Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

VS Code Node

v1.0.2

Operate on code through a VS Code/Cursor IDE connected as an OpenClaw Node. Provides 40+ commands for file operations, language intelligence, git, testing, d...

1· 940·4 current·4 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for xiaoyaner0201/vscode-node.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "VS Code Node" (xiaoyaner0201/vscode-node) from ClawHub.
Skill page: https://clawhub.ai/xiaoyaner0201/vscode-node
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Canonical install target

openclaw skills install xiaoyaner0201/vscode-node

ClawHub CLI

Package manager switcher

npx clawhub@latest install vscode-node
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Benign
high confidence
Purpose & Capability
The SKILL.md describes a VS Code/Cursor Node controller and references the 'nodes' tool and an openclaw-node-vscode extension — this matches the skill name and description. Minor inconsistency: the registry metadata in the top-level summary indicated 'Required binaries: none', while SKILL.md metadata declares a requirement for the 'nodes' tool; that mismatch should be clarified but is plausible (the skill is instruction-only and expects the platform to provide the nodes capability).
Instruction Scope
Instructions are focused on invoking node commands (file read/write, language features, git, test, debug, and delegating to a Cursor Agent). Paths are stated to be workspace-relative and terminal execution is explicitly disabled by default. The only broader capability is delegation to a Cursor Agent (vscode.agent.run), which can perform multi-step coding actions — this is within the stated purpose but operators should be aware it can run complex edits and tests.
Install Mechanism
No install spec or code files are present; the skill is instruction-only and does not download or install software itself, reducing install-time risk.
Credentials
The skill declares no required environment variables, secrets, or config paths. The instructions reference gateway configuration (allowCommands, nodes status) but do not request unrelated credentials or system-wide secrets.
Persistence & Privilege
always is false and the skill does not request persistent/system-wide privileges. It does rely on Gateway approval and per-device Ed25519 identities, which is consistent with its remote-control role.
Assessment
This skill appears to do what it says, but before installing: (1) verify and review the referenced VS Code extension and GitHub repo (the SKILL.md links to github.com/xiaoyaner-home/openclaw-vscode) to ensure you trust the extension code; (2) keep the IDE terminal disabled unless you explicitly need it and strictly whitelist only the node commands required; (3) confirm the Gateway's allowCommands whitelist and per-device approvals so the node cannot be invoked unexpectedly; (4) be cautious when using the 'vscode.agent.run' delegation — it can make broad edits or run tests in your workspace, so avoid running it on sensitive repositories without review; (5) if possible, test in a disposable workspace or VM first; and (6) clarify the small metadata mismatch about the 'nodes' tool requirement with the skill author or registry before production use.

Like a lobster shell, security has layers — review code before you run it.

latestvk975qgmy3m7w20zvm4m0ntqdts81wz7z
940downloads
1stars
4versions
Updated 3h ago
v1.0.2
MIT-0

VS Code / Cursor Node Skill

Control a VS Code or Cursor IDE remotely through the OpenClaw Node protocol.

Related

Prerequisites

  • Extension openclaw-node-vscode installed and connected (status bar 🟢)
  • Node visible in nodes status
  • Commands in Gateway's allowCommands whitelist

Invocation Pattern

nodes invoke --node "<name>" --invokeCommand "<cmd>" --invokeParamsJson '{"key":"val"}'

Both invokeTimeoutMs (Gateway internal) and timeoutMs (HTTP layer, must be larger) are required for long operations.

Timeout guide:

TypeinvokeTimeoutMstimeoutMs
File/editor/lang1500020000
Git3000035000
Test6000065000
Agent plan/ask180000185000
Agent run300000305000

Command Categories

CategoryPrefixKey CommandsReference
Filevscode.file.*read, write, edit, deletecommands/file.md
Directoryvscode.dir.*listcommands/file.md
Languagevscode.lang.*definition, references, hover, symbols, rename, codeActions, formatcommands/language.md
Editorvscode.editor.*active, openFiles, selectionscommands/editor.md
Diagnosticsvscode.diagnostics.*getcommands/editor.md
Gitvscode.git.*status, diff, log, blame, stage, commit, stashcommands/git.md
Testvscode.test.*list, run, resultscommands/test-debug.md
Debugvscode.debug.*launch, stop, breakpoint, evaluate, stackTrace, variablescommands/test-debug.md
Terminalvscode.terminal.*run (disabled by default)commands/terminal.md
Agentvscode.agent.*status, run, setup (Cursor only)commands/agent.md
Workspacevscode.workspace.*infocommands/editor.md

Quick Examples

Read a file

nodes invoke --node "my-vscode" --invokeCommand "vscode.file.read" --invokeParamsJson '{"path":"src/main.ts"}'
→ { content, totalLines, language }

Find all references

nodes invoke --node "my-vscode" --invokeCommand "vscode.lang.references" --invokeParamsJson '{"path":"src/main.ts","line":10,"character":5}'
→ { locations: [{ path, line, character }] }

Git status + commit

nodes invoke --node "my-vscode" --invokeCommand "vscode.git.status"
→ { branch, staged, modified, untracked, ahead, behind }

nodes invoke --node "my-vscode" --invokeCommand "vscode.git.stage" --invokeParamsJson '{"paths":["src/main.ts"]}'
nodes invoke --node "my-vscode" --invokeCommand "vscode.git.commit" --invokeParamsJson '{"message":"fix: resolve type error"}'

Delegate to Cursor Agent

nodes invoke --node "my-vscode" --invokeCommand "vscode.agent.run" --invokeParamsJson '{"prompt":"Add error handling to all API endpoints","mode":"plan"}' --invokeTimeoutMs 180000 --timeoutMs 185000
→ { output, exitCode }

Common Workflows

See references/workflows.md for detailed step-by-step workflows:

  • Fix a type error
  • Safe cross-file refactor
  • Delegate complex task to Cursor Agent

Error Handling

ErrorCauseSolution
node command not allowedNot in Gateway whitelistAdd to gateway.nodes.allowCommands
node not foundExtension not connectedCheck extension status bar
timeoutOperation too longIncrease both timeout params
path traversal blockedPath outside workspaceUse relative paths only
read-only modeExtension in read-onlyDisable openclaw.readOnly setting

Security

  • All paths are relative to workspace root — absolute paths and ../ blocked
  • Writes respect readOnly and confirmWrites extension settings
  • Terminal disabled by default, whitelist-only when enabled
  • Each device has unique Ed25519 identity, must be approved by Gateway

Comments

Loading comments...