zed-extension-development
Pass
Audited by Gen Agent Trust Hub on Sep 13, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Reference documentation explains the implementation of binary downloads using the host's native
download_fileAPI, which is standard for language servers. The instructions emphasize security best practices such as pinning specific release assets and verifying host platform/architecture. - [COMMAND_EXECUTION]: Included code templates utilize the
Worktree::whichAPI to resolve language server executables within the editor's sandbox environment. This follows the standard, restricted process management pattern for Zed extensions. - [INDIRECT_PROMPT_INJECTION]: The skill functions as a template generator for extensions, creating a surface where user inputs are interpolated into code and configuration.
- Ingestion points: User-provided extension IDs, names, and server configurations in metadata files and manifests.
- Boundary markers: None identified in the provided templates to separate untrusted user input from instruction code.
- Capability inventory: The generated extensions have capabilities to write files to the extension directory, download binaries, and execute server processes via Zed host APIs.
- Sanitization: The scaffolding logic does not include automated sanitization or escaping of user-provided metadata strings.
Audit Metadata