Check V17 · agent-provenance family · browser-side · one of the 17 VS Code Marketplace checks
The question this check asks: did an AI chat assistant or an MCP/tool directory lead you to this listing? Not whether the extension mentions AI — whether the route you took to it went through one. Today RepoGates cannot answer that question for a Marketplace extension at all, and this page says so rather than letting the roster entry imply otherwise.
V17 is named as the Marketplace counterpart to GitHub's C22 AI-agent provenance, which is live: an assistant's recommendation reads as vetting to the person receiving it, and it is not vetting. Island's AgentBaiting research showed the mechanism working on GitHub — chat assistants recommending attacker-seeded repositories as confidently as anything legitimate — and nothing about it is specific to GitHub. Ask an assistant for a VS Code extension and it will name one. The Marketplace has already hosted listings that fit exactly what a developer asks an assistant for: MaliciousCorgi's two AI chat extensions, whensunset.chatgpt-china at 1,340,869 installs and zhukunpeng.chat-moss at 151,751 (as quoted from Koi Security by The Hacker News and BleepingComputer, January 2026), worked as advertised while hidden code read every opened file. A listing an assistant hands you deserves the scrutiny you would give a link a stranger sent — and on this platform, so does a listing at the top of the search results: Kaspersky's 10 July 2025 report of a fake Solidity Language extension that outranked juanblanco.solidity by its newer update date was on Open VSX and Cursor rather than the Microsoft Marketplace, but ranking and recommendation fail the same way. Neither is evidence.
What only the browser can see: the signal exists at navigation time — which tab you came from, which tab opened this one, the referrer when one survives. A backend never sees it; the gallery record does not carry it; nothing in the package reflects it. C22 works because the extension holds permission on an enumerated list of AI chats (claude.ai, chatgpt.com, chat.openai.com, gemini.google.com, copilot.microsoft.com, perplexity.ai) and MCP directories (lobehub.com, glama.ai, mcp.so, mcpmarket.com, smithery.ai) and watches tab lineage at the moment someone lands on github.com. No board on marketplace.visualstudio.com exists yet to do the same, so for a Marketplace listing the signal is never observed — not by the extension, not by the API, not by anything.
V17 does not run for an extension today, and this section describes the plumbing that exists around that gap rather than a score anyone receives. In the roster it is listed with a single input, the browser; on the API path — the score and verdict routes, the MCP server, the preflight — that input is never present, so every response lists V17 as not checked, with the reason "decided in the browser at navigation time". Not PASS, not an INFO line, not a skip dressed up as clearance: a skip stated as a skip. It is also the one skip in the roster that does not withhold PASS from a dimension verdict. The Hand to an AI agent dimension takes the worst of V7, V8 and V13–V16 and reads PASS when those ran and found nothing, exactly as the Scorecard rule works on the GitHub roster and H18 on the Hub's — a check with no possible input on this path is not evidence withheld, where a package listing that failed to fetch is. The verdict route does accept the same prov=agent flag the extension sends for a GitHub repository, and the scoring table's agent-provenance row — CRITICAL at 25 points, INFO at 5 — is matched by finding prefix, not by platform, so the weight is defined; how C22 applies it, escalating a REVIEW and noting a PASS, is documented on its own page. Its evidence note:
"C22: AgentBaiting channel; INFO row (recorded on PASS) costs a little, CRIT (escalated) a lot"
What does not exist is the thing that would send the flag: the board on marketplace pages, tracked as VS-3. Until it ships, no Marketplace verdict carries this finding, and nothing on this page, in the extension or in the MCP server claims otherwise.
None, because nothing runs. A check that does not execute cannot misfire. That is a different claim from "zero false positives measured" — which is what a check earns after running against real traffic and turning up nothing wrong — and we are careful not to blur the two. The 18 September 2026 measurement of the 100 most-installed extensions ran through the API path, where V17 is not on the path at all; it has not been measured because it has not shipped.
Everything, today — by construction, since it is inactive. Once the board on marketplace pages exists, expect the boundaries C22 already documents: browser navigations only, from an enumerated list of surfaces it is told about; not what you asked an assistant or what it said, only that a navigation crossed from one of those surfaces to a listing; and not the package itself — a recommended extension that trips nothing else would not be held on that basis alone, because a recommendation is not evidence. Two Marketplace routes would stay outside it even then, because neither is a browser navigation: the editor's own Extensions view, and an install command an assistant writes for you — the preflight judges that line on its own terms and never knows who suggested it.
RepoGates assesses a Marketplace extension on request — through the API, the MCP server (platform="vsx") and the preflight for code --install-extension. It does not see an extension installed from the editor's own UI, or one that auto-updates; the board on marketplace pages is not built yet; Open VSX (where VSCodium, Cursor and Windsurf install from) is a different registry and is not assessed. The extension's code bundle is not read on this tier: a PASS means the provenance and the declared surface are clean, never that the JavaScript was inspected.
Since nothing automated exists for this yet, the manual version is the only version: treat any extension an assistant hands you as an unverified search result, not a referral. On the listing page, read the three things the roster reads first — whether the publisher's name carries the Marketplace's domain-verified check (V1), whether the Resources column links a source repository and whose it is (V5), and whether the install count fits the published date (V2, V3). Then compare the publisher and the name against the extension you actually meant (V4). The Download Extension link in the same column gives you the .vsix, a zip with the extension's files under extension/:
unzip -l EXTENSION.vsixThen verify the publisher out of band — a project website, a package on a registry you already trust, a named person with a history — the same discipline the vetting standard recommends for any agent-discovered repository, on any platform, whether or not a check exists to automate it yet.
Does RepoGates currently tell me whether an AI assistant recommended this extension? No. V17 is defined in the 17-check roster, but the only thing that could ever observe it — a browser extension present at the moment you navigate to the listing — does not exist for marketplace.visualstudio.com yet. Every Marketplace verdict reports this row as "not checked": not PASS, not a finding, an honest gap stated as a gap, until the board on marketplace pages ships.
Why does "not checked" not turn the agent dimension to NOT_ASSESSED? Because V17 has no possible input on the API path — it is decided in the browser or not at all — and a check that could not have run is not evidence withheld. The Hand to an AI agent dimension takes the worst of V7, V8 and V13 to V16 and reads PASS when those ran and found nothing, exactly as the Scorecard rule works on the GitHub roster and H18 on the Hub's. A skip caused by a fetch that failed — the package listing unavailable — is different, and does withhold PASS.
Does RepoGates see the extension when VS Code installs it? No. RepoGates assesses a Marketplace extension on request — through the API, the MCP server and the preflight for code --install-extension. It does not see an extension installed from the editor's own UI, or one that auto-updates; the board on marketplace pages is not built yet; and Open VSX, where VSCodium, Cursor and Windsurf install from, is a different registry and is not assessed. V17, even once it ships, will only ever see a person following a recommendation into a browser tab.
C22 AI-agent provenance — the same check, live, on the platform where the extension already watches navigations · H18 AI-agent provenance — the Hub's counterpart, in the same defined-not-running state · V4 Lookalike publisher or name — the provenance check that does run today on the name a recommendation hands you · V1 Publisher verification — the first thing to read on a listing you did not find yourself.
Add RepoGates to Chrome Pricing
Numbers on this page: MaliciousCorgi install counts as quoted from Koi Security by The Hacker News and BleepingComputer, 23–26 January 2026; Kaspersky Securelist, 10 July 2025 (the fake Solidity Language extension, on Open VSX and Cursor); Island's AgentBaiting as published on the AgentBaiting intelligence page; the 18 September 2026 measurement of the 100 most-installed VS Code Marketplace extensions (99 PASS, 1 REVIEW, 0 BLOCK, run through the API path). V17's own status — listed as not checked, no board on marketplace pages, tracked as VS-3 — is a statement of the product's current state, not a measurement.