launch
Pass
Audited by Gen Agent Trust Hub on May 12, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [Command Execution]: The skill uses shell commands to manage the VS Code lifecycle, including starting the application (
./scripts/code.sh), identifying listening ports (lsof), and terminating processes (kill). These are standard operations for development and automation workflows. - [Local Network Interaction]: It utilizes the Chrome DevTools Protocol (CDP) on local ports (e.g., 9224) to attach Playwright to the VS Code instance. This is a common and legitimate method for browser-based application automation.
- [Dynamic Execution]: The skill employs
npx @playwright/cli evalto execute JavaScript snippets within the automated application's context. This is the primary mechanism for interacting with the VS Code UI and is used here for legitimate automation tasks such as element selection and state verification. - [Temporary File Usage]: Screenshots are stored in
/tmp/code-oss-screenshots/. This is a standard practice for managing transient data during automation runs, though users should be aware that screenshots might capture sensitive information visible in the UI.
Audit Metadata