AI SQLite Editor — NL2SQL, AI SQL Copilot & Database Browser

AI Security Review

Evidence context: threat category none; evidence quality moderate.

The extension's stated job is browsing and editing SQLite files inside a workspace, with an AI layer that turns plain English into SQL. That job requires reading and writing the .db files a user opens, and it requires outbound calls to whichever model provider the user supplies a key for. Both capabilities show up in the findings. Nothing else does.

Network. Three findings, NET-FETCH-extension/out/extension.js-3, NET-FETCH-extension/out/extension.js-6 and NET-FETCH-extension/out/webview/assets/index-74d800ae.js-2, mark outbound fetch calls in the compiled extension entry point and in the webview bundle. For a text-to-SQL feature these are the request path to the model API, and the description's "bring your own key" framing matches that. The manifest records no declared permissions, no host permissions and no enumerated endpoints, so the destination is selected at runtime from whatever provider the user configures.

Obfuscation. OBFUSCATION-FUNCTION_INDIRECT-extension/out/extension.js-3 and the matching hit in extension/out/webview/assets/index-74d800ae.js-2 flag functions invoked through a variable instead of a literal name. extension/out is TypeScript compiler output and the webview asset is a Vite build. The (0, fn)() calling convention and memoised module helpers both produce that shape, and the same pattern appears in essentially every bundled VS Code webview. There are no encoded string tables, no packed payloads and no invisible-character content anywhere in the two hit files.

Credential access. There are zero secret findings. Nothing in the evidence reads .env, .ssh, .aws or .git/config, and no credential-provider or keychain access is flagged. For a tool whose AI feature asks the user to paste in an API key, that restraint is the baseline you would want, and it is met here.

Process and filesystem scope. No child_process, shell or postinstall behaviour appears in any finding title, and the extension declares no special permissions. Row editing is performed against files the user explicitly opens through the editor, which is the documented function of a SQLite browser.

The remaining volume is 44 low-severity code-smell entries plus three dependency entries. Those are pattern matches on minified bundle output and a bundled npm tree; they describe the build, not behaviour. The dependency entries carry no advisory name in the evidence.

Strongest counterargument. With no endpoint list, an AI extension could ship schema or row contents to any host it likes, and 282 installs is a thin trust signal for a publisher we cannot tie to a verified organisation. That is a data-handling question rather than a code-integrity one, and it does not move the verdict. To change it we would need a fetch site pointing at an unadvertised host, an activation hook that runs on install, or a credential read. None of those appear: the fetch findings sit in the same module as command registration, and the activation-triggered payload pattern that would make this malicious is absent.

Key Reasons

• Outbound fetch findings in extension/out/extension.js and the webview bundle match the advertised text-to-SQL model calls
• FUNCTION_INDIRECT matches occur only in TypeScript and Vite compiled output, a standard bundler calling convention
• No credential, secret or .env/.ssh access findings; zero IoC and malware-signature matches
• No child_process, shell or activation-time download behaviour in any finding title
• Manifest declares no special permissions or host permissions

False Positive Considerations

• FUNCTION_INDIRECT matches on tsc/Vite bundle helper calls in extension/out
• NET-FETCH hits are the request path for the extension's own AI feature
• 44 low-severity code-smell matches on minified webview JavaScript
• No enumerated endpoints or declared permissions to anchor a destination check

Reviewed 2026-10-18; recommended action: suppress false positive; model confidence 78%.