Lightcone Session
AdvisoryAudited by Static analysis on Apr 30, 2026.
Overview
No suspicious patterns detected.
Findings (0)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
If used carelessly, the agent could run arbitrary commands inside the cloud session or combine shell access with logged-in browser state.
The skill documents an escape-hatch debug action that runs shell commands in the cloud computer, but does not state limits or approval requirements for when the agent may use it.
`command` | For debug | Shell command to run ... `debug` | Command output | Run shell command in the computer
Use the debug action only when explicitly needed, and require user confirmation before shell commands, account-changing actions, or actions involving sensitive sessions.
The skill can act through the Lightcone account associated with the provided API key.
The skill requires a Lightcone/Tzafon API key, which is expected for creating and controlling cloud sessions, and it is disclosed in the metadata.
`requires":{"env":["TZAFON_API_KEY"]},"primaryEnv":"TZAFON_API_KEY"Use a dedicated or least-privileged API key if available, and revoke it if you stop using the skill.
Credentials or private website content entered into the cloud session may be visible to or processed by the external session provider.
The documented workflow can send credentials, screenshots, and page HTML through a cloud-computer provider session. This is aligned with the purpose, but sensitive data boundaries are not explained in the artifact.
Activate when user needs ... login sequences ... `type`, text: `password123` ... `html` | Page HTML | Extract page source
Avoid entering highly sensitive credentials unless you trust the provider and understand its data handling; close sessions when finished.