AI risk level

None

Recommendation

install

Model

~deepseek/deepseek-v4-flash-latest

Analyzed commit

608f0f6

Reviewed

2 weeks ago

The plugin is a straightforward bar widget that reads Cline's local sqlite database in read-only mode to display token usage stats. The Python scanner is simple, has no subprocess/network/destructive operations, and only outputs JSON. The QML UI and IPC handlers are benign and do not perform any harmful actions.

How this check works

This review combines the deterministic scan (the rule-based results above) with an independent look at the plugin's code by a language model. The model reads a trimmed sample of the repository's files, the manifest, and the README, then gives a plain-language risk level and a recommendation: install (no notable danger), review (look closer first), or avoid (clearly dangerous).

It runs on the same analyzed commit as the deterministic scan and is strictly advisory — it is not a security guarantee and never blocks a plugin by itself. A human moderator still reviews plugins before they are listed.

AI advisory only — automated analysis, not a security guarantee.