vscode-debug-setup — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited vscode-debug-setup (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Glob: **/*.csproj (exclude bin/ and obj/ directories)Read each .csproj and classify:
Sdk attribute is Microsoft.NET.Sdk.WebPackageReference contains xunit, MSTest, or NUnit (case-insensitive)Also collect per project:
<TargetFramework> value (e.g. net9.0).csproj filename without extension)For each web project, read {ProjectDir}/Properties/launchSettings.json:
commandName is not "IISExpress")applicationUrl — full value (e.g. https://localhost:5001;http://localhost:5000){httpsUrl} — the https-only portion (e.g. https://localhost:5001)launchUrl is present (e.g. swagger), record it for use in uriFormatFor each web + test project, one "build: {ProjectName}" task. Add a "build: solution" task (isDefault: true) that builds the whole .sln (Glob *.sln to get the path). For each web project, also add a "watch: {ProjectName}" background task using dotnet watch for hot reload.
See REFERENCE.md § tasks.json.
For each web project, generate two launch configurations in sequence:
type: coreclr, preLaunchTask: "build: {ProjectName}", full .dll path as program, cwd set to project dir, console: "integratedTerminal", sourceFileMap, and serverReadyAction; use uriFormat: "{httpsUrl}/{launchUrl}" when launchUrl is present, otherwise "{httpsUrl}/"program: "dotnet", args: ["watch", "--project", ..., "--non-interactive", "run", "--no-restore", "--", "--urls={applicationUrl}"], no preLaunchTask, cwd set to workspace root, console: "integratedTerminal", sourceFileMap, and serverReadyActionFor each test project: one launch config with program: "dotnet", args: ["test", ...], console: "integratedTerminal". Always append an "Attach to Process" config at the end.
≥ 2 web projects: add two compounds entries:
See REFERENCE.md § launch.json.
mkdir -p .vscode (if not exists).vscode/tasks.json.vscode/launch.json~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.