Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
VS Code Node
v1.0.2Operate on code through a VS Code/Cursor IDE connected as an OpenClaw Node. Provides 40+ commands for file operations, language intelligence, git, testing, d...
⭐ 1· 877·3 current·3 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
The SKILL.md describes a VS Code/Cursor Node controller and references the 'nodes' tool and an openclaw-node-vscode extension — this matches the skill name and description. Minor inconsistency: the registry metadata in the top-level summary indicated 'Required binaries: none', while SKILL.md metadata declares a requirement for the 'nodes' tool; that mismatch should be clarified but is plausible (the skill is instruction-only and expects the platform to provide the nodes capability).
Instruction Scope
Instructions are focused on invoking node commands (file read/write, language features, git, test, debug, and delegating to a Cursor Agent). Paths are stated to be workspace-relative and terminal execution is explicitly disabled by default. The only broader capability is delegation to a Cursor Agent (vscode.agent.run), which can perform multi-step coding actions — this is within the stated purpose but operators should be aware it can run complex edits and tests.
Install Mechanism
No install spec or code files are present; the skill is instruction-only and does not download or install software itself, reducing install-time risk.
Credentials
The skill declares no required environment variables, secrets, or config paths. The instructions reference gateway configuration (allowCommands, nodes status) but do not request unrelated credentials or system-wide secrets.
Persistence & Privilege
always is false and the skill does not request persistent/system-wide privileges. It does rely on Gateway approval and per-device Ed25519 identities, which is consistent with its remote-control role.
Assessment
This skill appears to do what it says, but before installing: (1) verify and review the referenced VS Code extension and GitHub repo (the SKILL.md links to github.com/xiaoyaner-home/openclaw-vscode) to ensure you trust the extension code; (2) keep the IDE terminal disabled unless you explicitly need it and strictly whitelist only the node commands required; (3) confirm the Gateway's allowCommands whitelist and per-device approvals so the node cannot be invoked unexpectedly; (4) be cautious when using the 'vscode.agent.run' delegation — it can make broad edits or run tests in your workspace, so avoid running it on sensitive repositories without review; (5) if possible, test in a disposable workspace or VM first; and (6) clarify the small metadata mismatch about the 'nodes' tool requirement with the skill author or registry before production use.Like a lobster shell, security has layers — review code before you run it.
latestvk975qgmy3m7w20zvm4m0ntqdts81wz7z
License
MIT-0
Free to use, modify, and redistribute. No attribution required.