Vvvv Editor Extensions

Security checks across malware telemetry and agentic risk

Overview

This is a coherent, instruction-only reference for creating vvvv gamma editor extensions, with no code, install steps, credentials, or hidden data flows.

This skill appears safe as an instruction-only reference. Before installing or using it, be aware that vvvv editor extensions can run when opened and can modify editor state, so review any generated .HDE.vl files or editor commands before relying on them.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Risk analysis

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

#
ASI04: Agentic Supply Chain Vulnerabilities
Info
What this means

You are mainly trusting the registry entry and SKILL.md guidance as provided.

Why it was flagged

The skill is instruction-only and has no executable install path, but the provided metadata does not identify an upstream source or homepage for independent verification.

Skill content
Source: unknown; Homepage: none
Recommendation

If accuracy matters, compare the guidance with official vvvv gamma documentation or another trusted source.

#
ASI05: Unexpected Code Execution
Low
What this means

Opening a generated or third-party .HDE.vl extension in the editor may run its extension logic.

Why it was flagged

The skill explicitly describes creating editor extension files that execute automatically when opened, which is expected for this purpose but important for users to understand.

Skill content
Extensions are standard VL patches saved with a `.HDE.vl` suffix. They run automatically when open in the editor.
Recommendation

Review generated extension patches before opening or sharing them, especially if they automate editor behavior.

#
ASI02: Tool Misuse and Exploitation
Low
What this means

An extension built from this guidance could alter open vvvv patches or editor workflows.

Why it was flagged

The documented API can inspect and modify editor nodes or pins. This is aligned with editor extension development, but it can change project state if used in generated extensions.

Skill content
Access hovered/selected nodes, read/write pins via `VL.Lang` `Session` category nodes.
Recommendation

Ask the agent to explain any read/write editor API usage and keep changes scoped to the intended project or command.