AI Error Message Humanizer — Rewrite Cryptic Errors with OpenRouter

AI Security Review

Evidence context: threat category none; evidence quality moderate.

The extension reads the code around a thrown error and sends it to a model provider for rewriting, so a network call in the compiled entry point comes with the territory. The single network finding, NET-FETCH-extension/out/extension.js-1 at extension/out/extension.js:1:0, marks a fetch in the bundled output. Nothing in the file set describes child_process spawning, a postinstall hook, or a download-and-execute path: malware-signature, malware and tool-poisoning all come back empty. The manifest declares no permissions and no host_permissions, the normal shape for a VS Code extension that works through the editor's workspace API instead of a declared capability list. Reading the active file and posting a snippet to openrouter.ai matches the published description, including the pay-per-token billing it advertises.

Credential exposure does not surface anywhere. The secret category holds zero findings, and none of the code-smell matches is a credential-read rule. No finding touches .env, .git/config, ~/.ssh, or VS Code's SecretStorage. An extension that needs one user-supplied OpenRouter key has no reason to reach for those paths, and nothing here says it does.

The endpoints deserve a plain reading. openrouter.ai serves the advertised API. img.shields.io supplies README badges, errors.new shows up in Go error-handling documentation and string constants, and schemas.openxmlformats.org is an XML namespace identifier that bundled OOXML libraries carry as a literal, so it never resolves to a host. The indicator hits land on IPv6 fragments and domain-shaped property chains lifted from minified code, which is what the extractor does to any bundle. The code-smell matches land on out/extension.js, compiled webpack or esbuild output where every bundled library contributes its own patterns.

The strongest counterargument is by-ciromaciel.click, a subdomain that carries the publisher's own name (Ciro Cesar Maciel) yet points somewhere other than the model provider. A host like that could carry telemetry the description never mentions. It does not change the conclusion, because the extension already ships the user's code to a third-party model API by design; a publisher-controlled host adds no capability the advertised flow lacks. The real caveat is track record. Zero installs at version 0.0.4 means no independent history against which to check what that subdomain receives. That argues for watching the endpoint over time, and it would argue for escalation if a future build were caught posting workspace content there.

Key Reasons

• The only network finding, NET-FETCH-extension/out/extension.js-1 in extension/out/extension.js:1:0, matches the extension's advertised call to openrouter.ai
• Secret findings total zero: no reads of .env, .git/config, SSH keys or SecretStorage appear in the evidence
• No postinstall, process-spawn or download-and-execute findings; malware, malware-signature and tool-poisoning categories are empty
• Voluminous IoC and code-smell hits trace to minified build output in out/extension.js plus README badges and XML namespace strings
• Publisher-owned endpoint by-ciromaciel.click and a zero-install 0.0.4 release leave no behavioral track record

False Positive Considerations

• IoC extractor matches on img.shields.io badges, schemas.openxmlformats.org namespace constants and IPv6 fragments from minified strings
• Code-smell YARA rules firing on bundled webpack/esbuild output in extension/out/extension.js
• A fetch call flagged as a network finding when the extension's stated purpose requires one
• errors.new treated as a contacted host when it is a documentation site appearing in string constants

Reviewed 2026-10-17; recommended action: monitor; model confidence 72%.