Skills
Navigate
skills/full-stack-skills/vscode-skills/vscode-feature-webview/Gen Agent Trust Hub

vscode-feature-webview

Pass

Audited by Gen Agent Trust Hub on Oct 8, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill provides a template for VS Code extensions to render HTML content in webviews, which creates a potential surface for XSS if untrusted data is displayed.
  • Ingestion points: The currentPanel.webview.html property in the TypeScript template in SKILL.md is the target for HTML content.
  • Boundary markers: The template does not provide explicit boundary markers or sanitization logic for dynamic content.
  • Capability inventory: Uses the vscode.window.createWebviewPanel API to render UI and enables script execution via enableScripts: true.
  • Sanitization: The skill includes a 'Security Note' recommending the use of Content Security Policy (CSP) and the vscode-resource: scheme for production use.
  • [EXTERNAL_DOWNLOADS]: The HTML template includes a reference to an external image from a well-known media service.
  • Evidence: Fetches a GIF from Giphy (https://media.giphy.com/media/JIX9t2j0ZTN9S/giphy.gif) in the getWebviewContent function in SKILL.md.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 8, 2026, 04:41 AM