are included with the
[extension](https://github.com/github/awesome-copilot/blob/main/extensions/github-security/THIRD_PARTY_NOTICES.md) and
[canvas](https://github.com/github/awesome-copilot/blob/main/extensions/github-security/client/THIRD_PARTY_NOTICES.md).