Snowflake

AI Security Review

Evidence context: threat category none; evidence quality strong.

The extension is published by Snowflake itself, listed on OpenVSX as version 1.39.0, and has 347,263 users. Its stated job is to connect to Snowflake, run SQL, and show results in VS Code. The evidence package lists no declared permissions and no network endpoints. The findings do not come from an over-broad manifest. It is an official mirror of a popular data tool, not a lookalike.

Every finding is a tool-poisoning entry titled SKILL-CREDENTIAL-ACCESS. They all point at Markdown files inside the extension's bundled AI skill tree: extension/bin/bundled_skills/iceberg/horizon-irc-diagnose/storage-creds-errors/SKILL.md:125, extension/bin/bundled_skills/iceberg/catalog-integration/biglake-catalog-integration-setup/gcp-setup/SKILL.md:184, extension/bin/bundled_skills/iceberg/catalog-integration/glueirc-catalog-integration-setup/create/SKILL.md:460, and extension/bin/bundled_external_plugins/databricks/skills/databricks-local-testing/SKILL.md:234. Those documents walk a user through connecting AWS Glue, Google BigLake, OneLake, and Delta Sharing catalogs. The credential-access rule matches sentences about creating storage credentials, IAM roles, and catalog connections. The files are instructions, not executed scripts.

Filesystem and process access are not visible here. No manifest permissions, no network calls, no postinstall hook, and no child_process reference appear in the findings. A SQL client that reads workspace SQL files or talks to the Snowflake API would be doing its stated job. There is no evidence it goes beyond that.

The credential findings do not target real secrets. None of the matched paths are .env files, SSH keys, .git/config, or cloud credential stores. The rule is scanning prose that tells a human how to configure credentials in their own cloud account. That is the opposite of stealing them.

The strongest counterargument is the volume and severity. Thirty-nine critical entries about credential access is a pattern that usually warrants a hard look. But the descriptions are empty and every path ends in SKILL.md, a documentation file. The bundle also includes external Databricks plugin documentation, which multiplies the number of Markdown files scanned without changing what the matches are. The package has zero IoC hits, zero malware signatures, zero obfuscation findings, zero secret findings, and zero code-smell hits. A real credential stealer would leave executable code, not just setup guides. The rule is firing on bundled documentation for an official extension with hundreds of thousands of users. That pattern is a false positive.

Key Reasons

• Official Snowflake-published extension with 347,263 users on OpenVSX, not a typosquat or re-upload.
• All 39 findings are SKILL-CREDENTIAL-ACCESS matches inside bundled Markdown skill guides for cloud catalog setup, not executable code.
• No manifest permissions, network endpoints, IoC, malware, obfuscation, secret or code-smell findings accompany the tool-poisoning entries.
• Credential-access rule fires on documentation describing IAM and storage credential setup, not on reads of .env, .ssh or cloud credential files.
• The extension's stated purpose as a SQL client for Snowflake justifies any workspace SQL file access.

False Positive Considerations

• Documentation-scoped CREDENTIAL-ACCESS rule matching setup prose in SKILL.md files.
• Empty finding descriptions with no code context.
• Critical severity labels on inert Markdown files inflate apparent risk.
• Bundled AI skill and external plugin trees (iceberg, databricks) multiply rule matches across many docs.

Reviewed 2026-10-12; recommended action: suppress false positive; model confidence 94%.