Check O17 · agent provenance family · severity CRITICAL · extension only · one of the 17 Open VSX checks
Maps to OWASP LLM03 OWASP LLM09 ATLAS AML.T0060 ATLAS AML.T0100 An agent surfaced this to you. ATLAS names both halves: an entity registered to match a name a model invented, and content crafted to bait an agent into acting on it.
The question this check asks: did an AI chat assistant or an MCP directory lead you to this extension? Not whether the extension is about AI — whether the route you took to it went through one. Today RepoGates cannot answer that for Open VSX, and this page says so.
O17 is the Open VSX counterpart of GitHub's C22: an assistant's recommendation reads as vetting to the person receiving it, and it is not vetting. Island's AgentBaiting research showed the mechanism on GitHub. Only the browser sees the route at navigation time, and there is no board on Open VSX's pages to read it.
O17 does not run today. Its one input is the browser; on the API path that input is never present, so every verdict lists O17 as not checked, with the reason “decided in the browser at navigation time”. It does not withhold PASS. The scoring table's agent-provenance row — CRITICAL at 25 points, a note at 5 — is matched by finding, not by platform, so the weight is defined; how C22 applies it is on its own page.
None, because nothing runs. That is a different claim from “zero false positives measured”.
Everything until a board on Open VSX's pages exists. An agent that recommends an extension and installs it for you is seen by the hook only if it runs an --install-extension line in Claude Code.
Scope, the same on every page of this roster: RepoGates does not see git clone, package managers or curl — outside Claude Code with the RepoGates plugin, whose hook refuses a clone or install that names a blocked repository on the command line, before it runs. The hook sees Bash tool calls in that one client and nothing else. Edit and Write are read for one thing only — an API key about to be saved — checked on the machine and never sent; that guard asks, it never denies. Open VSX is the registry VSCodium, Cursor and Windsurf install from. An extension there is assessed on request: through the API (/v1/ovsx/score/{namespace}/{extension}), the MCP server (platform="ovsx") and the preflight, which reads an open-vsx.org address and a codium, vscodium, cursor or windsurf --install-extension line. That line is read against both Open VSX and the VS Code Marketplace, because it cannot show which registry the editor uses; code --install-extension stays the Marketplace's. An extension installed from the editor's own UI, or one that auto-updates, is not a shell line the hook sees; there is no board on Open VSX's pages, and the browser's download gate does not read open-vsx.org. This roster reads what Open VSX publishes about an extension — its record, its version history, its manifest, the package's file list and at most eight agent files inside the package — and the extension's code bundle is not read on this tier. Open VSX's own scan results are admin-only and not published; its review status is evidence, and its silence is never a pass. An extension Open VSX no longer serves is not assessed, never a pass. A PASS means nothing matched on what was read.
curl -s https://open-vsx.org/api/NAMESPACE/EXTENSION | jq .nameThere is nothing to check by hand: the route you took is in your own browser history.
Does O17 run today? No. It needs the browser to watch the route to an Open VSX page, and no board on those pages exists. Every verdict lists it as not checked, never as passed.
Why keep a check that does not run? So the roster says what it cannot see. A skipped check stated as a skip is honest; leaving it out would let the roster imply it had been considered.
Is this the same as C22? It is C22's counterpart. C22 runs on github.com in the browser extension; O17 would need the same on Open VSX's pages.
C22 Agent provenance — the check that runs · V17 AI-agent provenance — the Marketplace twin · M10 AI-agent provenance — the same gap on the MCP registry.
Add RepoGates to Chrome Pricing
Sources for this page: Open VSX's published record format, read on 1 November 2026; the measurement of Open VSX's 100 most-downloaded extensions the same day; the severities from the product's roster, and the default weights of its scoring table; campaign facts as the primary write-ups state them. See also the Open VSX intelligence page.