Security audit
Security checks for vulnerabilities and agentic risk
This skill is a markdown guide for creating VS Code Copilot custom agent files, with no bundled executable code or hidden behavior.
Install only if you want help authoring VS Code Copilot custom agents. Review generated agent files before use, especially any `tools`, `agents`, `handoffs.send`, user-level install paths, or `hooks` command entries, and prefer the minimum permissions needed for the agent's role.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
---
name: vscode-agent-creator
description: Create VS Code Copilot custom Agent (.agent.md) files.
---
# VS Code Copilot Custom Agent Creator
The trigger guidance is broad enough that the skill may activate for loosely related prompts such as generic 'create agent' or 'handoff' requests, increasing the chance of unintended use. In a skill that generates persistent agent configuration files, accidental invocation can lead users toward creating powerful automation artifacts without deliberate scoping.
The skill documents sensitive capabilities such as tool grants, sub-agents, handoffs, and especially command hooks, but provides no safety warning or guardrails about least privilege, trust boundaries, or execution risk. This is dangerous because it can normalize creation of agent files that automatically invoke powerful tools or local commands, enabling unsafe automation to persist beyond the current session.
No suspicious patterns detected.