skills/microsoft/vscode/launch/Gen Agent Trust Hub

launch

Pass

Audited by Gen Agent Trust Hub on May 12, 2026

Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
  • [Command Execution]: The skill uses shell commands to manage the VS Code lifecycle, including starting the application (./scripts/code.sh), identifying listening ports (lsof), and terminating processes (kill). These are standard operations for development and automation workflows.
  • [Local Network Interaction]: It utilizes the Chrome DevTools Protocol (CDP) on local ports (e.g., 9224) to attach Playwright to the VS Code instance. This is a common and legitimate method for browser-based application automation.
  • [Dynamic Execution]: The skill employs npx @playwright/cli eval to execute JavaScript snippets within the automated application's context. This is the primary mechanism for interacting with the VS Code UI and is used here for legitimate automation tasks such as element selection and state verification.
  • [Temporary File Usage]: Screenshots are stored in /tmp/code-oss-screenshots/. This is a standard practice for managing transient data during automation runs, though users should be aware that screenshots might capture sensitive information visible in the UI.
Audit Metadata
Risk Level
SAFE
Analyzed
May 12, 2026, 08:39 AM
Security Audit — agent-trust-hub — launch