lit-and-vscode-extensions
Pass
Audited by Gen Agent Trust Hub on Sep 27, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill is an instructional guide for developers. All code samples provided are standard boilerplate for VSCode extension and Lit web component development. The use of a nonce for script execution in the webview follows established security best practices for extension development.
- [EXTERNAL_DOWNLOADS]: The skill references standard development tools and libraries from public registries (NPM) and the author's own GitHub repository (
github.com/rodydavis/lit-vscode-extension). These are legitimate resources for the stated purpose of the skill. - [COMMAND_EXECUTION]: Instructions include standard development commands such as
npm init,npm install, andnpm run build. These are intended to be executed by the user in their local environment to set up the development project and do not represent a background execution risk. - [INDIRECT_PROMPT_INJECTION]: The extension code includes a message handling interface between the webview and the VSCode host (
onDidReceiveMessage). While this represents a data ingestion surface, the implementation is limited to triggering standard UI alerts and does not expose sensitive capabilities or agent-level controls.
Audit Metadata