Verified against GitHub Copilot CLI · 2026-08-04
Pair gh copilot suggest with explain before running anything it returns
A suggest-then-explain pairing for GitHub Copilot in the CLI that treats the returned command as a claim to check against a stated risk tolerance, not something to paste and run the moment it looks plausible.
The prompt
Ready to copy — highlighted parts are example details you can swap.
Run this through GitHub Copilot in the CLI: gh copilot suggest -t shell "find all files larger than 50MB in this repo and list them by size" WHY TWO SEPARATE CALLS suggest and explain are two distinct invocations of the model, not one command with two outputs — asking explain to independently interpret the exact string suggest returned gives you a second, independently generated read of the same command, which can catch something the first generation's own one-line description happened to omit. Before running whatever command it returns, run gh copilot explain on the exact string it suggested — a second, separate call to the model specifically asked what does this actually do, not a restatement of the one-line description suggest already gave you — and check that explanation against the context below before touching a real terminal with it. ENVIRONMENT THIS WILL RUN AGAINST Running locally on a laptop, inside a git repo with uncommitted changes I have not backed up yet. SHELL Git Bash on Windows 11 RISK TOLERANCE FOR THIS SPECIFIC TASK Read-only operations are fine. Anything that deletes, moves, or overwrites a file needs a narrower, explicitly scoped alternative. DO NOT RUN THE SUGGESTED COMMAND IF THE EXPLANATION SURFACES ANY OF THE FOLLOWING THAT YOU DID NOT EXPLICITLY ASK FOR - A recursive delete of any kind. - A force push, or any rewrite of already-shared git history. - A change to a file's permission or ownership bits. - A write, move, or delete reaching outside the current working directory. - A network call to a destination not named in find all files larger than 50MB in this repo and list them by size. IF THE EXPLANATION FLAGS ONE OF THOSE Ask gh copilot suggest again, this time stating explicitly in the follow-up prompt which of the items above the first suggestion crossed and asking for a narrower alternative that stays within Read-only operations are fine. Anything that deletes, moves, or overwrites a file needs a narrower, explicitly scoped alternative. — do not manually edit the flagged command yourself and run your own modified version, since a hand-edited version of a command you did not fully trust in the first place has not actually been explained or verified at all; it has just been changed based on a guess about which part was the risky one. IF THE EXPLANATION CONFIRMS THE COMMAND IS SAFE WITHIN Read-only operations are fine. Anything that deletes, moves, or overwrites a file needs a narrower, explicitly scoped alternative. Run it as suggested. Do not add your own extra flags or arguments to the confirmed command before running it — anything added after the explanation step is a command that was never actually explained, even if it looks like a small addition to one that was. Git Bash on Windows 11 DIFFERENCES TO WATCH FOR If Git Bash on Windows 11 is not a standard POSIX shell, check the explanation specifically for whether the suggested syntax — quoting, glob expansion, path separators — actually matches this shell's own rules rather than the POSIX conventions the suggestion may have been generated against by default.
Customize
Optional — swap in your own details for the highlighted parts above.
Why this works
gh copilot suggest generates a shell, git, or gh CLI command from a natural-language description, but it returns that command for a human to run manually — the CLI extension is deliberately built with that separation, since a wrong command against a real filesystem or a real git remote is not something anyone wants auto-executed on the strength of a natural-language description alone. Pairing it with gh copilot explain on the exact returned string, rather than trusting the one-line description suggest already produced, matters because suggest and explain are genuinely two separate calls to the model, generated independently — asking a second time, specifically what does this do, is a documented way to surface a side effect the first generation's own gloss omitted, precisely because the first generation was optimized for producing a plausible command, not for exhaustively describing every consequence of running it. Naming a risk tolerance up front and pre-committing to a fixed reject list — recursive delete, force push, permission changes, writes outside the working directory, an unnamed network destination — turns read the explanation carefully into a checkable gate applied the same way every single time, rather than relying on catching a dangerous flag through attentiveness alone in the moment right before running something, which is exactly the moment attention is weakest because the command already looks done and ready to paste. Refusing to hand-edit a flagged command and run the edited version instead of re-requesting a fresh suggestion closes a specific trap: an edit made to fix the one part that looked risky is a guess about which part was actually the problem, made by someone who by definition did not fully understand the original command well enough to have trusted it in the first place — a fresh suggestion, re-explained, is verified; a hand-patched one is not, no matter how small the edit looks. The shell-specific check exists because a command's explanation can be entirely accurate about what the command does in the shell it was generated against while still behaving differently in this one — quoting and glob rules are not universal across shells, and a suggestion generated with POSIX defaults in mind does not automatically carry a warning label when run somewhere those defaults do not hold.
What you get back
gh copilot suggest returns a command that finds files larger than 50MB and lists them by size using find piped through sort. gh copilot explain confirms this is read-only — it lists matching files without modifying anything — so it clears the reject list and is safe to run as suggested.
Verified against
GitHub Copilot CLI gh-copilot extension 1.9 · 2026-08-04
Changelog
- 2026-08-04 — Initial publish, verified against the gh-copilot CLI extension 1.9.
Need this built into your business?
If a prompt isn't enough — custom software, built and maintained for you — that's Scult's day job.
EXPLORE CUSTOM SOFTWARE
