Shell Command Execution
Flags items that execute shell commands, which can be used to perform system-level operations and potentially compromise system security.
Gobelin integration for VSCode.
Flags items that execute shell commands, which can be used to perform system-level operations and potentially compromise system security.
Flags items that initiate new processes by executing files from local or remote paths. This behavior can be used to run additional code outside the extension’s scope, including potentially malicious payloads. Uncontrolled process execution increases the risk of system compromise.
Flags items published by entities that haven’t gone through the publisher verification process of the marketplace. Lack of verification may indicate higher risk, as the publisher’s identity and trustworthiness are unconfirmed.
AI-powered analysis of the extension's source code for security insights and risk assessment.
This VSCode extension named "Gobelin helper" integrates the Gobelin tool with the editor to provide formatting and project update commands for files written in the "gobelin-lang" language.
Activation and Commands:
gobelin-vscode.format to format the current file, gobelin-vscode.update to update the project, and gobelin-vscode.add.month to add a month entry.Execution of External Process:
/usr/bin/gobelin command-line tool with arguments constructed from the workspace root path and user commands.child_process.execSync to synchronously execute these commands and capture their output.File and Editor Interaction:
add.month command.const stdout = execSync(gobelinCmd, { encoding: 'utf8' });
/usr/bin/gobelin but does not create or modify files directly.The extension acts as a bridge to run the Gobelin CLI tool within VSCode, primarily for formatting and project updates. It executes an external binary synchronously but does not perform network communication or persistent changes. User input is minimally involved in command construction but limited to a controlled prompt.
API calls detected through static analysis of the source code. For more accurate insights, explore our sandbox dynamic analysis.
Any encoded/decoded secrets we managed to find in the source code, git repository, or related files
Known vulnerabilities and security issues detected in the extension's dependencies and code.
Any identifiers we detected that may indicate external communication from the item's code
Dependencies and third-party libraries used by the extension, including version information and license details.