Awesome/awesome-copilot
1
0
Fork 0
mirror of https://github.com/github/awesome-copilot.git synced 2026-08-13 12:49:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Add attester package-verification instruction and import-check hook

Browse Source 
The instruction tells Copilot to verify PyPI/npm package and symbol names
against the attester.dev existence oracle (free keyless tier, 25 calls/day
per client IP) before installing or importing, catching hallucinated
dependency names (5.2-21.7% of LLM suggestions per USENIX Security 2025).
The preToolUse hook enforces the same check on code the agent writes:
stdlib-only script, blocks only on a confident oracle negative, fails open
on quota or network trouble, caches answers on disk. README tables
regenerated with npm start.
This commit is contained in:
Mostafa Amini
2026-07-22 01:14:01 -04:00
parent 786bdcfc65
commit 1336ec4777
6 changed files with 406 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/README.hooks.md
+1
View File
@@ -31,6 +31,7 @@ See [CONTRIBUTING.md](../CONTRIBUTING.md#adding-hooks) for guidelines on how to
| Name | Description | Events | Bundled Assets |
| ---- | ----------- | ------ | -------------- |
| [Attester Import Check](../hooks/attester-import-check/README.md) | Verifies PyPI and npm package names against the attester.dev existence oracle before the Copilot coding agent writes them into code, blocking hallucinated dependencies | preToolUse | `check-imports.py`<br />`hooks.json` |
| [Dependency License Checker](../hooks/dependency-license-checker/README.md) | Scans newly added dependencies for license compliance (GPL, AGPL, etc.) at session end | sessionEnd | `check-licenses.sh`<br />`hooks.json` |
| [Fix Broken Links](../hooks/fix-broken-links/README.md) | Checks changed web files for broken hyperlinks and SEO anchor issues after each Copilot tool use. | postToolUse | `hooks.json`<br />`link-fix.ps1`<br />`link-fix.sh` |
| [Governance Audit](../hooks/governance-audit/README.md) | Scans Copilot agent prompts for threat signals and logs governance events | sessionStart, sessionEnd, userPromptSubmitted | `audit-prompt.sh`<br />`audit-session-end.sh`<br />`audit-session-start.sh`<br />`hooks.json` |