vscode-extension-debugger
Pass
Audited by Gen Agent Trust Hub on Oct 3, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill provides educational content focused on VS Code extension development, including memory leak detection, race condition mitigation, and WebView communication patterns. The code snippets follow industry-standard practices.
- [INDIRECT_PROMPT_INJECTION]: The debugging workflows involve the agent processing external data sources which could technically contain malicious instructions.
- Ingestion points:
SKILL.md(Phase 1: Gather Information) describes collecting error messages, stack traces, and environment details. - Boundary markers: Absent; the skill does not explicitly instruct the agent to use delimiters when processing log files or stack traces.
- Capability inventory: The agent using this skill typically operates with filesystem access (
fs.promises.readFileinreferences/common-bugs.md), terminal control (terminal.sendTextinreferences/common-bugs.md), and VS Code command execution. - Sanitization: The skill provides specific fix patterns for sanitizing and validating external inputs in
references/common-bugs.md(Fix 17: Unvalidated Message Data), which demonstrates a security-conscious approach to extension development.
Audit Metadata