Immutable Deep Scan reportEvidence is locked to this exact artifact and scan.
About immutable reports
Future scans cannot replace the findings, coverage, ruleset, or artifact hash shown on this URL.
- Scan
f8594965-1f1c-43b9-91da-5ad04b428d15- Artifact
28e1c4691f09…929351b9
Analysis Report
Continue - open-source AI code agent
Continue.continue@2.1.0Completed analysis for this exact extension version. Use the summary below to decide what your team should do next.
The extension exposes sensitive capabilities or non-confirmed risk evidence that needs context.
- Required action
- Record a team decision before approval
Review decision-relevant behavior before installation.
Review the grouped evidence, affected locations, and whether each behavior matches the extension’s purpose.
The extension exposes sensitive capabilities or non-confirmed risk evidence that needs context.
This result applies only to the scanned artifact SHA-256, not to future releases or a publisher generally.
Review the grouped evidence and record the accountable team decision before approval.
Required analysis completed for this exact artifact; evidence remains scoped to scanner coverage.
- 1Artifact boundExtension, version, hash, and scan identity fixed
- 2Analysis checkedExecutable-file coverage
- 3Evidence grouped1 actionable · 24 contextual
- 4Policy appliedExact-release ruleset evaluated
- 5Review neededCurrent decision for this artifact
61/100Review needed
Diagnostic risk index for this exact artifact — not a probability of malice.
Policy result for this exact artifact
100
6/6 required analyzers completed
0
Diagnostic index, not probability
24 contextual notes kept separate
Power describes access, not intent
1 behavior group needs context before approval.
The extension exposes sensitive capabilities or non-confirmed risk evidence that needs context.
28e1c4691f090080f9872ddbbd450e32a822759fefea6e6c12f96a45929351b9Build 700e9036a4de · ruleset 2026.07.24-policy-v3-calibration.6
Evidence that drives review
Native binary bin/napi-v3/linux/arm64/onnxruntime_binding.node has no companion checksum or signature file and no documented provenance.
14 observed locations · review evidence