Gen Sage

AI Security Review

Risky Plugins reviewed this extension with an AI-assisted security workflow on 2026-09-06. The review verdict is likely false positive with 80% confidence.

Recommended action: suppress false positive. Evidence context: threat category none; evidence quality moderate.

Safety for Agents is a VS Code extension that scans AI agent tool calls for dangerous commands, malicious URLs, and harmful file writes. The 80 IoC findings mostly point to documentation and reference material. That pattern reflects the extension's own safety logic instead of live network behavior.

XIOC-URL-https://mathiasbynens.be/demo/url-regex and XIOC-URL-https://mathiasbynens.be/notes/javascript-encoding reference a well-known JavaScript encoding guide. XIOC-URL-https://www.safaribooksonline.com/library/view/regular-expressions-cookbook/9780596802837/ch07s16.html links to a regex cookbook chapter. XIOC-URL-https://reddit.com/r/photopea/comments/ikekht/uzipjs_questions/ points to a Reddit thread about a zip library. These URLs sit inside source-code comments or documentation. They do not represent runtime network requests. The extension bundles these references as part of its own safety logic, which explains why a scanner would flag them. A scanner that sees these strings in a package will flag them as IoCs even though they are inert text.

Domain findings include XIOC-DOMAIN-inst.rest, XIOC-DOMAIN-config.community, and XIOC-DOMAIN-inst.safe. No threat intelligence ties these domains to malicious activity. They appear in a URL-safety pattern list or example data, which is exactly where a safety tool would keep them. XIOC-DOMAIN-install.python-poetry.org and XIOC-DOMAIN-deno.land are official installation endpoints for developer tools. A tool that validates command safety would reasonably reference those endpoints.

The SHA1 hash finding and the .cjs.map domain findings (skill-upload-worker.cjs.map, sage-hook.cjs.map) come from bundled JavaScript source maps. Source maps routinely include file names and hashes that scanners flag. A scanner that unpacks source maps will see these strings and treat them as domain indicators.

No manifest-analysis findings flag excessive permissions. The extension's stated purpose requires reading workspace files to detect harmful writes and inspecting command strings. Any file access falls within that scope. The 189 code-smell findings are low-severity YARA matches typical of minified or bundled JavaScript. Minified code often trips generic rules that look for long lines, unusual variable names, or packed data. They reflect normal bundled code. The secret category is empty. No credential-access findings target .env, SSH keys, or cloud credentials.

The strongest counterargument is the single high-severity malware-signature finding. Its title and matched file are not available, so the finding cannot be dismissed on its own. The title and matched file would settle whether that finding points to embedded malicious code. A safety tool that detects malicious URLs and commands necessarily contains patterns that resemble malware indicators, such as regexes for suspicious domains or command injection. The code shows no obfuscation. It contains no secrets. The manifest has no anomalies. The IoCs point to documentation. Together these facts make a false positive far more likely than a real threat.

Key Reasons

• IoC findings are documentation URLs and benign developer domains, not malicious infrastructure
• No secret or credential-access findings
• 189 code-smell findings are low-severity YARA noise from bundled JavaScript
• Single malware-signature finding lacks specificity and is consistent with a safety tool's detection patterns
• No obfuscation or manifest-analysis anomalies

False Positive Considerations

• IoC extractor misreads documentation URLs and source map names as domains
• YARA code-smell rules fire on minified/bundled JavaScript
• Malware-signature rule matches safety tool's own detection patterns
• Bundled dependencies inflate finding count