Security audit
Security checks for vulnerabilities and agentic risk
The skill is transparent about being a VSCode automation tool, but it needs review because it lets an agent persistently install arbitrary VSCode extensions and add workspace folders without built-in safeguards.
Install only if you are comfortable giving the agent control over VSCode. Require explicit approval before running install-extension, verify extension IDs and publishers yourself, and avoid adding sensitive folders to a workspace unless needed.
The skill explicitly advertises extension installation and workspace modification capabilities but does not warn that these actions change the local developer environment. In an agent context, this can lead to unreviewed persistence, introduction of risky extensions, or unintended project/workspace changes initiated on the user's machine.
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
sudo ln -s /usr/share/code/bin/code /usr/local/bin/code
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
sudo ln -s /usr/share/code/bin/code /usr/local/bin/code
The file presents its title, help text, command descriptions, and later user-facing messages in Chinese, but there is no indication that users can opt into another language or locale. This creates a language-policy concern because the skill appears to enforce a specific locale by default rather than offering a choice.
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
cmd.append(file)
try:
subprocess.run(cmd, check=True)
if ctx.obj.get('json_output'):
click.echo(json.dumps({"action": "open", "file": file or "VSCode"}))
else:
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
cmd.append(file)
try:
subprocess.run(cmd, check=True)
if ctx.obj.get('json_output'):
click.echo(json.dumps({"action": "open", "file": file or "VSCode"}))
else:
This command allows installation of an arbitrary VSCode extension based on user-controlled input. In an agent skill context, that is dangerous because extensions execute privileged code inside the editor environment and can access workspace contents, making this an indirect code-execution/supply-chain risk rather than a shell-injection issue.
cmd = ['code', '--install-extension', id]
try:
result = subprocess.run(cmd, capture_output=True, text=True, check=True)
if ctx.obj.get('json_output'):
click.echo(json.dumps({"action": "install_extension", "id": id, "status": "success"}))
else:
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
cmd = ['code', '--list-extensions']
try:
result = subprocess.run(cmd, capture_output=True, text=True, check=True)
extensions = result.stdout.strip().split('\n')
if ctx.obj.get('json_output'):
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
"""显示 VSCode 状态"""
# 检查 code 命令是否可用
try:
result = subprocess.run(['code', '--version'], capture_output=True, text=True)
version = result.stdout.strip().split('\n')[0]
status_info = {
The skill description is written in Chinese and presents its core purpose in that language without any indication of alternative language support or user opt-in. This can violate a language/locale policy when users are not explicitly given a choice of language.
The natural-language instructions and capability descriptions are presented in Chinese, which effectively forces a specific language for users of the skill. There is no indication that this is a region-specific tool or that users can choose an alternate language.
No suspicious patterns detected.