drivable-vscode

Pass

Audited by Gen Agent Trust Hub on Sep 2, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill processes live state from a VS Code instance via the observe tool, which presents a surface for indirect prompt injection if the VS Code UI displays malicious content.
  • Ingestion points: The observe tool in SKILL.md ingests screenshots and text/ARIA state from the active VS Code session.
  • Boundary markers: No explicit boundary markers or instruction-ignoring delimiters are mentioned for the UI content ingested into the agent context.
  • Capability inventory: The skill provides the agent with capabilities to perform UI actions (act), manage sessions (start, finish), and record reproduction steps (add_finding).
  • Sanitization: Documentation indicates that text artifacts redact common credentials, but visual media (screenshots and video) do not include redaction mechanisms.
  • [COMMAND_EXECUTION]: The setup instructions involve executing local development commands to install and compile vendor-provided code.
  • Evidence: npm install and npm run compile -w @salesforce/drivable-vscode are used to prepare the environment for the MCP server.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 2, 2026, 10:03 AM
Security Audit — agent-trust-hub — drivable-vscode