vscode-extension

Pass

Audited by Gen Agent Trust Hub on Jun 18, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill provides instructions for installing the Couchbase extension via the VS Code CLI using code --install-extension Couchbase.vscode-couchbase. It also includes a diagnostic command curl http://localhost:8091/pools to verify local cluster availability, which targets the whitelisted localhost domain.
  • [EXTERNAL_DOWNLOADS]: The skill references the official VS Code Marketplace and the Couchbase-Ecosystem GitHub repository for extension source code and installation. These resources are well-known and consistent with the vendor's identity.
  • [INDIRECT_PROMPT_INJECTION]: The skill describes an MCP server integration that allows AI assistants to interact with database clusters. This creates a surface for indirect prompt injection where data stored in the database could influence agent behavior.
  • Ingestion points: Data retrieved from Couchbase collections and documents via the MCP server.
  • Boundary markers: Not explicitly defined in the skill instructions.
  • Capability inventory: The MCP server supports reading/writing documents and executing SQL++ queries.
  • Sanitization: The skill does not define specific sanitization logic, as it provides instructions for using an external tool (the VS Code extension) which manages its own security context and permissions.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 18, 2026, 09:28 AM
Security Audit — agent-trust-hub — vscode-extension