VS Code tasks are commands or scripts defined in a project’s workspace configuration, commonly in .vscode/tasks.json. They automate activities such as building, testing, or launching an application, and can invoke shells, tools, or local executables.
Because a task can run code on the developer’s machine, a malicious or altered repository may use it as a local execution path. That can expose resources available to the user account, including source files or credentials. Treat task definitions in unfamiliar projects as executable instructions: review commands and referenced files before running them, and use VS Code Workspace Trust or Restricted Mode when appropriate. Tasks are useful automation, but opening a project should not mean blindly trusting its commands.