Security audit
Security checks for vulnerabilities and agentic risk
This skill only gives instructions for editing Codex/VSCode user settings and does not include hidden code, network access, credential handling, or automatic execution.
Install this only if you want an agent to help edit global Codex/VSCode user settings. Review the exact setting key and value before applying changes, because user settings persist across projects and may require an editor reload.
The skill description is broadly scoped to modify any settings.json values whenever the user wants to change editor settings or preferences. Overly broad activation criteria can cause the agent to invoke this skill in situations where changing persistent global configuration is unnecessary or risky, increasing the chance of unintended state changes.
The markdown guidance repeats ambiguous invocation language like using the skill when the user wants to change preferences or any settings.json values, without guardrails on confirmation or scope. This can lead to unnecessary or overbroad use of a persistent configuration-writing skill, which is dangerous because it alters global IDE behavior beyond the current task.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
1. Parse the existing JSON (handle comments - VSCode settings support JSON with comments)
2. Add or update the requested setting
3. Preserve all other existing settings
4. Write back with proper formatting (2-space indentation)
### Example: Changing Font Size
No suspicious patterns detected.