Check V13 · agent family · automatic · one of the 17 VS Code Marketplace checks
The question this check asks: does the package you would install carry files an AI coding agent treats as instructions — and, since an installed extension does not live in your workspace, does that matter here the way it does for a repository you clone?
V13 is the same detection function as GitHub's C18 and Hugging Face's H14: the code behind C18–C21 runs unchanged on the package's file list and contents. The names it looks for are the ones an agent auto-loads at session start and treats with near-system-prompt authority — CLAUDE.md, AGENTS.md, .cursorrules, .clinerules, .windsurfrules, .github/copilot-instructions.md, .cursor/rules/*.mdc, the MCP configs .mcp.json and .cursor/mcp.json, and any .claude/*.json including .claude/settings.json. An extension can ship them for the most ordinary reason: a package is built from the publisher's working tree, and whatever the repository carries comes along unless it is excluded. prettier's package ships its repository's CLAUDE.md and .claude/settings.json; Microsoft's cmake-tools and makefile-tools ship an .mcp.json; vscode-icons and markdown-preview-enhanced ship an AGENTS.md. That is 5 of the 100 most-installed extensions, on 18 September 2026.
What makes V13 different from its two siblings is where the file lands. C18 and H14 report the row at HIGH because a cloned repository is opened as a workspace, and an agent started in that checkout reads the file before you do. An installed extension lands in ~/.vscode/extensions/publisher.name-version/ — a directory that is never the workspace an agent opens. The file is present; it is not loaded. So presence inside a package is a note. What still carries its full weight is what the file says: an .mcp.json whose command fetches and runs, a rules file with instructions hidden in invisible Unicode, a settings file that redirects an API key are CRITICAL inside a package exactly as they are in a repository, because the moment someone does open that directory — to develop the extension, or because an agent was pointed at it — the file is live. V13's job is to find the files so that V14, V15 and V16 can read them.
Once the package's file list is in hand (see V12 for how it is read without downloading the package), each matched path — up to eight — is fetched out of the .vsix by a third ranged GET, and each fires agent-config:<path>. The scoring entry is the one C18 and H14 share, agent-config, HIGH at 0 points, with the evidence note that set that weight on GitHub:
"77/80 top repos ship CLAUDE.md/AGENTS.md in 2026 — presence is not signal"
In the package context the engine then downgrades the row from HIGH to INFO, with the reason written into the row itself: "shipped inside the package — an installed extension's directory is not a workspace an agent opens, so a note; its contents are read (V14–V16)". The consequence in verdict terms is the whole difference between the three siblings. The verdict rule is shared by every V-check — the worst fired severity decides it: any CRITICAL reads BLOCK, any HIGH or MEDIUM reads REVIEW, INFO alone reads PASS; the score, 100 minus every fired penalty and floored at zero, is reported beside it (green at 80 and above, amber 50–79, red below 50). On GitHub a lone agent-config row is HIGH at 0 points, which reads REVIEW at a score of 100; inside a package the same file is INFO and reads PASS at 100. That is the grading of 18 September 2026: before it, the 5 extensions above read REVIEW on this row alone and the run was 87 PASS, 13 REVIEW; after it they read PASS and the run is 99, 1, 0. V13 feeds two dimensions — Open in an editor (with V7, V8, V12 and V14–V16) and Hand to an AI agent (with V7, V8, V14–V17) — each taking the worst of its checks and reading PASS only when every one of them ran. A package with no agent files is a PASS on this check, not a skip: there is nothing to hide instructions in. A package whose listing could not be fetched is a skip, not a pass, and neither dimension can then read PASS.
The row fired on 5 of the 100 most-installed extensions in the 18 September 2026 measurement — prettier (CLAUDE.md and .claude/settings.json), cmake-tools and makefile-tools (.mcp.json), vscode-icons and markdown-preview-enhanced (AGENTS.md) — and all 5 read PASS. Their contents were read: the two .mcp.json files launch no shell fetch, so V15 passed on them; nothing was hidden in invisible Unicode and nothing redirected a credential, so V14 and V16 passed too. Because the row is a note, it cannot move a verdict on its own, and the false-positive question for this family is really V14–V16's to answer on their own pages.
It reads the files on its list, as they sit in the package. An extension whose JavaScript writes a CLAUDE.md or an .mcp.json into your workspace when it activates is code behaviour, and the bundle is not read on this tier — the deep scan is the tool for that. A file under a name not on the list is not read until the list grows; a README that tells an agent what to do in ordinary prose is not an agent config file; your agent's own global configuration, outside the package, is never seen. And if you do open the extension's directory as a workspace — to work on it, or by pointing an agent at it — C18's reasoning applies in full, and this row is the pointer to read the files first. Presence is all V13 reports: a file whose harmful instruction is written in ordinary visible text passes V14, V15 and V16.
RepoGates assesses a Marketplace extension on request — through the API, the MCP server (platform="vsx") and the preflight for code --install-extension. It does not see an extension installed from the editor's own UI, or one that auto-updates; the board on marketplace pages is not built yet; Open VSX (where VSCodium, Cursor and Windsurf install from) is a different registry and is not assessed. The extension's code bundle is not read on this tier: a PASS means the provenance and the declared surface are clean, never that the JavaScript was inspected.
From the listing page's Resources column, Download Extension gives you the .vsix; it is a zip with the extension's files under extension/:
unzip -l publisher.extension-1.2.3.vsix \
| grep -E 'extension/(CLAUDE\.md|AGENTS\.md|\.cursorrules|\.clinerules|\.windsurfrules|\.github/copilot-instructions\.md|\.cursor/rules/.*\.mdc|\.mcp\.json|\.cursor/mcp\.json|\.claude/.*\.json)$'For an extension already installed, the same names under ~/.vscode/extensions/publisher.extension-*/. Then read whatever turns up the way you would read a shell script someone handed you: as instructions that will be followed the day that directory is opened.
Why is the same file a REVIEW on GitHub and a PASS inside an extension? Because of where it lands. A cloned repository is opened as a workspace, and an agent auto-loads its CLAUDE.md or .mcp.json at session start, so C18 reports the row HIGH — at 0 points, which the verdict rule still reads as REVIEW. An installed extension lands under ~/.vscode/extensions/, a directory no agent opens as a workspace, so V13 reports the same row as INFO and the listing reads PASS. The file is present in both cases; it is loaded in only one.
If presence is only a note, why read the files at all? Because what is inside keeps its weight wherever it sits. V13 fetches each matched file out of the package with a third ranged GET so that V14 (hidden Unicode), V15 (an MCP config whose command fetches and runs) and V16 (a credential redirect) can read it, and those three stay CRITICAL inside a package. In the 18 September 2026 measurement the two .mcp.json files in the top-100 — Microsoft's cmake-tools and makefile-tools — were read and launch no shell fetch.
Does RepoGates see an extension I install from inside VS Code? No. RepoGates assesses a Marketplace extension on request — through the API, the MCP server and the preflight for code --install-extension. It does not see an extension installed from the editor's own UI or one that auto-updates, the board on marketplace pages is not built yet, and Open VSX is a different registry that is not assessed. The code bundle is not read on this tier either, so an extension whose JavaScript writes an agent file into your workspace at runtime is a question for the deep scan.
V14 Hidden Unicode in agent rules — what is inside the file that a reviewer cannot see, still CRITICAL in a package · V15 MCP shell-launch config — a command in the file that fetches and runs, read on the two .mcp.json files in the top-100 · V16 Credential redirect — a config that points an API key somewhere else · C18 Agent config files — the same function on a git tree, where the row is HIGH because the checkout is the workspace.
Add RepoGates to Chrome Pricing
Numbers on this page: the 18 September 2026 measurement of the 100 most-installed extensions (99 PASS, 1 REVIEW, 0 BLOCK; V13 on 5; 87/13/0 before the three gradings); the GitHub Phase 0 figure of 77 of 80 popular repositories, as recorded in the scoring table's own evidence note; weights from the product's scoring table.