vscode-theme-to-zed
Pass
Audited by Gen Agent Trust Hub on Sep 26, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes external VS Code theme files and
package.jsonmetadata which are untrusted data sources. - Ingestion points: Reads extension metadata and theme JSON files from
~/.vscode/extensionsand similar paths in the home directory. - Boundary markers: Absent; no specific instructions to treat theme content as untrusted data.
- Capability inventory: Script generation/execution (Python), file system writes to
~/.config/zed/themes/, and reading logs from~/Library/Logs/Zed/. - Sanitization: The skill includes a validation step for color strings using a regex (
^#[0-9A-Fa-f]{6}([0-9A-Fa-f]{2})?$) before writing the output file. - [DYNAMIC_EXECUTION]: The skill requires the agent to write and execute a custom Python script to perform the data conversion between theme formats.
- [COMMAND_EXECUTION]: The skill instructions involve searching specific directories in the user's home folder (
~/.vscode,.cursor,.windsurf) and reading application logs (Zed.log) to verify results.
Audit Metadata