Your team uses a copilot-setup-steps.yml file to configure the environment that Copilot agent runs use during coding tasks. A security review finds that the file installs several npm packages using an unpinned 'latest' version tag and downloads a bash script from an external URL using curl | bash. Which change should be prioritized to harden this configuration?
Select an answer to reveal the explanation.
Short Explanation
You've got two notorious supply-chain attack vectors here: unpinned 'latest' dependencies and curl | bash. Pin packages to immutable hashes and swap curl | bash for a verified, checksummed download. That way, the agent's environment is built from exactly the software you reviewed, every single time.
Full Explanation
The copilot-setup-steps.yml file defines the trusted environment in which the Copilot agent executes. If this environment is compromised through supply-chain attacks, every agentic task run in that environment is compromised. Two specific vulnerabilities are present:
1. Unpinned 'latest' versions: An attacker who gains control of a package through typosquatting, account takeover, or publishing a malicious update can inject code that runs inside the agent's execution environment. Pinning to a specific version and, ideally, a content hash such as SHA-256 of the tarball prevents silent updates.
2. curl | bash: This pattern downloads and immediately executes a script without any verification. If the remote URL is compromised, updated, or returns different content based on user-agent or IP, arbitrary code runs in the agent's environment. The fix is to download first, verify the SHA-256 checksum against a known-good value, then execute.
Moving the copilot-setup-steps.yml file to a private repository prevents casual discovery but does nothing to protect against the two vulnerabilities, because attackers exploiting these vectors don't need to read the YAML file. Adding a comment warning maintainers not to use untrusted packages has zero security value. Requiring all npm packages to be published by verified npm authors is not a reliable signal, because account takeovers and malicious packages from verified accounts are documented attack patterns. The correct mitigation is hash-pinning and checksum verification.