skills/microsoft/vscode/chat-perf/Gen Agent Trust Hub

chat-perf

Pass

Audited by Gen Agent Trust Hub on Sep 14, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • External Downloads: The skill downloads official VS Code releases (e.g., version 1.115.0) to serve as a performance baseline for regression testing. These downloads are managed through official Microsoft tools like @vscode/test-electron.
  • Command Execution: The tool facilitates the execution of various local commands, including npm run for benchmarks, gulp for production builds, and the GitHub CLI (gh) for managing CI artifacts and workflow runs. These commands are integral to the skill's purpose of automating performance evaluation.
  • Indirect Prompt Injection: The benchmarking scenarios ingest and process simulated LLM responses. While this creates a potential surface for indirect prompt injection, the risk is mitigated by the use of a local mock server (mock-llm-server.js) to provide the responses in a controlled environment.
  • File System Interaction: The skill generates and manages performance artifacts, such as JSON result files, heap snapshots, and CPU profiles, stored in the .chat-simulation-data directory.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 14, 2026, 10:13 PM
Security Audit — agent-trust-hub — chat-perf