vscode-extension
Pass
Audited by Gen Agent Trust Hub on Sep 25, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- Command Execution: The skill involves executing local build scripts (
build.sh,build.ps1), project builds viadotnet, and package management tasks usingyarn. These are standard activities for extension development and debugging within a local environment. - External Dependency Management: It uses
yarnandcorepackto manage and install Node.js dependencies. It also references the use of the .NET SDK and a specific package feed (dotnet-public-npm) for resolving dependencies, which is a common practice in enterprise development environments to ensure build consistency. - Indirect Prompt Injection Surface: As a development and debugging tool, the skill processes workspace files, CLI outputs, and test results. While this creates a surface for processing data from the codebase, it is a necessary component of the skill's primary function to investigate extension behavior, and the skill provides explicit instructions to redact sensitive data before sharing logs or screenshots.
Audit Metadata