Is AutoCR safe to use?

AutoCR has a security risk score of 80.91/100 (HIGH risk). Our security analysis detected 114 findings. Review the detailed security assessment below to understand the specific risks before installation.

What are the security risks of AutoCR?

Based on our automated security analysis, AutoCR presents high risk level. The extension is analyzed for malware patterns, secret exposure, network communications, permissions, and supply chain vulnerabilities.

How is the security score calculated?

Risky Plugins calculates security scores using weighted categories: severity of findings (25 points max), malware detections (35 points), secret exposure (28 points), network communications (10 points), and obfuscation (10 points). Scores range from 0-100, with higher scores indicating greater risk.

What does CRITICAL, HIGH, MEDIUM, LOW, MINIMAL risk mean?

CRITICAL (80-100): Severe security issues like malware. HIGH (60-79): Significant vulnerabilities. MEDIUM (40-59): Moderate security concerns. LOW (20-39): Minor issues. MINIMAL (0-19): Very low risk. Always review findings before installing any extension.

Is "AutoCR" on OpenVSX Registry Safe to Install?

Name: AutoCR
Availability: InStock
Author: ApolloNaco

ApolloNaco · openvsx · v1.0.0

在 Git commit 或 merge 后自动触发 Cursor Agent 代码审查，支持自定义模板与排除规则，审查报告输出到指定目录

Risk Assessment

Analyzed

80.91

out of 100

HIGH

114 security findings detected across all analyzers

Open VSX extension analyzed via package manifest and static code analysis

Severity Breakdown

Critical

High

Medium

Low

Info

Finding Categories

Malware Signatures

IoC Indicators

YARA Rules Matched

5 rules(18 hits)

credential env files postinstall system command postinstall crypto operations postinstall file manipulation postinstall network communication

About This Extension

在 Git commit 或 merge 后自动触发 Cursor Agent 代码审查，支持自定义模板与排除规则，审查报告输出到指定目录

Detailed Findings

49 total

YARA Rule Matches

5 rules

Indicators of Compromise

Network indicators, suspicious strings, and potential IoCs extracted during analysis

URLs

IP Addresses

Domains

Strings

All Indicators · 64

Domain

detected Domain: juejin.cn

XIOC detected Domain: juejin.cn

extracted_from_files

detected Domain: cv.iptc.org

XIOC detected Domain: cv.iptc.org

extracted_from_files

URL

detected URL: https://github.com/auto-cr/auto-cr.git

XIOC detected URL: https://github.com/auto-cr/auto-cr.git

extracted_from_files

URL

detected URL: https://github.com/auto-cr/auto-cr/issues

XIOC detected URL: https://github.com/auto-cr/auto-cr/issues

extracted_from_files

URL

detected URL: https://github.com/auto-cr/auto-cr#readme

XIOC detected URL: https://github.com/auto-cr/auto-cr#readme

extracted_from_files

URL

detected URL: https://github.com/ApolloNaco

XIOC detected URL: https://github.com/ApolloNaco

extracted_from_files

URL

detected URL: https://github.com/auto-cr/auto-cr

XIOC detected URL: https://github.com/auto-cr/auto-cr

extracted_from_files

URL

detected URL: https://img.shields.io/badge/version-1.0.0-blue.svg)](https://github.com/ApolloNaco/auto-cr/blob/master/package.json)

XIOC detected URL: https://img.shields.io/badge/version-1.0.0-blue.svg)](https://github.com/ApolloNaco/auto-cr/blob/master/package.json)

extracted_from_files

URL

detected URL: https://img.shields.io/badge/license-MIT-green.svg)](https://github.com/ApolloNaco/auto-cr/blob/master/LICENSE)

XIOC detected URL: https://img.shields.io/badge/license-MIT-green.svg)](https://github.com/ApolloNaco/auto-cr/blob/master/LICENSE)

extracted_from_files

URL

detected URL: https://marketplace.visualstudio.com/items?itemName=ApolloNaco.auto-cr)

XIOC detected URL: https://marketplace.visualstudio.com/items?itemName=ApolloNaco.auto-cr)

extracted_from_files

URL

detected URL: https://github.com/ApolloNaco/auto-cr/blob/master/LICENSE)

XIOC detected URL: https://github.com/ApolloNaco/auto-cr/blob/master/LICENSE)

extracted_from_files

URL

detected URL: https://juejin.cn/user/143390347639064)

XIOC detected URL: https://juejin.cn/user/143390347639064)

extracted_from_files

URL

detected URL: https://open-vsx.org/user-settings/tokens)

XIOC detected URL: https://open-vsx.org/user-settings/tokens)

extracted_from_files

URL

detected URL: http://www.w3.org/1999/02/22-rdf-syntax-ns#

XIOC detected URL: http://www.w3.org/1999/02/22-rdf-syntax-ns#

extracted_from_files

URL

detected URL: http://ns.adobe.com/photoshop/1.0/

XIOC detected URL: http://ns.adobe.com/photoshop/1.0/

extracted_from_files

URL

detected URL: http://iptc.org/std/Iptc4xmpExt/2008-02-29/

XIOC detected URL: http://iptc.org/std/Iptc4xmpExt/2008-02-29/

extracted_from_files

URL

detected URL: http://cv.iptc.org/newscodes/digitalsourcetype/trainedAlgorithmicMedia

XIOC detected URL: http://cv.iptc.org/newscodes/digitalsourcetype/trainedAlgorithmicMedia

extracted_from_files

URL

detected URL: https://github.com/ApolloNaco/auto-cr/issues)

XIOC detected URL: https://github.com/ApolloNaco/auto-cr/issues)

extracted_from_files

URL

detected URL: http://schemas.microsoft.com/developer/vsx-schema-design/2011

XIOC detected URL: http://schemas.microsoft.com/developer/vsx-schema-design/2011

extracted_from_files

Domain

detected Domain: microsoft.visualstudio.services.links.support

XIOC detected Domain: microsoft.visualstudio.services.links.support

extracted_from_files

Domain

detected Domain: readme.md

XIOC detected Domain: readme.md

extracted_from_files

URL

detected URL: http://schemas.openxmlformats.org/package/2006/content-types

XIOC detected URL: http://schemas.openxmlformats.org/package/2006/content-types

extracted_from_files

URL

detected URL: https://github.com/ApolloNaco)

XIOC detected URL: https://github.com/ApolloNaco)

extracted_from_files

URL

detected URL: https://dev.azure.com)

XIOC detected URL: https://dev.azure.com)

extracted_from_files

URL

detected URL: https://marketplace.visualstudio.com/manage/publishers/)

XIOC detected URL: https://marketplace.visualstudio.com/manage/publishers/)

extracted_from_files

URL

detected URL: https://open-vsx.org)

XIOC detected URL: https://open-vsx.org)

extracted_from_files

Domain

detected Domain: status-bar.js.map

XIOC detected Domain: status-bar.js.map

extracted_from_files

Domain

detected Domain: review.md

XIOC detected Domain: review.md

extracted_from_files

Domain

detected Domain: template-resolver.js.map

XIOC detected Domain: template-resolver.js.map

extracted_from_files

Domain

detected Domain: img.shields.io

XIOC detected Domain: img.shields.io

extracted_from_files

URL

detected URL: http://schemas.microsoft.com/developer/vsx-schema/2011

XIOC detected URL: http://schemas.microsoft.com/developer/vsx-schema/2011

extracted_from_files

Domain

detected Domain: apollonaco.auto

XIOC detected Domain: apollonaco.auto

extracted_from_files

Domain

detected Domain: schemas.microsoft.com

XIOC detected Domain: schemas.microsoft.com

extracted_from_files

Domain

detected Domain: error-notifier.js.map

XIOC detected Domain: error-notifier.js.map

extracted_from_files

Domain

detected Domain: git-scm.com

XIOC detected Domain: git-scm.com

extracted_from_files

Domain

detected Domain: extension.js.map

XIOC detected Domain: extension.js.map

extracted_from_files

Domain

detected Domain: hooks.js.map

XIOC detected Domain: hooks.js.map

extracted_from_files

Domain

detected Domain: report-notifier.js.map

XIOC detected Domain: report-notifier.js.map

extracted_from_files

Domain

detected Domain: review-trigger.js.map

XIOC detected Domain: review-trigger.js.map

extracted_from_files

Domain

detected Domain: item.show

XIOC detected Domain: item.show

extracted_from_files

Domain

detected Domain: changed-lines.js.map

XIOC detected Domain: changed-lines.js.map

extracted_from_files

Domain

detected Domain: command-resolver.js.map

XIOC detected Domain: command-resolver.js.map

extracted_from_files

Domain

detected Domain: vscode.configurationtarget.global

XIOC detected Domain: vscode.configurationtarget.global

extracted_from_files

Domain

detected Domain: confirm-dialog.js.map

XIOC detected Domain: confirm-dialog.js.map

extracted_from_files

Domain

detected Domain: f.name

XIOC detected Domain: f.name

extracted_from_files

Domain

detected Domain: context-resolver.js.map

XIOC detected Domain: context-resolver.js.map

extracted_from_files

Domain

detected Domain: outputchannel.show

XIOC detected Domain: outputchannel.show

extracted_from_files

Domain

detected Domain: ns.adobe.com

XIOC detected Domain: ns.adobe.com

extracted_from_files

detected Domain: iptc.org

XIOC detected Domain: iptc.org

extracted_from_files

URL

detected URL: https://git-scm.com

XIOC detected URL: https://git-scm.com

extracted_from_files

Domain

detected Domain: k.mk

XIOC detected Domain: k.mk

extracted_from_files

Domain

detected Domain: mb.aw

XIOC detected Domain: mb.aw

extracted_from_files

Domain

detected Domain: k.ch

XIOC detected Domain: k.ch

extracted_from_files

Domain

detected Domain: agent-trigger.js.map

XIOC detected Domain: agent-trigger.js.map

extracted_from_files

detected IP: ::6

XIOC detected IP: ::6

extracted_from_files

Domain

detected Domain: schemas.openxmlformats.org

XIOC detected Domain: schemas.openxmlformats.org

extracted_from_files

Domain

detected Domain: github.com

XIOC detected Domain: github.com

extracted_from_files

Domain

detected Domain: marketplace.visualstudio.com

XIOC detected Domain: marketplace.visualstudio.com

extracted_from_files

Domain

detected Domain: open-vsx.org

XIOC detected Domain: open-vsx.org

extracted_from_files

Domain

detected Domain: dev.azure.com

XIOC detected Domain: dev.azure.com

extracted_from_files

Domain

detected Domain: www.w3.org

XIOC detected Domain: www.w3.org

extracted_from_files

detected IP: ::

XIOC detected IP: ::

extracted_from_files

Hash

detected SHA1 Hash: 7b8d6f51f702640a42b999c648d973eb3ecfc517

XIOC detected SHA1 Hash: 7b8d6f51f702640a42b999c648d973eb3ecfc517

extracted_from_files

URL

detected URL: https://github.com/ApolloNaco/auto-cr/pulls)

XIOC detected URL: https://github.com/ApolloNaco/auto-cr/pulls)

extracted_from_files

Security Analysis Summary

Security Analysis Overview

AutoCR is a OpenVSX Registry extension published by ApolloNaco. Version 1.0.0 has been analyzed by the Risky Plugins security platform, receiving a risk score of 80.91/100 (HIGH risk) based on 114 security findings.

Risk Assessment

This extension presents critical security risk. Severe issues were detected, potentially including malware indicators, exposed secrets, or dangerous behaviors. Installation is strongly discouraged until these issues are addressed.

Findings Breakdown

High: 18 finding(s)
Medium: 65 finding(s)

What Was Analyzed

The security assessment covers multiple analysis categories:

Malware Detection: YARA rule matching against 2,400+ malware signatures
Secret Detection: Scanning for exposed API keys, tokens, and credentials
Static Analysis: Code-level security analysis for common vulnerability patterns
Network Analysis: Detection of suspicious network communications and endpoints
Obfuscation Detection: Identification of code obfuscation techniques

Developer Information

AutoCR is published by ApolloNaco on the OpenVSX Registry marketplace.

Recommendation

This extension is not recommended for installation without thorough manual review. Consider alternatives with lower risk scores, or contact the developer to address the identified security concerns.

Source Code Viewer

Source Code Not Available

Source code is not available for this version of the extension.

Frequently Asked Questions

Similar Extensions

Related extensions from the same publisher or marketplace

ai-command-sync

ApolloNaco

CRITICAL 373 users

ranvier-vscode

cellaxon

CRITICAL 2K users

dalidev-vscode-extension

ycteng

CRITICAL 6K users

cappy

eduardocecon

CRITICAL 1K users

quarto-report-Studio

sweaty-tstudio

CRITICAL 5K users

kylin-python

KylinIdeTeam

CRITICAL 12K users

Risk Assessment

Severity Breakdown

Finding Categories

YARA Rules Matched

About This Extension

Detailed Findings

HASH-87b1c21add6a0a48

HASH-a2e253e1cb13b51d

HASH-5f2ebfa6b6b41ef1

HASH-26ddfc23d49afb3f

HASH-9dac9b82416fef89

HASH-a882c56b034cc6ba

HASH-735ed66f57938eb4

HASH-2dfa6e81b62806d9

HASH-820be06d324dad9f

HASH-e278723c303ad51e

HASH-1d421367841d796a

HASH-59bc5c9f8c2b057d

HASH-113f65f7c99e3ed9

HASH-a365c7231ca14996

HASH-72e7bc6587fcd9b0

HASH-3d0b0cf01d5587a7

HASH-56010e2b50de037f

HASH-77fa76984c7856f9

HASH-98279005045a4dcd

HASH-cf86f0b664925cd0

HASH-291cd24b5eb220e7

HASH-b0fed1eb003518ca

HASH-072a4659a0a8b260

HASH-9a42da8aa80b1cae

HASH-b1d8671bb9b6be4a

HASH-4f8beb0e9faf68cc

HASH-c6074e2872b9bc0d

HASH-eb4b7c369b1c9012

HASH-7bf121e9e06db846

HASH-cfe18f007652b276

HASH-1556f9f13ac8998b

YARA Rule Matches

credential env files

postinstall system command

postinstall crypto operations

postinstall file manipulation

postinstall network communication

Indicators of Compromise

All Indicators · 64

Security Analysis Summary

Security Analysis Overview

Risk Assessment

Findings Breakdown

What Was Analyzed

Developer Information

Recommendation

Frequently Asked Questions

Similar Extensions

ai-command-sync

ranvier-vscode

dalidev-vscode-extension

cappy

quarto-report-Studio

kylin-python