vscode-extension
Pass
Audited by Gen Agent Trust Hub on Jun 18, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill provides instructions for installing the Couchbase extension via the VS Code CLI using
code --install-extension Couchbase.vscode-couchbase. It also includes a diagnostic commandcurl http://localhost:8091/poolsto verify local cluster availability, which targets the whitelisted localhost domain. - [EXTERNAL_DOWNLOADS]: The skill references the official VS Code Marketplace and the
Couchbase-EcosystemGitHub repository for extension source code and installation. These resources are well-known and consistent with the vendor's identity. - [INDIRECT_PROMPT_INJECTION]: The skill describes an MCP server integration that allows AI assistants to interact with database clusters. This creates a surface for indirect prompt injection where data stored in the database could influence agent behavior.
- Ingestion points: Data retrieved from Couchbase collections and documents via the MCP server.
- Boundary markers: Not explicitly defined in the skill instructions.
- Capability inventory: The MCP server supports reading/writing documents and executing SQL++ queries.
- Sanitization: The skill does not define specific sanitization logic, as it provides instructions for using an external tool (the VS Code extension) which manages its own security context and permissions.
Audit Metadata