LLM Extension Security — Threat Model and Heuristics

LLM extensions occupy a privileged position: they inject text directly into the model's context and can execute shell commands via hooks. Traditional security tools do not cover this attack surface. This skill provides the mental model and detection heuristics.

Why LLM Extensions Are Different

A malicious VS Code extension needs the user to run code it contains. A malicious LLM extension only needs to be installed — its hook scripts run automatically on every session start, and its skill/command files are read directly into the model's reasoning context.

This creates two distinct attack classes:

The mind attack class is novel and has no prior art in security tooling.