Confirm the source
Compare the repository, publisher, and installation command before continuing.
✓
Third-party audit
PassedGen Agent Trust Hub
author-contributions · microsoft/vscode
Provider summary
The skill performs complex git analysis by dynamically generating and executing temporary Python and shell scripts. This introduces risks of command injection if parameters like the author name or branch names are not strictly sanitized before being passed to shell-interpreted blocks.
The provider classified the analyzed snapshot as NONE risk. This result applies to the content available at audit time.
- Provider
- Gen Agent Trust Hub
- Normalized result
- pass
- Risk level
- NONE
- Audited
- Feb 17, 2026
How to use this signal
Read the content
Review SKILL.md, scripts, and allowed tools. Artificial Atlas never executes them during indexing.
Limit permissions
Use the narrowest possible scope and avoid broad credentials for third-party skills.