vscode-extension

Pass

Audited by Gen Agent Trust Hub on Sep 25, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • Command Execution: The skill involves executing local build scripts (build.sh, build.ps1), project builds via dotnet, and package management tasks using yarn. These are standard activities for extension development and debugging within a local environment.
  • External Dependency Management: It uses yarn and corepack to manage and install Node.js dependencies. It also references the use of the .NET SDK and a specific package feed (dotnet-public-npm) for resolving dependencies, which is a common practice in enterprise development environments to ensure build consistency.
  • Indirect Prompt Injection Surface: As a development and debugging tool, the skill processes workspace files, CLI outputs, and test results. While this creates a surface for processing data from the codebase, it is a necessary component of the skill's primary function to investigate extension behavior, and the skill provides explicit instructions to redact sensitive data before sharing logs or screenshots.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 25, 2026, 09:12 PM