Check O15 · agent surface family · severity CRITICAL · automatic · one of the 17 Open VSX checks
Maps to OWASP LLM03 OWASP LLM06 ATLAS AML.T0110.001 ATLAS AML.T0050 A configuration that launches a shell when the agent starts is the tool's implementation, not its description.
The question this check asks: does an MCP configuration shipped in the package start its server through a shell, or with a line that downloads code and runs it?
An MCP entry is a command an agent's client runs. One that pipes a download into a shell runs whatever that address serves on the day it is started.
O15 is C20's reading on the agent files O13 read out of the package. A shell launch or a fetch-and-run line is mcp-exec:<path>, CRITICAL, 30 points, and the verdict is BLOCK; under the personal default profile the action is a warning, as for C20, and the organisation profiles block. A hook that runs a file shipped in the package is a note: an installed extension's directory is not a workspace an agent opens, so it does not run from there.
It fired on none of the 100 most-downloaded extensions measured on 1 November 2026; one of them ships an .mcp.json.
A loader in the code. GlassWorm v2's sleepers fetched a .vsix payload from a GitHub release and installed it with the editor's own command line (Socket, 25 April 2026); that is the bundle, not a configuration file, and no check on this tier sees it.
Scope, the same on every page of this roster: RepoGates does not see git clone, package managers or curl — outside Claude Code with the RepoGates plugin, whose hook refuses a clone or install that names a blocked repository on the command line, before it runs. The hook sees Bash tool calls in that one client and nothing else. Edit and Write are read for one thing only — an API key about to be saved — checked on the machine and never sent; that guard asks, it never denies. Open VSX is the registry VSCodium, Cursor and Windsurf install from. An extension there is assessed on request: through the API (/v1/ovsx/score/{namespace}/{extension}), the MCP server (platform="ovsx") and the preflight, which reads an open-vsx.org address and a codium, vscodium, cursor or windsurf --install-extension line. That line is read against both Open VSX and the VS Code Marketplace, because it cannot show which registry the editor uses; code --install-extension stays the Marketplace's. An extension installed from the editor's own UI, or one that auto-updates, is not a shell line the hook sees; there is no board on Open VSX's pages, and the browser's download gate does not read open-vsx.org. This roster reads what Open VSX publishes about an extension — its record, its version history, its manifest, the package's file list and at most eight agent files inside the package — and the extension's code bundle is not read on this tier. Open VSX's own scan results are admin-only and not published; its review status is evidence, and its silence is never a pass. An extension Open VSX no longer serves is not assessed, never a pass. A PASS means nothing matched on what was read.
jq '.mcpServers' .mcp.jsonRun it on the .mcp.json of an unpacked package and read each command.
Why is this critical? Because the line runs code the configuration does not contain, chosen by whoever controls the address on the day it starts.
Why does the personal profile only warn? Because the same shape is how some legitimate servers start, and the personal profile warns on it for C20 too. The organisation profiles block.
Is a hook in the package a finding? No, a note: an installed extension's folder is not a workspace an agent opens.
V15 MCP shell-launch config — the Marketplace twin · C20 MCP shell launch — the same reading in a repository · M8 Launch arguments — the same question about a registry server.
Add RepoGates to Chrome Pricing
Sources for this page: Open VSX's published record format, read on 1 November 2026; the measurement of Open VSX's 100 most-downloaded extensions the same day; the severities from the product's roster, and the default weights of its scoring table; campaign facts as the primary write-ups state them. See also the Open VSX intelligence page.