launch-vscode-extension
Pass
Audited by Gen Agent Trust Hub on Oct 12, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [Command Execution]: The skill uses shell commands to manage VS Code instances and extension builds. While these are standard for automation, direct process management and shell interaction should be reviewed to ensure they stay within intended scopes. Evidence: The use of kill, ps, and grep to manage debug processes in SKILL.md.
- [Dynamic Execution]: The use of the agent-browser eval command allows for executing JavaScript within the VS Code UI context to interact with complex elements like the Monaco editor. This provides a powerful interface for UI manipulation that should be monitored. Evidence: Multiple instances of agent-browser eval for focusing and verifying text in Monaco editors.
- [Indirect Prompt Injection Surface]: The skill retrieves accessibility snapshots of the VS Code UI. If the content being automated contains specific instructions, it could influence the agent's behavior. Evidence Chain: (1) Ingestion points: UI snapshots via agent-browser snapshot. (2) Boundary markers: None identified. (3) Capability inventory: Bash shell access and JS evaluation. (4) Sanitization: Direct UI interaction without explicit snapshot filtering.
- [Local Data Persistence]: A dedicated directory (.vscode-ext-debug) is used to store user data profiles and screenshots. This ensures that authentication sessions and debugging state are preserved between runs, though it requires management of local storage. Evidence: The use of --user-data-dir pointing to a local path in the project root.
Audit Metadata