Every published check, grouped by what is being assessed: a GitHub repository, a Hugging Face model, a GitLab project, a VS Code extension, a Docker Desktop extension, an agent skill or plugin.
Four groups. The first three run on the verdict service; the last one can only run in the browser.
.envrc). Read from the file list — no clone — except
the devcontainer configuration, which is read so that a command that
runs on your host (initializeCommand) is told apart from
one that runs inside the container.A model, dataset or Space on huggingface.co is scored by its own
roster (H1–H18) under hf/{kind}/{org}/{name}; the 22
stay the 22. Provenance:
repository age,
author account age,
traction mismatch,
lookalike
organisation,
access flags,
model card and
licence. Execution surface:
Hub malware scan
hit,
Hub pickle-import
scan,
pickle-only weights,
custom code on load,
dataset loading
script,
a Space executes on
open,
Hub scan incomplete.
Agent surface:
agent config files,
hidden
Unicode in agent rules,
MCP shell-launch
config,
credential redirect,
AI-agent provenance.
Measured on the
malicious-models page.
An extension on the Marketplace is scored by its own roster (V1–V17)
under vsx/{publisher}/{extension}, through the API, the
MCP server (platform="vsx") and the preflight for
code --install-extension. Provenance:
publisher
verification,
extension age,
traction mismatch,
lookalike
publisher or name,
source repository
(the declared GitHub source, assessed through the 22 on the same
pass),
pre-release
and re-publish cadence. Execution surface:
package signature,
declares code
execution,
proposed API access,
extension
pack and dependencies,
Marketplace
validation,
package contents —
what executes inside the package, listed from its file list and not
read. Agent surface:
agent config files,
hidden
Unicode in agent rules,
MCP shell-launch
config,
credential redirect,
AI-agent provenance.
The extension's code bundle is not read on this tier; Open VSX is not
assessed; an extension installed from the editor's own UI is not a
shell line the hook sees. Measured on the
malicious-extensions
page.
A Docker Desktop extension — a Docker Hub image whose labels carry
the listing and whose image carries metadata.json — is
scored by its own roster (D1–D11) under
dde/{owner}/{name}, through the API, the MCP server
(platform="dde") and the preflight for
docker extension install, without pulling the image.
Provenance:
publisher,
extension age,
traction mismatch,
lookalike
publisher or name,
marketplace
listing (the index is frozen — Docker paused submissions on
16 June 2026 — so an unlisted image is sideloaded or private),
source repository
(the declared GitHub source, assessed through the 22),
publication
freshness. Execution surface:
host binaries,
VM backend beside the
Docker socket and what its compose file asks for,
publisher URLs.
AI-agent
provenance (D11) is browser-side. An extension installed from
Docker Desktop's own marketplace tab is not a shell line the hook
sees. Measured on the
Docker Desktop
extensions page.
A gitlab.com project is scored by the same 22 checks the GitHub
roster runs, under G ids and the key
gl/{namespace…}/{project} (groups nest, so the key is the
project's whole path), through the API, the MCP server
(platform="gl") and the preflight for a git
clone, glab repo clone or any gitlab.com URL. Each
G page is its C twin's, with what GitLab changes:
owner account age
(a group's is public; a user namespace's needs a token, so it is
listed as not checked without one),
fork and lookalike
(fork status is not in the anonymous project record — not checked,
never assumed "not a fork"),
OpenSSF Scorecard
(no coverage of gitlab.com — never runs),
devcontainer
and Workspace devfile auto-execution (GitLab Workspaces run a
devfile's postStart commands when a workspace is created),
maintenance
activity (GitLab's last_activity_at moves on issue
and merge-request activity too).
AI-agent provenance
(G22) is browser-side. A self-managed GitLab is another hostname and
is not assessed. Measured on the
GitLab page.
An AI-agent skill hosted on GitHub — what npx skills add
owner/repo installs — and a Claude Code plugin are scored by a
roster of their own (S1–S15), under
skill/gh/{owner}/{repo}[/{path}] and
skill/plugin/{owner}/{repo}/{plugin}, through the API,
the MCP server (check_skill) and the preflight for
npx skills add and claude plugin install.
Provenance:
source repository
(the repository behind the skill, through the 22, its verdict riding
along),
listing and owner
age,
traction mismatch,
lookalike owner or
name. What the skill declares:
frontmatter
validity,
declared tool
surface,
declared
requirements. What the text tells the agent:
hidden Unicode,
instruction shapes
(the shapes the 2026 ClawHub campaigns used, matched as named regex
classes with a stated calibration — never a prompt-injection claim).
Beside it:
scripts and
executables, size. For a
plugin:
marketplace
source pinning,
hooks and monitors,
MCP servers,
credential
redirect. This tier reads the listing record, the tree once, and
at most twelve files of 64 KB each; the deep scan reads the whole
package. ClawHub (@owner/slug) is parsed and routed but
not assessed on this tier; /plugin install is a slash
command the hook never sees; a skill copied by hand into
~/.claude/skills is never seen. Measured on the
malicious skills page.
Four dimension verdicts, from the same roster.
Beside the single verdict, the score answers the four things you might
do with the repository — open it in an editor (C10, C11, C13,
C14, C17, C18–C21), clone it (C1–C8, C11, C12), install and
run it (C9, C10, C14, C15, C16), hand it to an AI agent
(C10, C18–C22) — each PASS, REVIEW, BLOCK or not assessed, with your
profile's action. A dimension is a maximum over its checks, never a
sum, so the score does not change; it is PASS only when every check in
it ran and none fired, and a Scorecard result that does not exist or
the browser-only C22 is listed as not checked without withholding it.
/v1/score, the MCP check_repo and the
preflight carry them, and the preflight's one-line reason ends with
the dimension the verb is about (clone: REVIEW,
install: PASS). On the board they are the four chips
above the family pills. Shipped 10 September 2026 on the API and the
agent path; the chips arrive with the next extension release.
The repository timeline. Every fresh answer is
kept for 180 days — the date, the verdict, the score and which checks
fired, by number; nothing about who asked — and a new point is added
only when the answer changed, so a repository that stays the same has
one point that keeps being confirmed. /v1/score carries
the last twelve as history and the difference since the
previous one as drift: the score delta, the checks that
newly fired or cleared, and whether the engine changed in between —
in which case the movement reflects updated checks, not the
repository. A point exists only when someone looked; nothing is
re-checked on a schedule. The MCP check_repo and the
preflight say the same as changed_since_last; on the
board it is the delta beside the score and one line naming what
changed. Shipped 10 September 2026 on the API and the agent path;
the board part arrives with the next extension release.
What it does not see. RepoGates gates downloads made through the browser. It does not see git clone, package managers or curl — outside Claude Code with the RepoGates plugin, whose hook refuses a clone or install that names a blocked repository on the command line, before it runs. The hook sees Bash tool calls in that one client and nothing else. VS Code and Docker Desktop extensions and agent skills are answered through the MCP server and the plugin, not in the browser.