bridgecode

AI Security Review

Evidence context: threat category none; evidence quality moderate.

BridgeCode advertises AI agents running in parallel VS Code terminals, voice commands, and a backlog board. The code in the extension does those things.

On filesystem and process access: the manifest carries no permission declarations at all, so behavior is set entirely by the shipped JavaScript. The network findings are fetch and WebSocket calls in extension/dist/extension.js, extension/dist/utils/cliUpdateCheck.js and extension/dist/core/VoiceCaptureService.js. A WebSocket at extension/dist/extension.js:71686 is how a terminal-attached agent streams model output. The fetch in cliUpdateCheck.js asks whether a newer CLI build exists. VoiceCaptureService.js sends recorded audio to a speech-to-text service. For an extension whose headline feature is talking to AI agents, none of that is out of scope. Spawning terminals is the product.

The critical obfuscation findings are the noisiest part of this review. Each one is titled OBFUSCATION-NATIVE_BINARY_ADDON and points into extension/scripts/bin/sox/: zlib1.dll, libsox-3.dll, libflac-8.dll, libvorbis-0.dll, libwinpthread-1.dll and the rest. Those files are the stock Windows build of SoX, the long-running open source audio utility, together with its compression and threading dependencies. The rule fires on the presence of a compiled binary, not on packing or encryption. SoX is the tool a voice-command feature uses to convert microphone audio before it leaves the machine. Shipping it as a DLL is a design decision users should know about. It is not concealment.

On credentials, there are no secret-scanning hits, no .env parsing and no reads of .ssh or cloud credential files. The two tool-poisoning findings, SKILL-CREDENTIAL-ACCESS-extension/bundled/cli/claude/skills/server-management/SKILL.md-130 and SKILL-CREDENTIAL-ACCESS-extension/bundled/cli/claude/skills/red-team-tactics/SKILL.md-36, are line matches inside markdown instruction files in a bundled Claude skills folder. Those are prompts an agent reads, not code the extension executes. A skill called server-management will mention credentials the way a man page does.

The strongest counterargument is reach. An agent that drives terminals, a bundled audio engine, outbound fetch and WebSocket calls, and instruction files mentioning credential access is a lot of capability for an extension with roughly a thousand installs from an unfamiliar publisher. Reach is not intent. The endpoints line up with the advertised features, no malware signature or IoC matched anything, and the low-severity code-smell matches repeat the same few rules across minified bundles in dist/, which is what any webpack build produces.

The one artifact whose text was not inspected is the red-team-tactics skill file. Bundled agent instructions can steer an agent through prompt injection, and that is the only place in this extension where such text would live.

Key Reasons

• Outbound fetches sit in feature files: cliUpdateCheck.js for CLI updates, VoiceCaptureService.js for speech-to-text, extension.js:71686 for the agent WebSocket
• Critical obfuscation findings are stock SoX Windows DLLs (libsox-3.dll, libflac-8.dll, zlib1.dll) under extension/scripts/bin/sox/, flagged for being compiled binaries rather than packed
• No .env, .ssh or credential-store access; the only credential hits are SKILL.md markdown lines under extension/bundled/cli/claude/skills/
• No malware signature, IoC or secret-scanning matches; the low-severity volume is minified dist/ webpack output
• Observed network behavior matches the stated purpose of terminal AI agents plus voice capture, and the manifest declares no permissions

False Positive Considerations

• OBFUSCATION-NATIVE_BINARY_ADDON fires on any bundled .dll, including stock SoX audio libraries in extension/scripts/bin/sox/
• More than a thousand low-severity code-smell matches concentrated in minified dist/ bundle output
• SKILL-CREDENTIAL-ACCESS matches are text hits inside markdown agent instructions, not executable code
• NET-FETCH and NET-WEBSOCKET findings are ordinary API, update-check and streaming calls in feature files

Reviewed 2026-10-17; recommended action: monitor; model confidence 75%.