Guardrails
Check an extension
Sign in
Back to extension profile
Immutable Deep Scan reportEvidence is locked to this exact artifact and scan.
About immutable reports

Future scans cannot replace the findings, coverage, ruleset, or artifact hash shown on this URL.

Scan
c226181b-7ab4-4a59-aea6-12329c524563
Artifact
b7ae0e17eaf1…c148cd4e
Analysis Report

Kubernetes

ms-kubernetes-tools.vscode-kubernetes-tools@1.4.0

Completed analysis for this exact extension version. Use the summary below to decide what your team should do next.

Scan resultDo not install

Prevent execution pending review: high-confidence abuse-chain evidence matched (remote-vsix-install-chain). This is a preventive policy decision, not a confirmed-malicious label.

Required action
Do not install this version
Export evidence
Decision nowPrevent execution pending review: high-confidence abuse-chain evidence matched (remote-vsix-install-chain). This is a preventive policy decision, not a confirmed-malicious label.Exact artifact only
Actionable evidence115 contextual notes
Capabilities8Observed powers, not intent
Coverage100%Executable-file coverage
Package scope10429 dependencies
Frozen regression fixtureThis exact artifact is in the GuardRails regression corpus.

Hash-pinned as a credential sensitive case. The exact artifact identity matches the frozen cohort; the current decision above comes only from this scan's evidence.

ms-kubernetes-toolsvs-marketplaceVersion 1.4.0
Security brief

This exact artifact should not be installed.

Inspect the evidence that supports this do-not-install policy decision.

What changed

Prevent execution pending review: high-confidence abuse-chain evidence matched (remote-vsix-install-chain). This is a preventive policy decision, not a confirmed-malicious label.

Why it matters

This result applies only to the scanned artifact SHA-256, not to future releases or a publisher generally.

Recommended action

Do not install this exact artifact. Record an exception only with accountable approval.

Analysis limits

Required analysis completed for this exact artifact; evidence remains scoped to scanner coverage.

  1. 1Artifact boundExtension, version, hash, and scan identity fixed
  2. 2Analysis checkedExecutable-file coverage
  3. 3Evidence grouped1 actionable · 15 contextual
  4. 4Policy appliedExact-release ruleset evaluated
  5. 5Do not installCurrent decision for this artifact
96/100Do not install

Diagnostic risk index for this exact artifact — not a probability of malice.

OutcomeDo not install

Policy result for this exact artifact

Executable-file coverage
100

7/7 required analyzers completed

Malware signal
0

Diagnostic index, not probability

Evidence groups1

15 contextual notes kept separate

Capabilities8

Power describes access, not intent

Why this outcome

1 evidence group support this do-not-install decision.

Prevent execution pending review: high-confidence abuse-chain evidence matched (remote-vsix-install-chain). This is a preventive policy decision, not a confirmed-malicious label.

Exact artifactb7ae0e17eaf14e98675abd413546311b4fd6fa000ff1dce2011a502bc148cd4e

Build 6aab1d4caaf6 · ruleset 2026.07.24-policy-v3-calibration.6

Evidence supporting this decision
HIGH
Code downloads a VSIX, writes it locally, and invokes the IDE extension installer without visible integrity verification.

1 observed location · review evidence