The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection due to its core function of processing untrusted data from extension projects.
Ingestion points: The skill reads and analyzes package.json manifests and extension source files (.ts, .js, etc.) using provided scripts and tools.
Boundary markers: There are no specific delimiters or instructional guardrails used when the agent context ingests content from these files to prevent the interpretation of embedded malicious instructions.
Capability inventory: The skill can execute various development commands (bun, node, tsc) and perform network operations to download VS Code test environments and project dependencies.
Sanitization: Content read from extension files is processed without explicit sanitization or filtering to remove potentially malicious prompt segments.
[SAFE]: The skill demonstrates high security awareness and utilizes official developer tools.
Security Best Practices: The instructions and example code explicitly implement Workspace Trust checks (e.g., in extension.node.ts) and use the SecretStorage API for handling sensitive data, mitigating the risk of credential theft and unauthorized command execution.
Official Tooling: All external dependencies and test utilities used, such as @vscode/test-cli, @vscode/test-electron, and esbuild, are official or industry-standard tools for VS Code extension development.

develop-vscode-extensions