The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill implements a template for AI agent integration that is vulnerable to indirect prompt injection due to its ingestion of untrusted external data and powerful file-system capabilities.
Ingestion points: The FileBridge class in assets/file-bridge/src/fileBridge.ts watches and reads JSON command files from the .vscode/ai-bridge/commands/ directory, which is intended to be written to by external AI agents.
Boundary markers: The mechanism uses JSON as a structural boundary but lacks semantic boundary markers or instructions to prevent the agent from executing malicious commands delivered through this channel.
Capability inventory: The extension template in assets/file-bridge/src/extension.ts provides handlers for readFile (allowing file content extraction), writeFile (allowing file creation/modification), and executeCommand (restricted via whitelist).
Sanitization: The readFile and writeFile handlers in the template implementation (assets/file-bridge/src/extension.ts) fail to sanitize or validate the params.filePath input, allowing potential access to any file the VS Code process can reach. This implementation is less secure than the best-practice examples documented in references/ai-integration.md.

vscode-extension-builder-lawvable