skills.rest
fabioc-aloha
fabioc-alohaCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

extension-security

Enforce secure VS Code extension development using SecretStorage and `vsce ls` verification.

Updated Feb 24, 2026
Search Tags:#vscode#security#extension#credentials#api key#vsce
One-click install
npx skills add https://github.com/fabioc-aloha/Extensions --skill extension-security
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: extension-security
Source: https://github.com/fabioc-aloha/Extensions/tree/main/.github/skills/extension-security
Command: npx skills add https://github.com/fabioc-aloha/Extensions --skill extension-security

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill ensures that VS Code extensions are developed and published securely, preventing the accidental inclusion of sensitive credentials and protecting users from potential vulnerabilities.

Core Features & Use Cases

  • Credential Management: Enforces the use of VS Code's SecretStorage for all API keys and sensitive data, preventing hardcoding.
  • Publishing Verification: Utilizes vsce ls to verify that no sensitive files or source code are included in the final extension package (.vsix).
  • Secret Scanning: Integrates a scanner to detect common patterns of secrets within code.
  • Use Case: Before publishing a new VS Code extension that requires an API key, use this Skill to audit your code, verify your .vscodeignore file, and run vsce ls to ensure no secrets are exposed.

Quick Start

Run the security audit for the 'my-extension' VS Code extension.

Frequently Asked Questions about extension-security

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I secure API keys in a VS Code extension?▼

Secure API keys in a VS Code extension by storing them using the built-in SecretStorage API, which prevents hardcoded credentials and protects against accidental data exfiltration.

How can I check what files are included in my published VS Code extension package?▼

Check what files are included in your published VS Code extension package by running the `vsce ls` command, which verifies that no sensitive files or source code are exposed in the final `.vsix` file.

What is the best way to prevent accidental secret exposure when publishing VS Code extensions?▼

The best way to prevent accidental secret exposure when publishing VS Code extensions is performing a security audit that scans code for common secret patterns and validates the `.vscodeignore` file before packaging.

Does this security audit work with existing VS Code extensions that use hardcoded credentials?▼

Yes, the security audit works with existing VS Code extensions by integrating a secret scanner to detect common patterns of hardcoded credentials and enforcing migration to the secure SecretStorage mechanism.

Why should I use SecretStorage instead of environment variables for VS Code extension credentials?▼

You should use SecretStorage instead of environment variables for VS Code extension credentials because it enforces secure development practices by preventing hardcoding and mitigating risks of accidental data exfiltration across insecure configurations.

Related Skills

Explore More Software Engineering Skills→
igamenovoerigamenovoer
7

vscode-make-offline-installer

Package VS Code clients, server artifacts, and VSIX extensions for offline deployment.

Community
Advanced
sergeyitalysergeyitaly
1

cursor-kiro-extension-publishing

Publish VS Code extension VSIX files to Open VSX for Cursor and Kiro IDEs.

Community
Intermediate
achmfachmf

vulnerability-scanner

Scan software projects for vulnerabilities, hardcoded secrets, and insecure code patterns.

Community
Advanced
alannreyesalannreyes

Pre-Deployment Security Check

Scan JavaScript/TypeScript code for hardcoded credentials before pushing to GitHub.

Community
Advanced