Cli Vscode

Security checks across malware telemetry and agentic risk

Overview

This is a straightforward VSCode command wrapper, but users should approve extension installs and workspace changes deliberately.

Install this only if you want an agent to operate VSCode locally. Use trusted extension IDs, review folder paths before adding them to a workspace, and avoid running the Linux `sudo` setup command unless the target VSCode path is correct.

SkillSpector

By NVIDIA

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

Confidence: 87% confidence
Finding: The skill explicitly supports installing VSCode extensions and modifying the workspace, which are state-changing actions on the local development environment, but it does not warn the user or agent about trust, side effects, or approval requirements. In an agent context, these actions can introduce untrusted code execution paths via extensions or alter a user's working environment without informed consent.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal