Please avoid publishing exploitable details in a public issue before maintainers have had a chance to assess them. Use GitHub's private vulnerability reporting feature if enabled for the repository.
Include:
- affected version or commit;
- reproduction steps;
- impact;
- suggested mitigation if known.
The inspect command is a heuristic static triage tool. Its output is not a security certification, sandbox, antivirus result, or guarantee that an Agent extension is safe to install.