launch
Pass
Audited by Gen Agent Trust Hub on Jul 30, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill executes shell scripts (
launch.sh,monaco-paste.sh) to manage the Electron lifecycle and UI automation. These scripts use standard system tools (rsync,curl,node,jq) to perform their tasks. The use ofnohupanddisownis appropriate for managing detached Electron processes in a development workflow. - [EXTERNAL_DOWNLOADS]: The launcher invokes
node build/lib/preLaunch.tswithin the VS Code repository, which is a standard step in VS Code development to ensure the Electron binary is present and the source is compiled. This targets official infrastructure. - [DATA_EXPOSURE]: The skill documentation correctly identifies that authentication tokens are stored in the OS keychain and
User/globalStorage. The launcher handles these by cloning the necessary files to a temporary throwaway profile. This is a legitimate development workflow designed to allow testing authenticated features (like Copilot) without mutating the user's primary development environment. - [DYNAMIC_EXECUTION]: The scripts use
node -eto perform small tasks like port selection and text-based JSON merging for settings. These operations are performed using static templates or safe string interpolation to ensure the environment remains consistent.
Audit Metadata