AI risk level

Low

Recommendation

install

Model

~deepseek/deepseek-v4-flash-latest

Analyzed commit

2d4fa03

Reviewed

1 month ago

The plugin is a well-engineered bar widget that downloads pet packages from a small allowlist of hosts and installs activity hooks into coding agents. All network access is HTTPS-only, redirects are validated, file sizes are capped, and config modifications are atomic with symlink protection and backups. No obfuscation, credential theft, or destructive behavior was found.

• • Downloads third-party pet packages (spritesheets, pet.json) from petdex.dev, codex-pets.net, and openpets.dev; while hosts are allowlisted and content is validated, the spritesheets are processed with ImageMagick, which could be a vector if a malicious image exploits a system vulnerability.
• • Installs hooks into coding-agent config files (Codex, Claude, etc.) which modifies user configuration; this is user-initiated via the panel and the installer is careful, but it does alter files outside the plugin directory.

How this check works

This review combines the deterministic scan (the rule-based results above) with an independent look at the plugin's code by a language model. The model reads a trimmed sample of the repository's files, the manifest, and the README, then gives a plain-language risk level and a recommendation: install (no notable danger), review (look closer first), or avoid (clearly dangerous).

It runs on the same analyzed commit as the deterministic scan and is strictly advisory — it is not a security guarantee and never blocks a plugin by itself. A human moderator still reviews plugins before they are listed.

AI advisory only — automated analysis, not a security guarantee.