ClawHub

openclaw-with-vscode

Security checks across malware telemetry and agentic risk

Overview

This skill is a coherent VS Code Copilot bridge, but it can hand broad coding requests to an agent that may edit files and run commands without enough user-control boundaries.

Install only if you trust the separate VS Code extension and are comfortable allowing OpenClaw prompts to reach Copilot Agent. Use it only in workspaces where file edits and command execution are acceptable, review Copilot changes and commands before keeping them, and avoid sending secrets or restricted code unless your Copilot policy allows it.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
90% confidence
Finding
The skill activates on very broad coding-related requests and instructs dispatch to VS Code Copilot for execution, which can lead to unintended delegation of sensitive or high-risk tasks without clear scope limits. In context, this is more dangerous because the downstream agent is described as able to edit files and run commands, so ordinary-looking prompts could trigger system-modifying actions.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill explicitly says Copilot may edit files, run commands, and create code, but it does not require a user warning or confirmation before performing system-modifying actions. This creates a real risk of unintended local changes, command execution, or abuse through prompt injection or ambiguous user requests.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal