drivable-vscode
Pass
Audited by Gen Agent Trust Hub on Sep 2, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes live state from a VS Code instance via the
observetool, which presents a surface for indirect prompt injection if the VS Code UI displays malicious content. - Ingestion points: The
observetool inSKILL.mdingests screenshots and text/ARIA state from the active VS Code session. - Boundary markers: No explicit boundary markers or instruction-ignoring delimiters are mentioned for the UI content ingested into the agent context.
- Capability inventory: The skill provides the agent with capabilities to perform UI actions (
act), manage sessions (start,finish), and record reproduction steps (add_finding). - Sanitization: Documentation indicates that text artifacts redact common credentials, but visual media (screenshots and video) do not include redaction mechanisms.
- [COMMAND_EXECUTION]: The setup instructions involve executing local development commands to install and compile vendor-provided code.
- Evidence:
npm installandnpm run compile -w @salesforce/drivable-vscodeare used to prepare the environment for the MCP server.
Audit Metadata