pablodomi/vsix-scan
Deep security analyzer for VS Code extensions
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| target | Extension to analyze. Accepts: publisher.extensionName (downloads from VS Marketplace), publisher.extensionName@version, path to a .vsix file, or a folder path. | yes | — |
| format | Output format: terminal | json | html | sarif | no | sarif |
| fail-on | Fail the action (exit 1) if any finding meets this severity or above. Values: critical | high | medium | low | no | high |
| rules | Path to an additional YAML rules file | no | — |
| upload-sarif | Upload SARIF results to the GitHub Security tab. Only applies when format is "sarif". Requires the repo to have GitHub Advanced Security enabled (public repos or GHAS license). | no | true |
Outputs
| name | description |
|---|---|
| risk-score | Numeric risk score (0–100) |
| risk-level | Risk level: safe | low | medium | high | critical |