devcontainer-helper
Pass
Audited by Gen Agent Trust Hub on Oct 15, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: No malicious patterns, obfuscation, or unauthorized access attempts were detected. The skill serves its stated purpose of assisting with
devcontainer.jsonconfiguration. - [EXTERNAL_DOWNLOADS]: The skill references container images and features from
mcr.microsoft.com(Microsoft Container Registry) andghcr.io(GitHub Container Registry). These are well-known and trusted sources for development environment components. - [INDIRECT_PROMPT_INJECTION]: The skill functions as a configuration generator based on user requirements. While it ingests untrusted user input to determine which tools and features to include, the resulting output is a static configuration file meant for user review and project setup rather than automated high-privilege execution.
- Ingestion points: User-provided requirements for languages, tools, extensions, and base images.
- Boundary markers: None explicitly defined in the instructions.
- Capability inventory: Generation of
devcontainer.jsonand related Docker configurations. - Sanitization: Not explicitly implemented; the skill relies on the agent's logic to transform user requests into valid JSON configuration.
Audit Metadata