The Agent Skills Directory

[DATA_EXFILTRATION]: The file-bridge template in assets/file-bridge/src/extension.ts implements a readFile handler that accepts a filePath parameter and uses it directly with vscode.workspace.fs.readFile without validation. This allows an attacker who can write a JSON command to the watched directory to read any file accessible by the VS Code process, including sensitive credentials or SSH keys.
[COMMAND_EXECUTION]: The file-bridge template in assets/file-bridge/src/extension.ts implements a writeFile handler that accepts filePath and content parameters. It writes to the specified path without ensuring it stays within the workspace, enabling arbitrary file writes which can be used to achieve persistence or modify system configuration.
[PROMPT_INJECTION]: The file-bridge pattern creates a large surface for indirect prompt injection. By watching the .vscode/ai-bridge/commands/ directory, the extension effectively grants any process or user capable of writing to that directory (including a malicious repository) the ability to influence the extension's behavior and the agent's context through the IPC mechanism. This is particularly risky given the missing boundary markers and lack of sanitization in the template implementation.
Ingestion points: .vscode/ai-bridge/commands/*.json files (watched by FileBridge class).
Boundary markers: Absent in the implementation code; the system processes any valid JSON found in the folder.
Capability inventory: File reading (readFile), file writing (writeFile), and whitelisted command execution (executeCommand) as seen in assets/file-bridge/src/extension.ts.
Sanitization: Path resolution and prefix checks are missing in the template code, although they are suggested in the references/ai-integration.md documentation.

vscode-extension-builder-lawvable