github / github/copilot-cli

Powershell tools trigger security alerts

未關閉
#1,412 3 則留言 3 個 reaction 已指派 0 人 在 GitHub 檢視
area:platform-windows
主要語言
Shell
星號
11.2k
分支
1.9k
平均合併
14 小時 16 分鐘
30 天內合併 PR
6

描述

### Describe the bug

Whenever I use GitHub Copilot CLI I get IMs from Security Operations saying my machine is triggering alerts.
Specifically, it looks like Elastic has a [built-in rule](https://www.elastic.co/docs/reference/security/prebuilt-rules/rules/windows/defense_evasion_clearing_windows_console_history) called "Clearing Windows Console History" that looks for Powershell commands with `Set-PSReadLineOption` and `SaveNothing`. It appears GitHub Copilot CLI does this for at least some Powershell tool invocations.

### Affected version

GitHub Copilot CLI 0.0.406

### Steps to reproduce the behavior

1. Run a prompt that will invoke Powershell.
2. See a new process spawned `pwsh.exe -nop -nol -noe -c Set-PSReadLineOption -HistorySaveStyle SaveNothing`

### Expected behavior

GitHub Copilot CLI should not explicitly disable or clear Powershell command history

### Additional context

**Operating System:** Windows 11
**Terminal:** Windows Terminal
**Shell:** Powershell 7.5.4

貢獻指南

開啟貢獻指南

評估

這個 Issue 還沒有評估資料。

把新 issue 寄到你的電子郵件信箱

精選適合新手參與的 GitHub issue 摘要。