Check O13 · agent surface family · severity LOW · automatic · one of the 17 Open VSX checks
Maps to OWASP LLM01 OWASP LLM03 ATLAS AML.T0110.000 ATLAS AML.T0081 A file the agent reads as instruction is the model-visible tool definition ATLAS names; the check reports that one is present and what it says, never that it is hostile.
The question this check asks: does the package carry files an AI agent reads as instructions or configuration — CLAUDE.md, AGENTS.md, .mcp.json, a Cursor rule, a Copilot instructions file and the like?
These files tell an agent what to do and which tools to start. In a repository they apply to whoever opens it. Inside an extension package they are a stranger's text sitting on the developer's machine, and what is in them is what O14 to O16 read.
O13 is C18's file list applied to the package's own files. Inside a package each file is agent-config:<path>, a note with 0 points: an installed extension's directory is not a workspace an agent opens. Up to eight such files are read out of the package by byte range, 64 KB each, for O14 to O16. A hook file shipped inside a package is named as a note for the same reason.
6 of the 100 most-downloaded extensions measured on 1 November 2026 ship one or more agent files (CLAUDE.md, AGENTS.md, Claude Code settings, an .mcp.json, a Copilot instructions file); every one is a note.
An agent that reads the extension's folder anyway, if a user opens it as a workspace. Files past the eighth, and files over 64 KB, are not read.
Scope, the same on every page of this roster: RepoGates does not see git clone, package managers or curl — outside Claude Code with the RepoGates plugin, whose hook refuses a clone or install that names a blocked repository on the command line, before it runs. The hook sees Bash tool calls in that one client and nothing else. Edit and Write are read for one thing only — an API key about to be saved — checked on the machine and never sent; that guard asks, it never denies. Open VSX is the registry VSCodium, Cursor and Windsurf install from. An extension there is assessed on request: through the API (/v1/ovsx/score/{namespace}/{extension}), the MCP server (platform="ovsx") and the preflight, which reads an open-vsx.org address and a codium, vscodium, cursor or windsurf --install-extension line. That line is read against both Open VSX and the VS Code Marketplace, because it cannot show which registry the editor uses; code --install-extension stays the Marketplace's. An extension installed from the editor's own UI, or one that auto-updates, is not a shell line the hook sees; there is no board on Open VSX's pages, and the browser's download gate does not read open-vsx.org. This roster reads what Open VSX publishes about an extension — its record, its version history, its manifest, the package's file list and at most eight agent files inside the package — and the extension's code bundle is not read on this tier. Open VSX's own scan results are admin-only and not published; its review status is evidence, and its silence is never a pass. An extension Open VSX no longer serves is not assessed, never a pass. A PASS means nothing matched on what was read.
curl -sL -o x.vsix "$(curl -s https://open-vsx.org/api/NAMESPACE/EXTENSION | jq -r .files.download)" && unzip -l x.vsix | grep -Ei 'claude|agents|\.mcp|cursor|copilot'That downloads the package to your machine; RepoGates reads only the matching files.
Why is an agent file only a note here? Because an installed extension's folder is not a workspace an agent opens. The same file in a repository is read differently.
Are the files read? Yes, up to eight of them at 64 KB each, for O14 to O16.
Is the extension's code read? No. Only the agent files are read out of the package.
V13 Agent config files — the Marketplace twin · C18 Agent config files — the same list in a repository · O14 Hidden Unicode in agent rules — what is read in them.
Add RepoGates to Chrome Pricing
Sources for this page: Open VSX's published record format, read on 1 November 2026; the measurement of Open VSX's 100 most-downloaded extensions the same day; the severities from the product's roster, and the default weights of its scoring table; campaign facts as the primary write-ups state them. See also the Open VSX intelligence page.