vscode-react-webview-architecture
Pass
Audited by Gen Agent Trust Hub on Oct 12, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- Data Ingestion via Configuration: The skill outlines a standard architecture where webviews receive initial state from the extension host through
window.config?.__initialData. This data is processed usingJSON.parsewithin theuseConfigurationhook. This serves as the primary entry point for external data into the webview context. - Telemetry and Communication: The guidelines describe the use of a tRPC client for communication between the webview and the extension host. This includes standard operations such as fetching data (
trpcClient.myView.getData), reporting telemetry (trpcClient.common.reportEvent), and displaying UI notifications. These capabilities are used to facilitate expected application behavior. - Initialization Timing: A hardcoded delay is mentioned as a temporary measure to manage the initialization of Monaco Editor workers. While documented as a development task to be refined, it represents a controlled operational delay within the application lifecycle.
- UI Constraints: The
useSelectiveContextMenuPreventionhook is used to restrict the default browser context menu in specific areas of the webview. This is a common design pattern intended to provide a more integrated user experience within the VS Code environment.
Audit Metadata