ChatGPT Copilot Extension for Visual Studio Code
Drift inferred · capture-to-capture
- HIGH code analysis flagged committed secret ×4 in feiskyer/chatgpt-copilot
transport stdio · http · sse counts 0 tools · 0 res
· 0 prompts
permission surface via code analysis
No tools enumerated yet for this server.
prompt-surface
shipped agent-instruction files + hidden-content / dangerous-code findings —
quoted from the analyzed source
analyzed commit ed1a8f7 · analyzer v33 · 2w ago
danger signals11
- over-broad OAuth scope https://www.googleapis.com/auth/cloud-platform feiskyer-chatgpt-copilot-ed1a8f7/scripts/antigravity-oauth.ts :28
"https://www.googleapis.com/auth/cloud-platform", - over-broad OAuth scope https://www.googleapis.com/auth/cloud-platform feiskyer-chatgpt-copilot-ed1a8f7/scripts/gemini-oauth.ts :28
"https://www.googleapis.com/auth/cloud-platform", - over-broad OAuth scope https://www.googleapis.com/auth/cloud-platform feiskyer-chatgpt-copilot-ed1a8f7/src/oauth/providers/antigravity.ts :21
"https://www.googleapis.com/auth/cloud-platform", - over-broad OAuth scope https://www.googleapis.com/auth/cloud-platform feiskyer-chatgpt-copilot-ed1a8f7/src/oauth/providers/gemini.ts :21
"https://www.googleapis.com/auth/cloud-platform", - over-broad OAuth scope https://www.googleapis.com/auth/cloud-platform feiskyer-chatgpt-copilot-ed1a8f7/src/test/oauth/oauth-flow.test.ts :71
"https://www.googleapis.com/auth/cloud-platform", - over-broad OAuth scope https://www.googleapis.com/auth/cloud-platform feiskyer-chatgpt-copilot-ed1a8f7/src/test/oauth/providers/antigravity.test.ts :8
"https://www.googleapis.com/auth/cloud-platform", - over-broad OAuth scope https://www.googleapis.com/auth/cloud-platform feiskyer-chatgpt-copilot-ed1a8f7/src/test/oauth/providers/gemini.test.ts :10
"https://www.googleapis.com/auth/cloud-platform", - committed secret Google OAuth client secret feiskyer-chatgpt-copilot-ed1a8f7/scripts/antigravity-oauth.ts :20
GOCSPX…(35 chars, redacted) - committed secret Google OAuth client secret feiskyer-chatgpt-copilot-ed1a8f7/scripts/gemini-oauth.ts :20
GOCSPX…(35 chars, redacted) - committed secret Google OAuth client secret feiskyer-chatgpt-copilot-ed1a8f7/src/oauth/providers/antigravity.ts :16
GOCSPX…(35 chars, redacted) - committed secret Google OAuth client secret feiskyer-chatgpt-copilot-ed1a8f7/src/oauth/providers/gemini.ts :16
GOCSPX…(35 chars, redacted)
evidence-backed
findings quoted directly from the published source artifact — not inferred
code files: 74
filesystem 9
- fs (weak) feiskyer-chatgpt-copilot-ed1a8f7/scripts/antigravity-oauth.ts :10
import * as fs from "fs"; - fs (weak) feiskyer-chatgpt-copilot-ed1a8f7/scripts/chatgpt-oauth.ts :10
import * as fs from "fs"; - fs (weak) feiskyer-chatgpt-copilot-ed1a8f7/scripts/claude-oauth.ts :13
import * as fs from "fs"; - fs (weak) feiskyer-chatgpt-copilot-ed1a8f7/scripts/gemini-oauth.ts :10
import * as fs from "fs"; - fs (weak) feiskyer-chatgpt-copilot-ed1a8f7/scripts/generate-codex-instructions.ts :15
import * as fs from "fs"; - fs (weak) feiskyer-chatgpt-copilot-ed1a8f7/scripts/patch-buffer.js :1
const fs = require('fs'); - fs feiskyer-chatgpt-copilot-ed1a8f7/src/chatgpt-view-provider.ts :1561
const fileContent = await vscode.workspace.fs.readFile( - fs feiskyer-chatgpt-copilot-ed1a8f7/src/claude-code.ts :14
import * as fs from "fs"; - fs feiskyer-chatgpt-copilot-ed1a8f7/src/oauth/token-storage.ts :2
import * as fs from "fs";
shell / exec 5
- shell feiskyer-chatgpt-copilot-ed1a8f7/media/vendor/highlight.min.js :245
} exec(e) { - shell (weak) feiskyer-chatgpt-copilot-ed1a8f7/scripts/antigravity-oauth.ts :14
import { spawn } from "child_process"; - shell (weak) feiskyer-chatgpt-copilot-ed1a8f7/scripts/chatgpt-oauth.ts :14
import { spawn } from "child_process"; - shell (weak) feiskyer-chatgpt-copilot-ed1a8f7/scripts/claude-oauth.ts :17
import { spawn } from "child_process"; - shell (weak) feiskyer-chatgpt-copilot-ed1a8f7/scripts/gemini-oauth.ts :14
import { spawn } from "child_process";
network 15
- net (weak) feiskyer-chatgpt-copilot-ed1a8f7/scripts/antigravity-oauth.ts :11
import * as http from "http"; - net (weak) feiskyer-chatgpt-copilot-ed1a8f7/scripts/chatgpt-oauth.ts :11
import * as http from "http"; - net (weak) feiskyer-chatgpt-copilot-ed1a8f7/scripts/claude-oauth.ts :123
const response = await fetch(TOKEN_ENDPOINT, { - net (weak) feiskyer-chatgpt-copilot-ed1a8f7/scripts/gemini-oauth.ts :11
import * as http from "http"; - net (weak) feiskyer-chatgpt-copilot-ed1a8f7/scripts/generate-codex-instructions.ts :47
const apiResponse = await fetch(CODEX_GITHUB_API_RELEASES); - net feiskyer-chatgpt-copilot-ed1a8f7/src/oauth/ai-sdk-providers/antigravity-oauth.ts :190
const response = await fetch(currentUrl, { - net feiskyer-chatgpt-copilot-ed1a8f7/src/oauth/ai-sdk-providers/chatgpt-oauth.ts :210
const response = await fetch(url, { - net feiskyer-chatgpt-copilot-ed1a8f7/src/oauth/ai-sdk-providers/claude-oauth.ts :133
const response = await fetch(url, { - net feiskyer-chatgpt-copilot-ed1a8f7/src/oauth/ai-sdk-providers/gemini-oauth.ts :79
const response = await fetch( - net feiskyer-chatgpt-copilot-ed1a8f7/src/oauth/oauth-callback-server.ts :2
import * as http from "http"; - net feiskyer-chatgpt-copilot-ed1a8f7/src/oauth/providers/antigravity.ts :81
const response = await fetch(endpoint, { - net feiskyer-chatgpt-copilot-ed1a8f7/src/oauth/providers/chatgpt.ts :76
const response = await fetch(this.config.tokenEndpoint, {
show 3 more
- net feiskyer-chatgpt-copilot-ed1a8f7/src/oauth/providers/claude.ts :67
const response = await fetch(this.config.tokenEndpoint, { - net feiskyer-chatgpt-copilot-ed1a8f7/src/oauth/providers/gemini.ts :66
const response = await fetch(this.config.tokenEndpoint, { - net feiskyer-chatgpt-copilot-ed1a8f7/src/utils.ts :16
return fetch(url, options);
secrets 1
- secrets feiskyer-chatgpt-copilot-ed1a8f7/src/chatgpt-view-provider.ts :718
if (!apiKey && process.env.OPENAI_API_KEY != null) {
install hooks 1
- postinstall feiskyer-chatgpt-copilot-ed1a8f7/package.json :681
node scripts/patch-buffer.js
declared dependencies 68
- @modelcontextprotocol/sdk@^1.26.0
- @ai-sdk/anthropic@^3.0.36
- @ai-sdk/azure@^3.0.26
- @ai-sdk/deepseek@^2.0.17
- @ai-sdk/google@^3.0.20
- @ai-sdk/groq@^3.0.21
- @ai-sdk/mistral@^3.0.18
- @ai-sdk/openai@^3.0.25
- @ai-sdk/perplexity@^3.0.17
- @ai-sdk/provider@^3.0.7
- @ai-sdk/replicate@^2.0.17
- @ai-sdk/togetherai@^2.0.29
show 28 more
- @ai-sdk/xai@^3.0.46
- @anthropic-ai/claude-agent-sdk@^0.2.31
- @openrouter/ai-sdk-provider@^2.1.1
- @quail-ai/azure-ai-provider@^2.0.0
- ai@^6.0.69
- ai-sdk-provider-gemini-cli@^2.0.1
- ajv@^8.18.0
- axios@^1.15.0
- cheerio@^1.2.0
- delay@^7.0.0
- eventsource-parser@^3.0.6
- gpt3-tokenizer@^1.1.5
- isomorphic-fetch@^3.0.0
- keyv@^5.6.0
- minimatch@^10.2.3
- ollama-ai-provider-v2@^3.0.3
- openai@^6.17.0
- p-timeout@^7.0.1
- punycode@^2.3.1
- puppeteer@^24.36.1
- puppeteer-extra@^3.3.6
- puppeteer-extra-plugin-stealth@^2.11.2
- puppeteer-extra-plugin-user-data-dir@^2.4.1
- puppeteer-extra-plugin-user-preferences@^2.4.1
- quick-lru@^7.3.0
- react@^19.2.4
- react-dom@^19.2.4
- remark@^15.0.1
28 more not shown — this panel samples each group; the count above is the real total.
ide-extension 1
- install-hook (high) feiskyer-chatgpt-copilot-ed1a8f7/package.json
extension declares install hook(s): postinstall