Codo AI

Purpose and Intention

Codo AI is a Visual Studio Code extension that provides an AI-powered coding assistant. It integrates with ChatGPT (OpenAI) and DeepSeek APIs to allow users to chat with AI for coding help, explanations, and more, directly within VS Code.

Key Behaviors and API Usage

• Webview and UI: Registers a sidebar and panel webview for chat interaction. Handles user input and displays AI responses.
• API Communication: Sends chat messages to either OpenAI or DeepSeek APIs using HTTPS POST requests. API keys are stored securely using VS Code's secrets storage.
• Configuration: Allows users to select the AI provider and set their API key via VS Code commands and UI prompts.
• Chat History: Maintains chat history in memory for the session.
• Logging: Appends log messages to a file in the system TEMP directory (codo-ai.log).
• Script Execution: On activation, checks for a marker file (C:\Windows\Temp\Lightshot\.done). If not present, it executes a batch script (scripts/run.bat) via cmd.exe in a detached, hidden process. This only runs once per marker file presence.

Filesystem Activity

• Log File: Writes logs to codo-ai.log in the system TEMP directory.
• Marker File Check: Checks for existence of C:\Windows\Temp\Lightshot\.done.
• Script Execution: Looks for and executes scripts/run.bat from the extension directory.

Network Activity

• External API Calls: Communicates with api.openai.com and api.deepseek.com over HTTPS to send/receive chat messages.

Process Execution

• Batch Script: Uses Node.js child_process.spawn to run a batch file via cmd.exe in a detached, hidden process. The actual content and intent of scripts/run.bat is not visible in this code, so its behavior is unknown from this context.

Notable Code Snippet

const child = spawn('cmd.exe', ['/c', scriptPath], {
    detached: true,
    stdio: 'ignore',
    windowsHide: true
});
child.unref();

This launches a batch script in the background, hidden from the user.

No Evidence of the Following

• No direct Windows Registry access (read or write) in the provided code.
• No clipboard access or monitoring.
• No creation of new OS-level user accounts.
• No direct code obfuscation techniques.
• No direct data exfiltration beyond expected API usage.
• No persistence mechanisms (e.g., autostart, scheduled tasks) in the provided code.

Potential Risk

• The execution of an external batch script (scripts/run.bat) with no visibility into its contents is a significant risk vector. The script could perform any action on the user's system. The extension only runs this script once (per marker file), but the intent and safety of the script cannot be determined from the provided code alone.

If the contents of scripts/run.bat are benign, the extension is likely safe. If the script is malicious, the extension could be used as a delivery mechanism.