Skills
Navigate
skills/full-stack-skills/vscode-skills/vscode-project-init/Gen Agent Trust Hub

vscode-project-init

Pass

Audited by Gen Agent Trust Hub on Oct 8, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill downloads the yo and generator-code packages from the official npm registry using npx. These are established and well-known tools for VS Code extension development.
  • [COMMAND_EXECUTION]: Executes shell commands to scaffold project files and runs npm install to set up project dependencies.
  • [INDIRECT_PROMPT_INJECTION]: The skill incorporates a user-provided project name into a shell command. 1. Ingestion points: User input for project name in SKILL.md. 2. Boundary markers: None. 3. Capability inventory: Shell command execution via npx and npm. 4. Sanitization: None mentioned.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 8, 2026, 04:42 AM