The AI review rates the findings as likely false positive, but the risk score (78/100) still counts them.
Analysis record
- Analysed
- 3 days ago
- Version
- v0.1.33
- Artifact
- SHA256 DAC…EB1
- Source
- Findings (non-IoC)
Is Gnosis AI safe?
Gnosis adds semantic code search, AI Blame and an agent chat panel to VS Code, and it comes from a publisher listed as JetBrains on OpenVSX, with 42 installs so far. The extension declares no special permissions. The endpoint list attached to it offers nothing real: entries such as apikeystatusitem.show, body.chat and args.report come from property access chains inside bundled JavaScript, so the extractor read code identifiers as hostnames.
The network findings sit in extension/node_modules/@agentclientprotocol/sdk/dist/server.test.js and its neighbours, which hold the test files for a bundled Agent Client Protocol library. A fetch call in a test file exercises an HTTP client against a test server. Two findings marked critical, SKILL-CREDENTIAL-ACCESS, point at markdown under extension/resources/worktrees/SKILL.md and extension/resources/gnosis-knowledge-skill/SKILL.md, where the writing covers how to handle credentials.
If a skill file told an AI agent to read your .env and send it somewhere, that would matter, because agent chat follows those instructions. Here the matches land on prose inside the extension's own skill library. The scanner logged no malware signatures, no secret access and no obfuscation anywhere in the package, and the agent has no destination endpoint to leak to.
Evidence ledger
Ranked by severity · findings with a source location link to the code viewer
YARA Rule Matches
16 rules| Severity | Rule | Hits | Files | Metadata |
|---|---|---|---|---|
| LOW | DebuggerStatementsShouldNotBeUsed | 1 | dist/extension.js | - |
| LOW | UsingCommandLineArguments | 8 | scripts/check-bundle-esm.mjsscripts/render-readme-figures.mjsout/test/suite/71tc40tc41DistillModelEdgeUi.test.js +5 more | - |
| LOW | postinstall file download | 134 | media/trajectory/main.jsmedia/taskTrace/main.jsout/chatter/ui/vscode/chatDetail/tocRenderer.js +131 more | - |
| LOW | NoUseWeakRandom | 22 | media/status/main.jsmedia/flows/main.jsdist/extension.js +19 more | - |
| LOW | NoUseEval | 4 | out/test/suite/chatCostChip.test.jsout/test/suite/chatDiagramView.test.jsdist/extension.js +1 more | - |
| LOW | SQLInjection | 5 | media/status/main.jsout/gnosisReset.jsmedia/worktree/main.js +2 more | - |
| LOW | credential env files | 138 | out/test/suite/18tc11CleanProjectUi.test.jsout/test/suite/elicitationMcpServerConfig.test.jsout/test/suite/47tc29TreeLabelsUi.test.js +135 more | - |
| LOW | postinstall persistence mechanism | 37 | out/test/runTestsSupport.jsout/test/suite/chatterDecorations.test.jsout/chatter/platform/WorkspaceRuntime.js +34 more | - |
| LOW | postinstall crypto operations | 64 | out/chatter/vendor/acp/npxRecovery.jsout/chatter/vendor/acp/PermissionHandler.jsout/test/suite/24tc14bNoGitFetchUi.test.js +61 more | - |
| LOW | postinstall registry modification | 65 | out/test/suite/worktreeOverview.test.jsout/test/suite/chatDetailTestRegistry.test.js.mapout/worktrees/workspaceScope.js +62 more | - |
| LOW | postinstall network communication | 48 | out/test/suite/57tc31OutsideWorkspaceUi.test.jsout/branchReviewPanel.jsout/review/panelSettingsModel.js +45 more | - |
| LOW | postinstall system command | 63 | out/test/suite/chatterUiChatHelpers.jsout/test/suite/gnosisIgnore.test.jsout/review/findingAgentTools.js +60 more | - |
| LOW | postinstall file manipulation | 250 | resources/embark-call-graph-install.shout/taskQueue/taskQueueModel.jsout/review/reviewWhy.js +247 more | - |
| LOW | postinstall obfuscation | 76 | out/review/panelSettingsModel.jsout/agentMessages.jsmedia/taskFlow/main.js +73 more | - |
| LOW | OriginsNotVerified | 12 | media/search/main.jsmedia/resolution/main.jsmedia/reviewMap/main.js +9 more | - |
| LOW | UsingShellInterpreterWhenExecutingOSCommands | 9 | out/embarkCli.jsscripts/build-gnosis-wheel.mjsout/worktrees/groupActions.js +6 more | - |
Publisher Evidence
LowJetBrains
Publisher identity, store signals, distribution reach, and warning signals used for context. Treat this as supporting evidence, not a clean bill of health.
12 evidence rows available.
Finding Categories
YARA Rules Matched
16 rules(936 hits)AI Security Report
AI Security Review
Evidence context: threat category none; evidence quality moderate.
Gnosis describes itself as knowledge aggregation and AI-agent tooling for VS Code: semantic code search, conversation cost and quality reports, task classification, AI Blame, a linked knowledgebase, and a built-in agent chat. That stated job covers the file reads and process spawns an extension like this needs, and nothing found here goes past it.
Workspace and process access. The scan surfaced no filesystem-access findings and no shell execution tied to activation or install. The only executable-code findings are HTTP fetches, and every one of them sits inside the Agent Client Protocol SDK bundled under node_modules: extension/node_modules/@agentclientprotocol/sdk/dist/server.test.js, server-session-sse.test.js, ws-stream.test.js, node-adapter.test.js and server-permission.test.js. Those are the upstream library's own test files, packed by the build. The fetch at server.test.js:730 drives a client against a test server; the one at ws-stream.test.js:76 does the same over a websocket. A dependency's test suite calling a local test server says nothing about the publisher.
Endpoint list. The domains attributed to this extension read as code identifiers: apikeystatusitem.show, body.chat, args.report, bundle.report, air.search, backbone.radio, badges.gitter.im. Property access chains in minified JavaScript produce those strings, and the extractor treats them as hostnames. IoC volume here tracks bundle size.
Credential findings. Two critical items carry the weight: SKILL-CREDENTIAL-ACCESS-extension/resources/worktrees/SKILL.md-45 and SKILL-CREDENTIAL-ACCESS-extension/resources/gnosis-knowledge-skill/SKILL.md-80. Both point at markdown instruction files in the extension's skill library. A skill file teaches the built-in agent how to work with a repository or a knowledgebase, and credential handling belongs in that text. Neither finding targets executable code that opens .env, .ssh or cloud credential files, and no secret-access match fired anywhere in the package. The manifest declares no permissions and no host permissions.
Strongest counterargument. For an agent extension, skill markdown earns scrutiny: a SKILL.md that tells the model to collect API keys and send them somewhere would count as tool poisoning and would run with the agent's privileges. That would flip this verdict if the files carried exfiltration instructions or if any code acted on such a line. What exists are text matches on credential-related lines inside two resource files, with no payload behind them and no destination endpoint that could receive a key.
Bulk noise. The low-severity rules that match generic JavaScript idioms account for the vast majority of what the scan reported, a predictable outcome when a package ships a node_modules tree and a built agent UI. Read the file paths: dependency test files, bundled libraries, resource markdown. None of them describe behaviour the extension's description does not already promise.
Key Reasons
- All NET-FETCH findings are confined to bundled test files under extension/node_modules/@agentclientprotocol/sdk/dist/ (server.test.js, ws-stream.test.js, server-permission.test.js).
- Both critical SKILL-CREDENTIAL-ACCESS findings point at markdown resources (extension/resources/worktrees/SKILL.md, extension/resources/gnosis-knowledge-skill/SKILL.md) rather than executable credential-reading code.
- No malware signatures, no secret-access matches and no obfuscation findings; the manifest lists no permissions and no host permissions.
- The attributed endpoint list consists of code identifiers misread as domains (apikeystatusitem.show, body.chat, args.report, backbone.radio).
- The stated purpose (semantic search, AI agent chat, knowledgebase skills) explains the file and process usage.
False Positive Considerations
- XIOC extractor converting minified property access chains into hostnames
- Bundled @agentclientprotocol/sdk test files shipping fetch calls inside node_modules
- SKILL-CREDENTIAL-ACCESS text rule matching instructional markdown instead of code
- Code-smell rule volume across a full node_modules tree
Reviewed 2026-10-15; recommended action: no action; model confidence 76%.
Open VSX version history
Risk trend by version
2 analyzed versions. Each point is the latest successful scan for that version; failed zero-score scans are hidden. Dates are based on first seen by risky plugins.
Pick any point on the chart to explore that version's code below.
Source Code Not Available
Source code is not available for this version of the extension.
About This Extension
Frequently Asked Questions
Similar Extensions
Related extensions from the same publisher or marketplace