The Agent Skills Directory

[DATA_EXFILTRATION] (HIGH): The readFile handler in assets/file-bridge/src/extension.ts provides unrestricted access to the local filesystem.
Evidence: It takes a filePath parameter from an external JSON command and passes it directly to vscode.Uri.file(params.filePath) and vscode.workspace.fs.readFile without any path validation or 'jail' within the workspace.
Impact: An attacker can read sensitive files like ~/.ssh/id_rsa, ~/.aws/credentials, or local environment files.
[COMMAND_EXECUTION] (HIGH): The writeFile handler in assets/file-bridge/src/extension.ts allows arbitrary file writes on the local machine.
Evidence: It accepts a filePath and content from an external JSON command and executes vscode.workspace.fs.writeFile using an unvalidated path.
Impact: This can be used to overwrite system binaries, modify shell configuration files (e.g., .bashrc) for persistence, or inject malicious scripts into other projects.
[DATA_EXFILTRATION] (MEDIUM): The getOpenFiles handler in assets/file-bridge/src/extension.ts leaks the full filesystem paths of all files currently open in the VS Code editor.
Evidence: It returns e.document.uri.fsPath for all visible text editors.
Impact: This exposes the user's directory structure and the names of sensitive projects they are working on.
[COMMAND_EXECUTION] (LOW): The executeCommand handler allows the AI bridge to run internal VS Code commands.
Evidence: While it includes a whitelist in assets/file-bridge/src/extension.ts, the capability itself increases the attack surface if the whitelist were to be expanded or bypassed.

vscode-extension-builder-lawvable