# Extension vetting report

- Name and kind: (skill / plugin / MCP server / marketplace)
- Source: (URL)
- Pinned to: (full SHA, exact version or digest)
- Pin check: (output of scripts/check_pin.sh)
- Agent versions: (Claude Code 2.1.179+ / Codex 0.146.0+ / Antigravity, as used here)

## What it can do
- Shell: (yes/no, which commands)
- Network: (hosts it contacts, and when)
- Files: (what it reads and writes outside the project)
- Hooks or auto-run behaviour: (events, commands)

## Scanner findings
(paste the audit_extension.py output; explain each high and medium finding or mark it a false positive with a reason)

## Recommendation
Install as pinned / install with changes / do not install.
Changes needed:
-

Re-vet on every update. Auto-update stays off for this source.