vscode-extension-guide-en — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited vscode-extension-guide-en (Agent Skill) and scored it 45/100 (orange). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 1 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
A base64 string of 128+ characters appears in a documentation file. Encoded prompt injection hides the hostile instruction in base64 — invisible to keyword filters — and relies on the agent's ability to decode it at runtime. There is no normal authoring reason to embed a multi-hundred-byte base64 blob in skill docs.
*.sig, SIGNATURES) outside the documentation.Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Create, develop, and publish VS Code extensions.
# Scaffold new extension (recommended)
npm install -g yo generator-code
yo code
# Or minimal manual setup
mkdir my-extension && cd my-extension
npm init -y && npm install -D typescript @types/vscodemy-extension/
├── package.json # Extension manifest (CRITICAL)
├── src/extension.ts # Entry point
├── out/ # Compiled JS (gitignore)
├── images/icon.png # 128x128 PNG for Marketplace
└── .vscodeignore # Exclude files from VSIXnpm run compile # Build once
npm run watch # Watch mode (F5 to launch debug)
npx @vscode/vsce package # Creates .vsix.vscodeignore)| Symptom | Fix |
|---|---|
| Extension not loading | Check activationEvents (auto-detected since VS Code 1.74 for contributed commands/views) |
| Command not found | Match command ID in package.json/code |
| Shortcut not working | Remove when clause, check conflicts |
| Topic | Reference |
|---|---|
| AI Customization | references/ai-customization.md |
| Code Review Prompts | references/code-review-prompts.md |
| Code Samples | references/code-samples.md |
| TreeView | references/treeview.md |
| Webview | references/webview.md |
| Testing | references/testing.md |
| Publishing | references/publishing.md |
| Troubleshooting | references/troubleshooting.md |
Unify package name, setting keys, command IDs, and view IDs before publishing:
| Item | Example |
|---|---|
| Package name | copilot-scheduler |
| Setting key | copilotScheduler.enabled |
| Command ID | copilotScheduler.createTask |
| View ID | copilotSchedulerTasks |
type NotificationMode = "sound" | "silentToast" | "silentStatus";
function getNotificationMode(): NotificationMode {
const config = vscode.workspace.getConfiguration("myExtension");
return config.get<NotificationMode>("notificationMode", "sound");
}
function notifyInfo(message: string, timeoutMs = 4000): void {
const mode = getNotificationMode();
switch (mode) {
case "silentStatus":
vscode.window.setStatusBarMessage(message, timeoutMs);
break;
case "silentToast":
void vscode.window.withProgress(
{ location: vscode.ProgressLocation.Notification, title: message },
async () => {},
);
break;
default:
void vscode.window.showInformationMessage(message);
}
}
function notifyError(message: string, timeoutMs = 6000): void {
const mode = getNotificationMode();
if (mode === "silentStatus") {
vscode.window.setStatusBarMessage(`⚠ ${message}`, timeoutMs);
console.error(message);
return;
}
void vscode.window.showErrorMessage(message);
}Expose a notificationMode setting so users can control how notifications are delivered.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.