Check O8 · execution surface family · severity HIGH · automatic · one of the 17 Open VSX checks
Maps to No OWASP LLM Top 10 risk and no MITRE ATLAS technique. VS Code's proposed-API allowlist is an editor privilege signal. Neither framework names an editor's internal API surface; the capability it grants is the editor's, not the model's.
The question this check asks: does the manifest declare enabledApiProposals — VS Code APIs that are not yet stable — and does VS Code's own allowlist grant them to this extension's id?
Stable VS Code ignores a proposed API for an extension that is not on its allowlist. VSCodium, Cursor and Windsurf are forks, and a fork may not hold the same line. Eleven proposals read the terminal or the user's sign-in state; an extension that asks for one of those is asking for more than an editor feature.
O8 compares the declared proposals with VS Code's allowlist (V8's data). An allowlisted id from a verified namespace is a note. Otherwise each proposal, five at most, is a row ovsx-api-proposal:<name>: one of the eleven that read the terminal or sign-in state is HIGH, 10 points, on any listing; any other is MEDIUM and 4 points, or a note on an established listing from a verified namespace (the default weights; the scoring table has no row of its own for the Open VSX checks yet).
The first smoke run on 1 November 2026 found an established, verified extension declaring a proposal that only changes hover detail; that is why a non-sensitive proposal on such a listing is a note. In the measurement of the 100 most-downloaded extensions, 10 declare proposals, all notes; none of the eleven sensitive ones was declared without the allowlist.
Whether the editor honours the proposal. That depends on the editor and its version, which the listing cannot show. What the code does with it: the bundle is not read on this tier.
Scope, the same on every page of this roster: RepoGates does not see git clone, package managers or curl — outside Claude Code with the RepoGates plugin, whose hook refuses a clone or install that names a blocked repository on the command line, before it runs. The hook sees Bash tool calls in that one client and nothing else. Edit and Write are read for one thing only — an API key about to be saved — checked on the machine and never sent; that guard asks, it never denies. Open VSX is the registry VSCodium, Cursor and Windsurf install from. An extension there is assessed on request: through the API (/v1/ovsx/score/{namespace}/{extension}), the MCP server (platform="ovsx") and the preflight, which reads an open-vsx.org address and a codium, vscodium, cursor or windsurf --install-extension line. That line is read against both Open VSX and the VS Code Marketplace, because it cannot show which registry the editor uses; code --install-extension stays the Marketplace's. An extension installed from the editor's own UI, or one that auto-updates, is not a shell line the hook sees; there is no board on Open VSX's pages, and the browser's download gate does not read open-vsx.org. This roster reads what Open VSX publishes about an extension — its record, its version history, its manifest, the package's file list and at most eight agent files inside the package — and the extension's code bundle is not read on this tier. Open VSX's own scan results are admin-only and not published; its review status is evidence, and its silence is never a pass. An extension Open VSX no longer serves is not assessed, never a pass. A PASS means nothing matched on what was read.
curl -sL "$(curl -s https://open-vsx.org/api/NAMESPACE/EXTENSION | jq -r .files.manifest)" | jq .enabledApiProposalsAn empty or missing list means no proposed API is asked for.
Which proposals are high? The eleven that read the terminal or sign-in state: terminal data and command events, the terminal selection and shell environment, task execution in a terminal, and six authentication proposals.
Why does it matter on Open VSX in particular? Stable VS Code ignores a proposal for an extension not on its allowlist; the editors that install from Open VSX are forks, and a fork may not.
Is a declared proposal blocked? No. The sensitive ones are a warning; the rest are a medium finding or a note.
V8 Proposed API access — the Marketplace twin, and the source of the allowlist · O7 Declares code execution — whether there is code to use the API at all.
Add RepoGates to Chrome Pricing
Sources for this page: Open VSX's published record format, read on 1 November 2026; the measurement of Open VSX's 100 most-downloaded extensions the same day; the severities from the product's roster, and the default weights of its scoring table; campaign facts as the primary write-ups state them. See also the Open VSX intelligence page.