Is "Rocket Commit" on VS Code Marketplace Safe to Install?
# Rocket Commit **Generate intelligent commit messages with AI - 100% local and private** Rocket Commit is a Visual Studio Code extension that uses local artificial intelligence to automatically generate descriptive commit messages based on your code changes. No internet connection or external APIs required after initial setup. ## โจ Features - ๐ค **Local AI**: Uses the Qwen2.5-Coder-1.5B model running entirely on your machine - ๐ **Total Privacy**: Your code never leaves your computer - ๐ **Descriptive Commits**: Generates messages following commit conventions - โก **Fast and Efficient**: Optimized model (Q4_K_M) for performance - ๐ **Easy to Use**: One click from the Source Control panel - ๐ **Works Offline**: After downloading the model, no connection required ## ๐ Requirements - Visual Studio Code v1.97.0 or higher - Node.js (recommended: LTS version) - Disk space: ~1GB for the AI model ## ๐ Installation 1. Install the extension from the [VS Code Marketplace](https://marketplace.visualstudio.com/items?itemName=Jonpena.rocket-commit) 2. On first use, the extension will automatically download the AI model (~900MB) 3. Ready to use! ## ๐ก Usage 1. **Stage your changes**: Use `git add` to prepare the files you want to commit ```bash git add . ``` 2. **Generate the message**: Click the rocket icon (๐) in the Source Control toolbar 3. **Review and confirm**: The generated message will appear in the input box. Review it and commit ### From Command Palette You can also use the command from the command palette (Ctrl/Cmd + Shift + P): ``` Generate Commit with AI ``` ## ๐ง How It Works 1. **Analysis**: The extension obtains the diff of staged changes (`git diff --staged`) 2. **Processing**: Filters and cleans the diff to focus on relevant changes 3. **Generation**: The AI model analyzes the changes and generates a descriptive message 4. **Optimization**: Post-processes the message to comply with best practices ### Technologies Used - **[node-llama-cpp](https://github.com/withcatai/node-llama-cpp)**: Runs LLM models locally in Node.js - **[Qwen2.5-Coder-1.5B](https://huggingface.co/Qwen/Qwen2.5-Coder-1.5B)**: Code-specialized model - **Q4_K_M Quantization**: Optimal balance between performance and quality ## ๐ Configuration The model comes configured with optimized parameters: ```typescript { maxTokens: 80, // Maximum message length temperature: 0.4, // Moderate creativity topP: 0.95, // Response diversity topK: 50 // Number of candidate tokens } ``` ## ๐๏ธ Project Structure ``` vscode-rocket-commit/ โโโ src/ โ โโโ commands/ # Extension commands โ โโโ services/ # Business logic (Git, AI, HTTP) โ โโโ providers/ # VSCode providers โ โโโ utils/ # Utilities and helpers โ โโโ constants/ # Configuration and constants โโโ images/ # Visual resources โโโ dist/ # Compiled build ``` ## ๐ค Contributing Contributions are welcome! If you want to improve Rocket Commit: 1. Fork the repository 2. Create a branch for your feature (`git checkout -b feature/AmazingFeature`) 3. Commit your changes (`git commit -m 'Add some AmazingFeature'`) 4. Push to the branch (`git push origin feature/AmazingFeature`) 5. Open a Pull Request ### Local Development ```bash # Clone the repository git clone https://github.com/joncodeofficial/vscode-rocket-commit.git # Install dependencies npm install # Compile in watch mode npm run watch # Run tests npm test # Linting npm run lint ``` ## ๐ Changelog See [CHANGELOG.md](https://github.com/joncodeofficial/vscode-rocket-commit/blob/HEAD/CHANGELOG.md) to learn about changes in each version. ## ๐ Report Issues Found a bug? [Open an issue](https://github.com/joncodeofficial/vscode-rocket-commit/issues) ## ๐ License This project is licensed under the Apache 2.0 License. See the [LICENSE](https://github.com/joncodeofficial/vscode-rocket-commit/blob/HEAD/LICENSE) file for more details. ## ๐ Acknowledgments - [Qwen Team](https://github.com/QwenLM) for the Qwen2.5-Coder model - [node-llama-cpp](https://github.com/withcatai/node-llama-cpp) for the inference library - The VSCode community for the tools and documentation ## ๐ง Contact Jonathan - [@joncodeofficial](https://github.com/joncodeofficial) Project Link: [https://github.com/joncodeofficial/vscode-rocket-commit](https://github.com/joncodeofficial/vscode-rocket-commit) --- **Like Rocket Commit?** โญ Star the repo and share it with other developers!
Risk Assessment
Analyzed4065 security findings detected across all analyzers
VS Code extension analyzed via package manifest and static code analysis
Severity Breakdown
Finding Categories
YARA Rules Matched
15 rules(1000 hits)About This Extension
Detailed Findings
1000 totalYARA Rule Matches
15 rulesSecurity Analysis Summary
Security Analysis Overview
Rocket Commit is a Visual Studio Code Marketplace extension published by joncode. Version 1.0.4 has been analyzed by the Risky Plugins security platform, receiving a risk score of 63.05/100 (MEDIUM risk) based on 4065 security findings.
Risk Assessment
This extension presents high security risk. Significant concerns were identified during analysis. It is not recommended for use in sensitive or production environments without thorough review.
Findings Breakdown
- High: 1432 finding(s)
- Medium: 2631 finding(s)
- Low: 2 finding(s)
What Was Analyzed
The security assessment covers multiple analysis categories:
- Malware Detection: YARA rule matching against 2,400+ malware signatures
- Secret Detection: Scanning for exposed API keys, tokens, and credentials
- Static Analysis: Code-level security analysis for common vulnerability patterns
- Network Analysis: Detection of suspicious network communications and endpoints
- Obfuscation Detection: Identification of code obfuscation techniques
Developer Information
Rocket Commit is published by joncode on the Visual Studio Code Marketplace marketplace. The extension has approximately 3 users.
Recommendation
This extension is not recommended for installation without thorough manual review. Consider alternatives with lower risk scores, or contact the developer to address the identified security concerns.
Source Code Not Available
Source code is not available for this version of the extension.
Frequently Asked Questions
Similar Extensions
Related extensions from the same publisher or marketplace