{ "query": "", "kind": "extension", "page": 1, "pages": 2, "pageSize": 24, "total": 26, "results": [ { "kind": "extension", "slug": "claude-code-for-vscode", "name": "Claude Code for VS Code", "vendor": "Anthropic", "description": "Anthropic's extension that runs Claude Code inside VS Code — the same agent as the CLI, surfaced in the editor with inline diffs, a sidebar session, and the editor's own file context feeding the agent.\n\nThe capability surface is that of a full coding agent rather than a completion tool: it reads and writes files across the workspace, runs shell commands through its Bash tool, reaches the network for model calls, and holds an API credential. That combination matches Anomity's full-control pattern, which is the honest description of any agent that can edit and execute. Anthropic-published, so it takes the official trust adjustment; the operational controls that matter are its permission prompts and allow-lists, which should not be blanket-approved on repositories that hold production credentials.", "website": "https://docs.claude.com/en/docs/claude-code/ide-integrations", "repository": null, "documentationUrl": null, "license": null, "version": null, "trustLevel": "official", "capabilities": [ "filesystem:read", "filesystem:write", "shell:execute", "network:outbound", "credentials:access" ], "packaging": { "manager": "vsix", "packageName": "anthropic.claude-code" }, "configFiles": null, "category": null, "updatedAt": "2026-09-02", "risk": { "score": 100, "band": "critical", "signals": [ { "id": "trust-official", "kind": "trust", "label": "Published by the vendor", "contribution": -40 }, { "id": "high-risk-capabilities", "kind": "capability", "label": "3 high-risk capabilities: filesystem:write, shell:execute, credentials:access", "contribution": 30 }, { "id": "exfiltration-risk", "kind": "combination", "label": "Data exfiltration risk (high)", "description": "Shell execution combined with outbound network access can exfiltrate arbitrary data from the machine.", "contribution": 15 }, { "id": "credential-theft-risk", "kind": "combination", "label": "Credential theft risk (high)", "description": "Filesystem write combined with credentials access can plant persistent credential stealers.", "contribution": 15 }, { "id": "filesystem-write-shell-risk", "kind": "combination", "label": "Persistence + execution risk (medium)", "description": "Shell execution plus filesystem write means the agent can plant persistent backdoors (e.g. modifying startup scripts).", "contribution": 5 }, { "id": "full-control-risk", "kind": "combination", "label": "Full-control risk (critical)", "description": "Shell + filesystem write + network is effectively a remote shell on the employee machine.", "contribution": 25 } ], "dangerousCombos": [ { "id": "exfiltration-risk", "name": "Data exfiltration risk", "description": "Shell execution combined with outbound network access can exfiltrate arbitrary data from the machine.", "capabilities": [ "shell:execute", "network:outbound" ], "severity": "high" }, { "id": "credential-theft-risk", "name": "Credential theft risk", "description": "Filesystem write combined with credentials access can plant persistent credential stealers.", "capabilities": [ "filesystem:write", "credentials:access" ], "severity": "high" }, { "id": "filesystem-write-shell-risk", "name": "Persistence + execution risk", "description": "Shell execution plus filesystem write means the agent can plant persistent backdoors (e.g. modifying startup scripts).", "capabilities": [ "shell:execute", "filesystem:write" ], "severity": "medium" }, { "id": "full-control-risk", "name": "Full-control risk", "description": "Shell + filesystem write + network is effectively a remote shell on the employee machine.", "capabilities": [ "shell:execute", "filesystem:write", "network:outbound" ], "severity": "critical" } ] }, "dangerousCombos": [ { "id": "exfiltration-risk", "name": "Data exfiltration risk", "description": "Shell execution combined with outbound network access can exfiltrate arbitrary data from the machine.", "capabilities": [ "shell:execute", "network:outbound" ], "severity": "high" }, { "id": "credential-theft-risk", "name": "Credential theft risk", "description": "Filesystem write combined with credentials access can plant persistent credential stealers.", "capabilities": [ "filesystem:write", "credentials:access" ], "severity": "high" }, { "id": "filesystem-write-shell-risk", "name": "Persistence + execution risk", "description": "Shell execution plus filesystem write means the agent can plant persistent backdoors (e.g. modifying startup scripts).", "capabilities": [ "shell:execute", "filesystem:write" ], "severity": "medium" }, { "id": "full-control-risk", "name": "Full-control risk", "description": "Shell + filesystem write + network is effectively a remote shell on the employee machine.", "capabilities": [ "shell:execute", "filesystem:write", "network:outbound" ], "severity": "critical" } ] }, { "kind": "extension", "slug": "cline", "name": "Cline", "vendor": "Cline", "description": "Cline is an autonomous coding agent that runs inside VS Code and takes the IDE far beyond autocomplete. Once approved, it can read and edit files across your repository, execute shell commands in the integrated terminal, browse the web, and call external tools through MCP servers — all while showing each step for human approval. The project is open source, published on the VS Code Marketplace, and updated frequently by a community-led team.\n\nFrom a capability standpoint, the extension declares full filesystem read and write access, shell execution inside the workspace, outbound network access to its model provider (Anthropic, OpenAI, OpenRouter, Bedrock, Vertex, and local models), and access to your stored API credentials. Combined, those capabilities are powerful enough to refactor a service, install dependencies, and ship a PR without leaving the editor.\n\nThe risk profile reflects that surface area. Cline is community-maintained rather than vendor-published, which lowers its trust adjustment. The pairing of shell execution with outbound network access matches Anomity's data-exfiltration combination, and filesystem write paired with credential access matches the credential-theft combination. Teams that adopt Cline should pair it with allow-listed commands, scoped credentials, and a strict approval workflow rather than the agent's auto-approve mode.", "website": "https://cline.bot", "repository": null, "documentationUrl": null, "license": null, "version": null, "trustLevel": "community", "capabilities": [ "filesystem:read", "filesystem:write", "shell:execute", "network:outbound", "credentials:access" ], "packaging": { "manager": "vsix", "packageName": "saoudrizwan.claude-dev" }, "configFiles": null, "category": null, "updatedAt": "2026-09-02T18:21:41.256Z", "risk": { "score": 100, "band": "critical", "signals": [ { "id": "trust-community", "kind": "trust", "label": "Established community project", "contribution": -10 }, { "id": "high-risk-capabilities", "kind": "capability", "label": "3 high-risk capabilities: filesystem:write, shell:execute, credentials:access", "contribution": 30 }, { "id": "exfiltration-risk", "kind": "combination", "label": "Data exfiltration risk (high)", "description": "Shell execution combined with outbound network access can exfiltrate arbitrary data from the machine.", "contribution": 15 }, { "id": "credential-theft-risk", "kind": "combination", "label": "Credential theft risk (high)", "description": "Filesystem write combined with credentials access can plant persistent credential stealers.", "contribution": 15 }, { "id": "filesystem-write-shell-risk", "kind": "combination", "label": "Persistence + execution risk (medium)", "description": "Shell execution plus filesystem write means the agent can plant persistent backdoors (e.g. modifying startup scripts).", "contribution": 5 }, { "id": "full-control-risk", "kind": "combination", "label": "Full-control risk (critical)", "description": "Shell + filesystem write + network is effectively a remote shell on the employee machine.", "contribution": 25 } ], "dangerousCombos": [ { "id": "exfiltration-risk", "name": "Data exfiltration risk", "description": "Shell execution combined with outbound network access can exfiltrate arbitrary data from the machine.", "capabilities": [ "shell:execute", "network:outbound" ], "severity": "high" }, { "id": "credential-theft-risk", "name": "Credential theft risk", "description": "Filesystem write combined with credentials access can plant persistent credential stealers.", "capabilities": [ "filesystem:write", "credentials:access" ], "severity": "high" }, { "id": "filesystem-write-shell-risk", "name": "Persistence + execution risk", "description": "Shell execution plus filesystem write means the agent can plant persistent backdoors (e.g. modifying startup scripts).", "capabilities": [ "shell:execute", "filesystem:write" ], "severity": "medium" }, { "id": "full-control-risk", "name": "Full-control risk", "description": "Shell + filesystem write + network is effectively a remote shell on the employee machine.", "capabilities": [ "shell:execute", "filesystem:write", "network:outbound" ], "severity": "critical" } ] }, "dangerousCombos": [ { "id": "exfiltration-risk", "name": "Data exfiltration risk", "description": "Shell execution combined with outbound network access can exfiltrate arbitrary data from the machine.", "capabilities": [ "shell:execute", "network:outbound" ], "severity": "high" }, { "id": "credential-theft-risk", "name": "Credential theft risk", "description": "Filesystem write combined with credentials access can plant persistent credential stealers.", "capabilities": [ "filesystem:write", "credentials:access" ], "severity": "high" }, { "id": "filesystem-write-shell-risk", "name": "Persistence + execution risk", "description": "Shell execution plus filesystem write means the agent can plant persistent backdoors (e.g. modifying startup scripts).", "capabilities": [ "shell:execute", "filesystem:write" ], "severity": "medium" }, { "id": "full-control-risk", "name": "Full-control risk", "description": "Shell + filesystem write + network is effectively a remote shell on the employee machine.", "capabilities": [ "shell:execute", "filesystem:write", "network:outbound" ], "severity": "critical" } ] }, { "kind": "extension", "slug": "kilo-code", "name": "Kilo Code", "vendor": "Kilo Code", "description": "Kilo Code is a multi-model AI coding assistant for VS Code that combines the agentic execution loop pioneered by Cline and Roo Code with first-class MCP server integration and a marketplace of curated workflows. It supports OpenAI, Anthropic, Google, Mistral, local Ollama models, and any OpenAI-compatible endpoint, letting teams route different tasks to different models from a single extension.\n\nIn day-to-day use, Kilo Code reads files anywhere in the open workspace, writes edits across multiple files in a single turn, executes shell commands through the integrated terminal, calls out to model providers and MCP servers over the network, and stores provider credentials in the VS Code secret store. Each tool invocation can be configured to require explicit approval, batched approval, or full auto-approve.\n\nKilo Code is community-maintained, and the combination of shell execution plus outbound network and filesystem write plus credentials access matches both Anomity's data-exfiltration and credential-theft dangerous combinations. The recommended controls are workspace-only credential scopes, allow-listed shell commands, and turning on per-tool approval rather than auto-approve for any agent that has internet access.", "website": "https://kilocode.ai", "repository": null, "documentationUrl": null, "license": null, "version": null, "trustLevel": "community", "capabilities": [ "filesystem:read", "filesystem:write", "shell:execute", "network:outbound", "credentials:access" ], "packaging": { "manager": "vsix", "packageName": "kilocode.kilo-code" }, "configFiles": null, "category": null, "updatedAt": "2026-09-02T18:21:41.256Z", "risk": { "score": 100, "band": "critical", "signals": [ { "id": "trust-community", "kind": "trust", "label": "Established community project", "contribution": -10 }, { "id": "high-risk-capabilities", "kind": "capability", "label": "3 high-risk capabilities: filesystem:write, shell:execute, credentials:access", "contribution": 30 }, { "id": "exfiltration-risk", "kind": "combination", "label": "Data exfiltration risk (high)", "description": "Shell execution combined with outbound network access can exfiltrate arbitrary data from the machine.", "contribution": 15 }, { "id": "credential-theft-risk", "kind": "combination", "label": "Credential theft risk (high)", "description": "Filesystem write combined with credentials access can plant persistent credential stealers.", "contribution": 15 }, { "id": "filesystem-write-shell-risk", "kind": "combination", "label": "Persistence + execution risk (medium)", "description": "Shell execution plus filesystem write means the agent can plant persistent backdoors (e.g. modifying startup scripts).", "contribution": 5 }, { "id": "full-control-risk", "kind": "combination", "label": "Full-control risk (critical)", "description": "Shell + filesystem write + network is effectively a remote shell on the employee machine.", "contribution": 25 } ], "dangerousCombos": [ { "id": "exfiltration-risk", "name": "Data exfiltration risk", "description": "Shell execution combined with outbound network access can exfiltrate arbitrary data from the machine.", "capabilities": [ "shell:execute", "network:outbound" ], "severity": "high" }, { "id": "credential-theft-risk", "name": "Credential theft risk", "description": "Filesystem write combined with credentials access can plant persistent credential stealers.", "capabilities": [ "filesystem:write", "credentials:access" ], "severity": "high" }, { "id": "filesystem-write-shell-risk", "name": "Persistence + execution risk", "description": "Shell execution plus filesystem write means the agent can plant persistent backdoors (e.g. modifying startup scripts).", "capabilities": [ "shell:execute", "filesystem:write" ], "severity": "medium" }, { "id": "full-control-risk", "name": "Full-control risk", "description": "Shell + filesystem write + network is effectively a remote shell on the employee machine.", "capabilities": [ "shell:execute", "filesystem:write", "network:outbound" ], "severity": "critical" } ] }, "dangerousCombos": [ { "id": "exfiltration-risk", "name": "Data exfiltration risk", "description": "Shell execution combined with outbound network access can exfiltrate arbitrary data from the machine.", "capabilities": [ "shell:execute", "network:outbound" ], "severity": "high" }, { "id": "credential-theft-risk", "name": "Credential theft risk", "description": "Filesystem write combined with credentials access can plant persistent credential stealers.", "capabilities": [ "filesystem:write", "credentials:access" ], "severity": "high" }, { "id": "filesystem-write-shell-risk", "name": "Persistence + execution risk", "description": "Shell execution plus filesystem write means the agent can plant persistent backdoors (e.g. modifying startup scripts).", "capabilities": [ "shell:execute", "filesystem:write" ], "severity": "medium" }, { "id": "full-control-risk", "name": "Full-control risk", "description": "Shell + filesystem write + network is effectively a remote shell on the employee machine.", "capabilities": [ "shell:execute", "filesystem:write", "network:outbound" ], "severity": "critical" } ] }, { "kind": "extension", "slug": "openai-codex-vscode", "name": "OpenAI Codex for VS Code", "vendor": "OpenAI", "description": "OpenAI's Codex extension brings its coding agent into VS Code, letting a developer delegate a task, watch the agent work through it in the editor, and review the resulting diff — with the option to hand work off to a cloud-executed session.\n\nLike any agentic extension it reads and writes the workspace, executes commands, calls the model service, and holds credentials. The cloud-execution path is the part that deserves specific attention in a review: work that runs remotely means repository contents are processed outside the developer's machine, which is a different data-flow answer than a purely local agent and one that a code-residency policy will have opinions about.", "website": "https://developers.openai.com/codex/ide", "repository": null, "documentationUrl": null, "license": null, "version": null, "trustLevel": "official", "capabilities": [ "filesystem:read", "filesystem:write", "shell:execute", "network:outbound", "credentials:access" ], "packaging": { "manager": "vsix", "packageName": "openai.chatgpt" }, "configFiles": null, "category": null, "updatedAt": "2026-09-02", "risk": { "score": 100, "band": "critical", "signals": [ { "id": "trust-official", "kind": "trust", "label": "Published by the vendor", "contribution": -40 }, { "id": "high-risk-capabilities", "kind": "capability", "label": "3 high-risk capabilities: filesystem:write, shell:execute, credentials:access", "contribution": 30 }, { "id": "exfiltration-risk", "kind": "combination", "label": "Data exfiltration risk (high)", "description": "Shell execution combined with outbound network access can exfiltrate arbitrary data from the machine.", "contribution": 15 }, { "id": "credential-theft-risk", "kind": "combination", "label": "Credential theft risk (high)", "description": "Filesystem write combined with credentials access can plant persistent credential stealers.", "contribution": 15 }, { "id": "filesystem-write-shell-risk", "kind": "combination", "label": "Persistence + execution risk (medium)", "description": "Shell execution plus filesystem write means the agent can plant persistent backdoors (e.g. modifying startup scripts).", "contribution": 5 }, { "id": "full-control-risk", "kind": "combination", "label": "Full-control risk (critical)", "description": "Shell + filesystem write + network is effectively a remote shell on the employee machine.", "contribution": 25 } ], "dangerousCombos": [ { "id": "exfiltration-risk", "name": "Data exfiltration risk", "description": "Shell execution combined with outbound network access can exfiltrate arbitrary data from the machine.", "capabilities": [ "shell:execute", "network:outbound" ], "severity": "high" }, { "id": "credential-theft-risk", "name": "Credential theft risk", "description": "Filesystem write combined with credentials access can plant persistent credential stealers.", "capabilities": [ "filesystem:write", "credentials:access" ], "severity": "high" }, { "id": "filesystem-write-shell-risk", "name": "Persistence + execution risk", "description": "Shell execution plus filesystem write means the agent can plant persistent backdoors (e.g. modifying startup scripts).", "capabilities": [ "shell:execute", "filesystem:write" ], "severity": "medium" }, { "id": "full-control-risk", "name": "Full-control risk", "description": "Shell + filesystem write + network is effectively a remote shell on the employee machine.", "capabilities": [ "shell:execute", "filesystem:write", "network:outbound" ], "severity": "critical" } ] }, "dangerousCombos": [ { "id": "exfiltration-risk", "name": "Data exfiltration risk", "description": "Shell execution combined with outbound network access can exfiltrate arbitrary data from the machine.", "capabilities": [ "shell:execute", "network:outbound" ], "severity": "high" }, { "id": "credential-theft-risk", "name": "Credential theft risk", "description": "Filesystem write combined with credentials access can plant persistent credential stealers.", "capabilities": [ "filesystem:write", "credentials:access" ], "severity": "high" }, { "id": "filesystem-write-shell-risk", "name": "Persistence + execution risk", "description": "Shell execution plus filesystem write means the agent can plant persistent backdoors (e.g. modifying startup scripts).", "capabilities": [ "shell:execute", "filesystem:write" ], "severity": "medium" }, { "id": "full-control-risk", "name": "Full-control risk", "description": "Shell + filesystem write + network is effectively a remote shell on the employee machine.", "capabilities": [ "shell:execute", "filesystem:write", "network:outbound" ], "severity": "critical" } ] }, { "kind": "extension", "slug": "refact-ai", "name": "Refact.ai", "vendor": "Refact.ai", "description": "Refact.ai is an open-source AI coding assistant offering completion, chat, and an agent mode, with a self-hosted server option so the models can run inside your own infrastructure.\n\nIn self-hosted mode it reads and writes the workspace and executes commands in agent mode without sending code to a third party. The catalogued capabilities reflect the agentic configuration — filesystem read and write plus shell execution, with network access to whichever model endpoint is configured. Self-hosting removes the data-residency question but not the agent question: an agent that can edit and execute locally is still an agent that can edit and execute.", "website": "https://refact.ai", "repository": "https://github.com/smallcloudai/refact", "documentationUrl": null, "license": null, "version": null, "trustLevel": "community", "capabilities": [ "filesystem:read", "filesystem:write", "shell:execute", "network:outbound" ], "packaging": { "manager": "vsix", "packageName": "smallcloud.codify" }, "configFiles": null, "category": null, "updatedAt": "2026-09-02", "risk": { "score": 100, "band": "critical", "signals": [ { "id": "trust-community", "kind": "trust", "label": "Established community project", "contribution": -10 }, { "id": "high-risk-capabilities", "kind": "capability", "label": "2 high-risk capabilities: filesystem:write, shell:execute", "contribution": 20 }, { "id": "exfiltration-risk", "kind": "combination", "label": "Data exfiltration risk (high)", "description": "Shell execution combined with outbound network access can exfiltrate arbitrary data from the machine.", "contribution": 15 }, { "id": "filesystem-write-shell-risk", "kind": "combination", "label": "Persistence + execution risk (medium)", "description": "Shell execution plus filesystem write means the agent can plant persistent backdoors (e.g. modifying startup scripts).", "contribution": 5 }, { "id": "full-control-risk", "kind": "combination", "label": "Full-control risk (critical)", "description": "Shell + filesystem write + network is effectively a remote shell on the employee machine.", "contribution": 25 } ], "dangerousCombos": [ { "id": "exfiltration-risk", "name": "Data exfiltration risk", "description": "Shell execution combined with outbound network access can exfiltrate arbitrary data from the machine.", "capabilities": [ "shell:execute", "network:outbound" ], "severity": "high" }, { "id": "filesystem-write-shell-risk", "name": "Persistence + execution risk", "description": "Shell execution plus filesystem write means the agent can plant persistent backdoors (e.g. modifying startup scripts).", "capabilities": [ "shell:execute", "filesystem:write" ], "severity": "medium" }, { "id": "full-control-risk", "name": "Full-control risk", "description": "Shell + filesystem write + network is effectively a remote shell on the employee machine.", "capabilities": [ "shell:execute", "filesystem:write", "network:outbound" ], "severity": "critical" } ] }, "dangerousCombos": [ { "id": "exfiltration-risk", "name": "Data exfiltration risk", "description": "Shell execution combined with outbound network access can exfiltrate arbitrary data from the machine.", "capabilities": [ "shell:execute", "network:outbound" ], "severity": "high" }, { "id": "filesystem-write-shell-risk", "name": "Persistence + execution risk", "description": "Shell execution plus filesystem write means the agent can plant persistent backdoors (e.g. modifying startup scripts).", "capabilities": [ "shell:execute", "filesystem:write" ], "severity": "medium" }, { "id": "full-control-risk", "name": "Full-control risk", "description": "Shell + filesystem write + network is effectively a remote shell on the employee machine.", "capabilities": [ "shell:execute", "filesystem:write", "network:outbound" ], "severity": "critical" } ] }, { "kind": "extension", "slug": "roo-code", "name": "Roo Code", "vendor": "Roo Code", "description": "Roo Code is an open-source AI coding agent for VS Code, originally forked from Cline and now developed independently with expanded provider support, more granular permission modes, and a community focused on configurability. Like its upstream, Roo Code can drive an entire feature end-to-end: planning a change, editing files in batches, running tests in the terminal, and reaching out to MCP servers for additional tools.\n\nThe extension's declared capabilities span filesystem read and write across the workspace, shell execution for builds and tests, outbound network connections to the configured LLM provider, and access to provider API keys and tokens stored in the secret store. Operators can install custom \"modes\" that further widen or narrow that surface — for example, an architect mode that can plan but not execute, or a code mode with the full toolbelt.\n\nBecause Roo Code is community-maintained and inherits the shell + network + credentials trio, it triggers both the data-exfiltration and credential-theft dangerous combinations in Anomity's catalog. The recommended posture is to enable the most restrictive mode that meets the team's need, restrict tools at the MCP server level, and avoid running it under accounts that hold production credentials.", "website": "https://roocode.com", "repository": null, "documentationUrl": null, "license": null, "version": null, "trustLevel": "community", "capabilities": [ "filesystem:read", "filesystem:write", "shell:execute", "network:outbound", "credentials:access" ], "packaging": { "manager": "vsix", "packageName": "RooVeterinaryInc.roo-cline" }, "configFiles": null, "category": null, "updatedAt": "2026-09-02T18:21:41.256Z", "risk": { "score": 100, "band": "critical", "signals": [ { "id": "trust-community", "kind": "trust", "label": "Established community project", "contribution": -10 }, { "id": "high-risk-capabilities", "kind": "capability", "label": "3 high-risk capabilities: filesystem:write, shell:execute, credentials:access", "contribution": 30 }, { "id": "exfiltration-risk", "kind": "combination", "label": "Data exfiltration risk (high)", "description": "Shell execution combined with outbound network access can exfiltrate arbitrary data from the machine.", "contribution": 15 }, { "id": "credential-theft-risk", "kind": "combination", "label": "Credential theft risk (high)", "description": "Filesystem write combined with credentials access can plant persistent credential stealers.", "contribution": 15 }, { "id": "filesystem-write-shell-risk", "kind": "combination", "label": "Persistence + execution risk (medium)", "description": "Shell execution plus filesystem write means the agent can plant persistent backdoors (e.g. modifying startup scripts).", "contribution": 5 }, { "id": "full-control-risk", "kind": "combination", "label": "Full-control risk (critical)", "description": "Shell + filesystem write + network is effectively a remote shell on the employee machine.", "contribution": 25 } ], "dangerousCombos": [ { "id": "exfiltration-risk", "name": "Data exfiltration risk", "description": "Shell execution combined with outbound network access can exfiltrate arbitrary data from the machine.", "capabilities": [ "shell:execute", "network:outbound" ], "severity": "high" }, { "id": "credential-theft-risk", "name": "Credential theft risk", "description": "Filesystem write combined with credentials access can plant persistent credential stealers.", "capabilities": [ "filesystem:write", "credentials:access" ], "severity": "high" }, { "id": "filesystem-write-shell-risk", "name": "Persistence + execution risk", "description": "Shell execution plus filesystem write means the agent can plant persistent backdoors (e.g. modifying startup scripts).", "capabilities": [ "shell:execute", "filesystem:write" ], "severity": "medium" }, { "id": "full-control-risk", "name": "Full-control risk", "description": "Shell + filesystem write + network is effectively a remote shell on the employee machine.", "capabilities": [ "shell:execute", "filesystem:write", "network:outbound" ], "severity": "critical" } ] }, "dangerousCombos": [ { "id": "exfiltration-risk", "name": "Data exfiltration risk", "description": "Shell execution combined with outbound network access can exfiltrate arbitrary data from the machine.", "capabilities": [ "shell:execute", "network:outbound" ], "severity": "high" }, { "id": "credential-theft-risk", "name": "Credential theft risk", "description": "Filesystem write combined with credentials access can plant persistent credential stealers.", "capabilities": [ "filesystem:write", "credentials:access" ], "severity": "high" }, { "id": "filesystem-write-shell-risk", "name": "Persistence + execution risk", "description": "Shell execution plus filesystem write means the agent can plant persistent backdoors (e.g. modifying startup scripts).", "capabilities": [ "shell:execute", "filesystem:write" ], "severity": "medium" }, { "id": "full-control-risk", "name": "Full-control risk", "description": "Shell + filesystem write + network is effectively a remote shell on the employee machine.", "capabilities": [ "shell:execute", "filesystem:write", "network:outbound" ], "severity": "critical" } ] }, { "kind": "extension", "slug": "blackbox-ai", "name": "Blackbox AI", "vendor": "Blackbox", "description": "Blackbox AI is an AI code-search and chat extension that markets itself as an all-in-one developer assistant — autocomplete, chat with the codebase, code-to-image search, and a browser companion. It is one of the higher-installed extensions in the AI category on the VS Code Marketplace, but it is also the entry in Anomity's catalog with the most opaque trust posture: the underlying model and the routing of user prompts are not publicly documented in detail, the vendor's privacy policy has shifted multiple times, and independent audits of what the extension transmits are not readily available.\n\nDeclared capabilities include reading files in the open workspace to construct prompts, making outbound network requests to Blackbox's hosted backend, and reading and writing credentials stored in the IDE for the user's Blackbox account. It does not declare filesystem write or shell execution.\n\nBlackbox AI is assigned the unknown trust level in the catalog — the highest trust adjustment — because the publisher's identity is not verifiable to the level of an official marketplace vendor and because the closed backend means the actual data flow cannot be confirmed from the outside. Combined with the credentials + outbound network signal, this is the kind of extension that should be evaluated carefully before installation on machines with access to proprietary code.", "website": "https://blackbox.ai", "repository": null, "documentationUrl": null, "license": null, "version": null, "trustLevel": "unknown", "capabilities": [ "filesystem:read", "network:outbound", "credentials:access" ], "packaging": { "manager": "vsix", "packageName": "Blackboxapp.blackbox" }, "configFiles": null, "category": null, "updatedAt": "2026-09-02T18:21:41.256Z", "risk": { "score": 80, "band": "critical", "signals": [ { "id": "trust-unknown", "kind": "trust", "label": "Unknown publisher", "contribution": 20 }, { "id": "high-risk-capabilities", "kind": "capability", "label": "1 high-risk capability: credentials:access", "contribution": 10 } ], "dangerousCombos": [] }, "dangerousCombos": [] }, { "kind": "extension", "slug": "continue", "name": "Continue", "vendor": "Continue", "description": "Continue is an open-source IDE extension that brings autocomplete, chat, and inline edits to VS Code and JetBrains using any LLM provider or local model. It's distributed on the VS Code Marketplace and JetBrains Marketplace, with the core engine published under an Apache 2.0 license, so teams can self-host the model layer and audit what the extension does on disk.\n\nIts declared capabilities include reading files in the open workspace and across configured context providers, writing edits back into source files when the user accepts a suggestion, making outbound network requests to the configured model and embedding providers, and accessing credentials stored in the IDE secret store. Continue does not request shell execution by default, which gives it a notably smaller blast radius than the fully-agentic extensions in the same category.\n\nFrom a risk standpoint, the extension is community-maintained and pairs filesystem write with credentials access — enough to match the credential-theft dangerous combination — but lacks the shell-execute capability that would push it into exfiltration territory. Teams adopting Continue should restrict its model providers to vetted endpoints and avoid pointing it at credentials that are not scoped to the developer's workstation.", "website": "https://continue.dev", "repository": null, "documentationUrl": null, "license": null, "version": null, "trustLevel": "community", "capabilities": [ "filesystem:read", "filesystem:write", "network:outbound", "credentials:access" ], "packaging": { "manager": "vsix", "packageName": "Continue.continue" }, "configFiles": null, "category": null, "updatedAt": "2026-09-02T18:21:41.256Z", "risk": { "score": 75, "band": "high", "signals": [ { "id": "trust-community", "kind": "trust", "label": "Established community project", "contribution": -10 }, { "id": "high-risk-capabilities", "kind": "capability", "label": "2 high-risk capabilities: filesystem:write, credentials:access", "contribution": 20 }, { "id": "credential-theft-risk", "kind": "combination", "label": "Credential theft risk (high)", "description": "Filesystem write combined with credentials access can plant persistent credential stealers.", "contribution": 15 } ], "dangerousCombos": [ { "id": "credential-theft-risk", "name": "Credential theft risk", "description": "Filesystem write combined with credentials access can plant persistent credential stealers.", "capabilities": [ "filesystem:write", "credentials:access" ], "severity": "high" } ] }, "dangerousCombos": [ { "id": "credential-theft-risk", "name": "Credential theft risk", "description": "Filesystem write combined with credentials access can plant persistent credential stealers.", "capabilities": [ "filesystem:write", "credentials:access" ], "severity": "high" } ] }, { "kind": "extension", "slug": "sourcegraph-cody", "name": "Sourcegraph Cody", "vendor": "Sourcegraph", "description": "Cody is Sourcegraph's AI coding assistant, distinguished from peers by tight integration with the Sourcegraph code-graph platform — it can pull context from any repository indexed by a Sourcegraph instance, not only the file currently open. That makes it particularly effective on large monorepos and across services owned by different teams. It is distributed for VS Code, JetBrains, and the Sourcegraph web app.\n\nDeclared capabilities include reading workspace files, writing edits back to files when the developer accepts a suggestion, making outbound network requests to either Sourcegraph's hosted Cody service or a self-hosted Sourcegraph instance, and accessing the user's Sourcegraph and provider API credentials. Shell execution is not requested by the extension itself, though some agent workflows in newer versions can run commands when explicitly opted in.\n\nCody is community trust in the catalog because Sourcegraph is not a marketplace-publisher trust authority. The combination of filesystem write plus credential access matches the credential-theft dangerous combination; the recommended posture is to use a workspace-scoped Sourcegraph account, prefer the self-hosted deployment for sensitive codebases, and review which repositories are indexed before granting Cody access.", "website": "https://sourcegraph.com/cody", "repository": null, "documentationUrl": null, "license": null, "version": null, "trustLevel": "community", "capabilities": [ "filesystem:read", "filesystem:write", "network:outbound", "credentials:access" ], "packaging": { "manager": "vsix", "packageName": "sourcegraph.cody-ai" }, "configFiles": null, "category": null, "updatedAt": "2026-09-02T18:21:41.256Z", "risk": { "score": 75, "band": "high", "signals": [ { "id": "trust-community", "kind": "trust", "label": "Established community project", "contribution": -10 }, { "id": "high-risk-capabilities", "kind": "capability", "label": "2 high-risk capabilities: filesystem:write, credentials:access", "contribution": 20 }, { "id": "credential-theft-risk", "kind": "combination", "label": "Credential theft risk (high)", "description": "Filesystem write combined with credentials access can plant persistent credential stealers.", "contribution": 15 } ], "dangerousCombos": [ { "id": "credential-theft-risk", "name": "Credential theft risk", "description": "Filesystem write combined with credentials access can plant persistent credential stealers.", "capabilities": [ "filesystem:write", "credentials:access" ], "severity": "high" } ] }, "dangerousCombos": [ { "id": "credential-theft-risk", "name": "Credential theft risk", "description": "Filesystem write combined with credentials access can plant persistent credential stealers.", "capabilities": [ "filesystem:write", "credentials:access" ], "severity": "high" } ] }, { "kind": "extension", "slug": "aixcoder", "name": "aiXcoder", "vendor": "aiXcoder", "description": "aiXcoder offers code completion for VS Code and JetBrains with an emphasis on deployable-on-premises models, aimed at organisations that want assistance without source code leaving their network.\n\nIn its local deployment the extension reads the workspace and writes accepted completions without outbound network access — a genuinely different risk profile from cloud assistants, and the reason it appears in procurement shortlists for regulated environments. The catalogued capability set reflects the local configuration; a hosted deployment adds outbound network and should be scored as such. Verify which mode is actually configured, because the difference is the entire security argument.", "website": "https://www.aixcoder.com", "repository": null, "documentationUrl": null, "license": null, "version": null, "trustLevel": "community", "capabilities": [ "filesystem:read", "filesystem:write" ], "packaging": { "manager": "vsix", "packageName": "aixcoder.aixcoder" }, "configFiles": null, "category": null, "updatedAt": "2026-09-02", "risk": { "score": 50, "band": "medium", "signals": [ { "id": "trust-community", "kind": "trust", "label": "Established community project", "contribution": -10 }, { "id": "high-risk-capabilities", "kind": "capability", "label": "1 high-risk capability: filesystem:write", "contribution": 10 } ], "dangerousCombos": [] }, "dangerousCombos": [] }, { "kind": "extension", "slug": "augment", "name": "Augment", "vendor": "Augment Code", "description": "Augment is an enterprise-focused AI coding assistant whose pitch centers on continuous, full-repository codebase indexing. Instead of feeding a model only the file currently open, Augment maintains a dense semantic index of the entire codebase and feeds the most relevant snippets into every completion, chat, or refactor — which becomes especially valuable on large, polyglot monorepos.\n\nThe extension reads files across the open workspace and across any repositories the team has connected to Augment's index, makes outbound network requests to Augment's hosted service for completions, chat, and indexing pushes, and stores credentials for the user's Augment account in the IDE secret store. It does not request filesystem write or shell execute permissions, which makes its declared attack surface narrower than the fully agentic coding extensions.\n\nAugment is community trust in Anomity's catalog because it is an independent vendor rather than a marketplace platform. The active risk signals come from the credential + outbound network pairing, which is the standard cost of any SaaS coding assistant. Teams adopting Augment should validate the vendor's data-handling and code-residency terms — the value of full-repo indexing comes with the cost of transmitting all of that code to the vendor.", "website": "https://augmentcode.com", "repository": null, "documentationUrl": null, "license": null, "version": null, "trustLevel": "community", "capabilities": [ "filesystem:read", "network:outbound", "credentials:access" ], "packaging": { "manager": "vsix", "packageName": "augment.vscode-augment" }, "configFiles": null, "category": null, "updatedAt": "2026-09-02T18:21:41.256Z", "risk": { "score": 50, "band": "medium", "signals": [ { "id": "trust-community", "kind": "trust", "label": "Established community project", "contribution": -10 }, { "id": "high-risk-capabilities", "kind": "capability", "label": "1 high-risk capability: credentials:access", "contribution": 10 } ], "dangerousCombos": [] }, "dangerousCombos": [] }, { "kind": "extension", "slug": "bito", "name": "Bito", "vendor": "Bito", "description": "Bito provides AI chat, code explanation, test generation, and an AI code review agent inside VS Code and JetBrains, positioned around review and comprehension as much as generation.\n\nIt reads the workspace, writes generated code and tests when accepted, and calls its hosted service, so it declares filesystem read and write plus outbound network. Test generation is the feature worth a caveat: generated tests that pass against current behaviour lock in that behaviour, bugs included, which is useful as a regression harness and misleading as evidence of correctness.", "website": "https://bito.ai", "repository": null, "documentationUrl": null, "license": null, "version": null, "trustLevel": "community", "capabilities": [ "filesystem:read", "filesystem:write", "network:outbound" ], "packaging": { "manager": "vsix", "packageName": "Bito.Bito" }, "configFiles": null, "category": null, "updatedAt": "2026-09-02", "risk": { "score": 50, "band": "medium", "signals": [ { "id": "trust-community", "kind": "trust", "label": "Established community project", "contribution": -10 }, { "id": "high-risk-capabilities", "kind": "capability", "label": "1 high-risk capability: filesystem:write", "contribution": 10 } ], "dangerousCombos": [] }, "dangerousCombos": [] }, { "kind": "extension", "slug": "codegeex", "name": "CodeGeeX", "vendor": "Zhipu AI", "description": "CodeGeeX is a multilingual code generation and completion extension from Zhipu AI, available for VS Code and JetBrains, with strong support for Chinese-language prompts and comments alongside English.\n\nIt reads workspace files for context, inserts accepted completions, and sends context to its hosted service, so it declares filesystem read and write with outbound network access. The relevant consideration for most enterprise reviewers is data residency: context is processed by infrastructure in a jurisdiction that may sit outside their approved list, which is a compliance question rather than a code-quality one and is best answered before rollout rather than during an audit.", "website": "https://codegeex.cn", "repository": null, "documentationUrl": null, "license": null, "version": null, "trustLevel": "community", "capabilities": [ "filesystem:read", "filesystem:write", "network:outbound" ], "packaging": { "manager": "vsix", "packageName": "aminer.codegeex" }, "configFiles": null, "category": null, "updatedAt": "2026-09-02", "risk": { "score": 50, "band": "medium", "signals": [ { "id": "trust-community", "kind": "trust", "label": "Established community project", "contribution": -10 }, { "id": "high-risk-capabilities", "kind": "capability", "label": "1 high-risk capability: filesystem:write", "contribution": 10 } ], "dangerousCombos": [] }, "dangerousCombos": [] }, { "kind": "extension", "slug": "pieces-for-developers", "name": "Pieces for Developers", "vendor": "Pieces", "description": "Pieces captures snippets, context, and workflow history into a local repository an assistant can draw on, with a long-term memory feature that records what you were working on across applications.\n\nIt reads and writes local storage and reaches the network for model calls, so it declares filesystem read and write with outbound network. The memory feature is the reason it is worth reviewing carefully rather than installing casually: a tool that continuously records developer activity across applications builds a detailed corpus of what was on screen, which is valuable to the developer and would be equally valuable to an attacker who reached the machine.", "website": "https://pieces.app", "repository": null, "documentationUrl": null, "license": null, "version": null, "trustLevel": "community", "capabilities": [ "filesystem:read", "filesystem:write", "network:outbound" ], "packaging": { "manager": "vsix", "packageName": "MeshIntelligentTechnologiesInc.pieces-vscode" }, "configFiles": null, "category": null, "updatedAt": "2026-09-02", "risk": { "score": 50, "band": "medium", "signals": [ { "id": "trust-community", "kind": "trust", "label": "Established community project", "contribution": -10 }, { "id": "high-risk-capabilities", "kind": "capability", "label": "1 high-risk capability: filesystem:write", "contribution": 10 } ], "dangerousCombos": [] }, "dangerousCombos": [] }, { "kind": "extension", "slug": "qodo", "name": "Qodo (Codium)", "vendor": "Qodo", "description": "Qodo, formerly known as CodiumAI, is an AI extension focused on test generation and automated code review rather than the general chat-and-completion category. Inside the IDE it reads the function the developer is working on, proposes a set of behavioral tests, and surfaces likely edge-case failures; in the pull request flow it leaves contextual review comments on changed code through a companion GitHub app.\n\nDeclared capabilities include reading files in the open workspace to gather context for test generation and review, making outbound network requests to Qodo's hosted service for model inference, and accessing the user's Qodo and provider credentials stored in the IDE secret store. The extension does not request filesystem write or shell execute permissions — generated tests are inserted by the IDE on acceptance, and any test execution happens through the user's own commands.\n\nQodo is community trust because it is an independent vendor. The credential plus outbound network pairing produces a routine risk signal but does not match any dangerous combination. The notable cost is the same as any SaaS coding assistant: the source code being reviewed is transmitted to the vendor on each request, so teams in regulated environments should validate the data-handling agreement before rollout.", "website": "https://qodo.ai", "repository": null, "documentationUrl": null, "license": null, "version": null, "trustLevel": "community", "capabilities": [ "filesystem:read", "network:outbound", "credentials:access" ], "packaging": { "manager": "vsix", "packageName": "Codium.codium" }, "configFiles": null, "category": null, "updatedAt": "2026-09-02T18:21:41.256Z", "risk": { "score": 50, "band": "medium", "signals": [ { "id": "trust-community", "kind": "trust", "label": "Established community project", "contribution": -10 }, { "id": "high-risk-capabilities", "kind": "capability", "label": "1 high-risk capability: credentials:access", "contribution": 10 } ], "dangerousCombos": [] }, "dangerousCombos": [] }, { "kind": "extension", "slug": "sourcery", "name": "Sourcery", "vendor": "Sourcery", "description": "Sourcery reviews and refactors code in the editor, originally focused on Python and later broadened, suggesting concrete simplifications with a preview of the rewritten form rather than a general comment.\n\nIt reads project files and applies refactors on acceptance, so it declares filesystem read and write, with outbound network for its hosted analysis. Mechanical refactoring is a good fit for automation because the transformations are behaviour-preserving by construction — the risk is the accumulation of many small accepted changes in a single commit, which is hard to review as a unit. Keep refactor commits separate from behavioural ones.", "website": "https://sourcery.ai", "repository": null, "documentationUrl": null, "license": null, "version": null, "trustLevel": "community", "capabilities": [ "filesystem:read", "filesystem:write", "network:outbound" ], "packaging": { "manager": "vsix", "packageName": "sourcery.sourcery" }, "configFiles": null, "category": null, "updatedAt": "2026-09-02", "risk": { "score": 50, "band": "medium", "signals": [ { "id": "trust-community", "kind": "trust", "label": "Established community project", "contribution": -10 }, { "id": "high-risk-capabilities", "kind": "capability", "label": "1 high-risk capability: filesystem:write", "contribution": 10 } ], "dangerousCombos": [] }, "dangerousCombos": [] }, { "kind": "extension", "slug": "supermaven", "name": "Supermaven", "vendor": "Supermaven", "description": "Supermaven is an AI code completion extension that is built around a custom model designed for very low latency and a context window large enough to feed entire repositories. It targets VS Code, JetBrains, Neovim, and a handful of other editors, and is one of the few extensions in the autocomplete category that markets sub-100ms response times as a primary differentiator.\n\nIts declared capabilities are deliberately narrow for a category that often over-asks. The extension reads files in the open workspace to assemble context for completions, makes outbound network requests to Supermaven's hosted completion service, and reads the locally stored Supermaven credential. It does not request filesystem write access — the IDE handles insertion of accepted suggestions — and does not execute shell commands.\n\nSupermaven is community trust because it is published by an independent vendor rather than a marketplace platform. The credential plus outbound network pairing is the only one that lights up Anomity's risk signals, and it does not match any dangerous combination. The residual concern is the standard one for hosted-completion products: source code from your workspace is transmitted to the vendor on every request, so teams under confidentiality controls should validate Supermaven's data-handling terms before adopting it broadly.", "website": "https://supermaven.com", "repository": null, "documentationUrl": null, "license": null, "version": null, "trustLevel": "community", "capabilities": [ "filesystem:read", "network:outbound", "credentials:access" ], "packaging": { "manager": "vsix", "packageName": "Supermaven.supermaven" }, "configFiles": null, "category": null, "updatedAt": "2026-09-02T18:21:41.256Z", "risk": { "score": 50, "band": "medium", "signals": [ { "id": "trust-community", "kind": "trust", "label": "Established community project", "contribution": -10 }, { "id": "high-risk-capabilities", "kind": "capability", "label": "1 high-risk capability: credentials:access", "contribution": 10 } ], "dangerousCombos": [] }, "dangerousCombos": [] }, { "kind": "extension", "slug": "tabby", "name": "Tabby", "vendor": "TabbyML", "description": "Tabby is a self-hosted, open-source coding assistant: you run the inference server, and the editor extensions for VS Code, JetBrains, and Vim talk to it. No code reaches a vendor because there is no vendor endpoint.\n\nThe extension reads workspace context and writes accepted completions, talking to a server you control. That makes it one of the lowest-risk assistants in the catalog for organisations whose main concern is code leaving the perimeter. The trade-offs are operational rather than security-related — you own the GPU, the model updates, and the uptime — and the honest note is that self-hosted models generally trail hosted frontier models in suggestion quality.", "website": "https://tabby.tabbyml.com", "repository": "https://github.com/TabbyML/tabby", "documentationUrl": null, "license": null, "version": null, "trustLevel": "community", "capabilities": [ "filesystem:read", "filesystem:write", "network:outbound" ], "packaging": { "manager": "vsix", "packageName": "TabbyML.vscode-tabby" }, "configFiles": null, "category": null, "updatedAt": "2026-09-02", "risk": { "score": 50, "band": "medium", "signals": [ { "id": "trust-community", "kind": "trust", "label": "Established community project", "contribution": -10 }, { "id": "high-risk-capabilities", "kind": "capability", "label": "1 high-risk capability: filesystem:write", "contribution": 10 } ], "dangerousCombos": [] }, "dangerousCombos": [] }, { "kind": "extension", "slug": "tabnine", "name": "Tabnine", "vendor": "Tabnine", "description": "Tabnine is one of the original AI code completion extensions, predating most of its current competitors and notable for offering both cloud-hosted and fully on-premises deployment models. It supports VS Code, JetBrains IDEs, Visual Studio, Neovim, Eclipse, and several other editors, and ships with enterprise features around codebase indexing, single-tenant deployment, and air-gapped model hosting.\n\nThe extension reads source files in the open workspace to assemble context for completions and chat, makes outbound network requests to Tabnine's hosted model or to a self-hosted Tabnine endpoint, and accesses stored credentials for the user's Tabnine account. It does not request filesystem write access for completions — accepted suggestions are inserted by the IDE itself — and does not execute shell commands.\n\nTabnine is a community trust level in Anomity's catalog because it is not a marketplace-first-party vendor. The credential + outbound network pairing is shared with most coding assistants and is not by itself a dangerous combination, but teams with strict data-handling requirements should evaluate the self-hosted plan rather than the SaaS one.", "website": "https://tabnine.com", "repository": null, "documentationUrl": null, "license": null, "version": null, "trustLevel": "community", "capabilities": [ "filesystem:read", "network:outbound", "credentials:access" ], "packaging": { "manager": "vsix", "packageName": "TabNine.tabnine-vscode" }, "configFiles": null, "category": null, "updatedAt": "2026-09-02T18:21:41.256Z", "risk": { "score": 50, "band": "medium", "signals": [ { "id": "trust-community", "kind": "trust", "label": "Established community project", "contribution": -10 }, { "id": "high-risk-capabilities", "kind": "capability", "label": "1 high-risk capability: credentials:access", "contribution": 10 } ], "dangerousCombos": [] }, "dangerousCombos": [] }, { "kind": "extension", "slug": "twinny", "name": "Twinny", "vendor": "twinnydotdev", "description": "Twinny is a free, open-source VS Code extension providing completion and chat against locally-run models via Ollama or any OpenAI-compatible endpoint, with no account and no telemetry by default.\n\nIt reads the workspace and writes accepted completions, reaching only the local or configured endpoint. Pointed at a local model it is about as private as an AI assistant gets, and its risk score reflects a genuinely small surface. The caveat is trust in the package rather than the model: it is a community extension whose updates arrive through the marketplace, and an extension with workspace write access is a meaningful supply-chain position — pin versions where that matters.", "website": "https://twinny.dev", "repository": "https://github.com/twinnydotdev/twinny", "documentationUrl": null, "license": null, "version": null, "trustLevel": "community", "capabilities": [ "filesystem:read", "filesystem:write", "network:outbound" ], "packaging": { "manager": "vsix", "packageName": "rjmacarthy.twinny" }, "configFiles": null, "category": null, "updatedAt": "2026-09-02", "risk": { "score": 50, "band": "medium", "signals": [ { "id": "trust-community", "kind": "trust", "label": "Established community project", "contribution": -10 }, { "id": "high-risk-capabilities", "kind": "capability", "label": "1 high-risk capability: filesystem:write", "contribution": 10 } ], "dangerousCombos": [] }, "dangerousCombos": [] }, { "kind": "extension", "slug": "amazon-q-developer", "name": "Amazon Q Developer", "vendor": "Amazon Web Services", "description": "Amazon Q Developer is AWS's AI coding assistant, shipping as an extension for VS Code, JetBrains IDEs, and Visual Studio. It offers inline completion, chat over your workspace, an agentic mode that can implement multi-file changes, and AWS-specific abilities such as explaining a CloudFormation template or upgrading a Java runtime across a codebase.\n\nIts distinguishing capability is the cloud connection: signed in with AWS credentials, it can read account context and act against AWS APIs, which is materially broader than a code-completion extension. Combined with workspace reads and writes and outbound calls to the model service, that puts it in the higher band of this catalog. The upgrade and transformation features in particular make sweeping automated edits — review those as you would a large refactor PR, and scope the IAM role it authenticates with rather than reusing an administrator profile.", "website": "https://aws.amazon.com/q/developer/", "repository": null, "documentationUrl": null, "license": null, "version": null, "trustLevel": "official", "capabilities": [ "filesystem:read", "filesystem:write", "network:outbound", "credentials:access" ], "packaging": { "manager": "vsix", "packageName": "AmazonWebServices.amazon-q-vscode" }, "configFiles": null, "category": null, "updatedAt": "2026-09-02", "risk": { "score": 45, "band": "medium", "signals": [ { "id": "trust-official", "kind": "trust", "label": "Published by the vendor", "contribution": -40 }, { "id": "high-risk-capabilities", "kind": "capability", "label": "2 high-risk capabilities: filesystem:write, credentials:access", "contribution": 20 }, { "id": "credential-theft-risk", "kind": "combination", "label": "Credential theft risk (high)", "description": "Filesystem write combined with credentials access can plant persistent credential stealers.", "contribution": 15 } ], "dangerousCombos": [ { "id": "credential-theft-risk", "name": "Credential theft risk", "description": "Filesystem write combined with credentials access can plant persistent credential stealers.", "capabilities": [ "filesystem:write", "credentials:access" ], "severity": "high" } ] }, "dangerousCombos": [ { "id": "credential-theft-risk", "name": "Credential theft risk", "description": "Filesystem write combined with credentials access can plant persistent credential stealers.", "capabilities": [ "filesystem:write", "credentials:access" ], "severity": "high" } ] }, { "kind": "extension", "slug": "gemini-code-assist", "name": "Gemini Code Assist", "vendor": "Google", "description": "Gemini Code Assist is Google's official AI coding assistant, distributed as a first-party extension for VS Code, JetBrains IDEs, Cloud Shell Editor, and the Google Cloud Console. It is powered by the Gemini model family and integrates tightly with Google Cloud — both for authentication (developers sign in with their Google account) and for tooling, with built-in support for explaining Google Cloud APIs, generating Terraform, and reviewing changes against Google's style guides.\n\nThe extension reads the current file plus configurable workspace context to construct prompts, makes outbound network requests to Google's Gemini service through the developer's Google Cloud project, and uses an OAuth credential negotiated with the user's Google account to authenticate. It does not write to disk autonomously or execute shell commands; suggestions are inserted by the IDE on acceptance.\n\nBecause Gemini Code Assist is officially published by Google, its trust adjustment is the most favorable available. The residual risk is the same as Copilot's — credentials plus outbound network mean that the contents of the developer's editor are transmitted to Google's service on each request. Teams with data-residency requirements should evaluate the enterprise tier and the regional endpoint configuration before broad rollout.", "website": "https://cloud.google.com/gemini/code-assist", "repository": null, "documentationUrl": null, "license": null, "version": null, "trustLevel": "official", "capabilities": [ "filesystem:read", "network:outbound", "credentials:access" ], "packaging": { "manager": "vsix", "packageName": "Google.geminicodeassist" }, "configFiles": null, "category": null, "updatedAt": "2026-09-02T18:21:41.256Z", "risk": { "score": 20, "band": "low", "signals": [ { "id": "trust-official", "kind": "trust", "label": "Published by the vendor", "contribution": -40 }, { "id": "high-risk-capabilities", "kind": "capability", "label": "1 high-risk capability: credentials:access", "contribution": 10 } ], "dangerousCombos": [] }, "dangerousCombos": [] }, { "kind": "extension", "slug": "github-copilot", "name": "GitHub Copilot", "vendor": "GitHub", "description": "GitHub Copilot is GitHub's official AI pair-programmer, distributed as a first-party extension across VS Code, Visual Studio, JetBrains IDEs, Neovim, Xcode, and the GitHub web UI. Backed by GitHub and Microsoft, it is the most widely-deployed AI coding extension in the world and one of the few that ships with enterprise-grade subscription tiers, audit logs, content-exclusion policies, and IP indemnification for business and enterprise plans.\n\nThe extension reads the file the developer is working in plus a configurable amount of additional repository context to construct prompts, makes outbound network requests to GitHub's Copilot service to retrieve completions and chat answers, and uses an OAuth credential negotiated with the user's GitHub account to authenticate those requests. It does not write to disk autonomously outside of the developer's accept gesture and does not execute shell commands unless the Copilot Agent mode is explicitly enabled by the user.\n\nBecause Copilot is officially published by GitHub, its trust adjustment is the most favorable in the catalog. The remaining residual risk is the credential-plus-network pairing — every keystroke in a Copilot-enabled file is potentially transmitted to GitHub's service, so teams subject to data-residency or confidentiality controls should evaluate Copilot Business or Enterprise rather than the consumer plan.", "website": "https://github.com/features/copilot", "repository": null, "documentationUrl": null, "license": null, "version": null, "trustLevel": "official", "capabilities": [ "filesystem:read", "network:outbound", "credentials:access" ], "packaging": { "manager": "vsix", "packageName": "GitHub.copilot" }, "configFiles": null, "category": null, "updatedAt": "2026-09-02T18:21:41.256Z", "risk": { "score": 20, "band": "low", "signals": [ { "id": "trust-official", "kind": "trust", "label": "Published by the vendor", "contribution": -40 }, { "id": "high-risk-capabilities", "kind": "capability", "label": "1 high-risk capability: credentials:access", "contribution": 10 } ], "dangerousCombos": [] }, "dangerousCombos": [] }, { "kind": "extension", "slug": "jetbrains-ai-assistant", "name": "JetBrains AI Assistant", "vendor": "JetBrains", "description": "JetBrains' first-party AI plugin, bundled across IntelliJ IDEA, PyCharm, WebStorm, and the rest of the IDE family. It provides completion, chat with project context, commit-message generation, and refactoring suggestions built on the IDE's own program model rather than on plain text — which is why its suggestions understand types and call hierarchies that a token-level tool cannot see.\n\nIt reads the project, applies edits when accepted, and sends context to JetBrains' AI service, so it declares filesystem read and write plus outbound network. Being vendor-published it takes the official trust adjustment. The setting that matters for a security review is which files are excluded from context collection: IDE-integrated assistants see everything the IDE has indexed, including configuration files that were never meant to leave the machine.", "website": "https://www.jetbrains.com/ai/", "repository": null, "documentationUrl": null, "license": null, "version": null, "trustLevel": "official", "capabilities": [ "filesystem:read", "filesystem:write", "network:outbound" ], "packaging": { "manager": "jetbrains-plugin", "packageName": "com.intellij.ml.llm" }, "configFiles": null, "category": null, "updatedAt": "2026-09-02", "risk": { "score": 20, "band": "low", "signals": [ { "id": "trust-official", "kind": "trust", "label": "Published by the vendor", "contribution": -40 }, { "id": "high-risk-capabilities", "kind": "capability", "label": "1 high-risk capability: filesystem:write", "contribution": 10 } ], "dangerousCombos": [] }, "dangerousCombos": [] } ] }