VS Code Node

• Analyzed: May 12, 2026, 4:04 AM
• Findings: 1
• Version: 1.0.2
• Hash: b72347a59bcc1abd9ff562c15360eec8b14c57f7d455e1972f29e2a74291f5ab
• Source: palm
• External report: View on VirusTotal

Findings (1)

This skill is classified as suspicious due to its inherent high-risk capabilities, despite documented security controls. The `SKILL.md` file describes commands like `vscode.terminal.run` (allowing arbitrary command execution), `vscode.file.write`, and `vscode.file.delete` (allowing file system manipulation). While the documentation explicitly states that `vscode.terminal.run` is 'disabled by default, whitelist-only when enabled' and that 'All paths are relative to workspace root — absolute paths and `../` blocked', these capabilities, if misconfigured or if the whitelisting is too permissive, could lead to remote code execution or data loss. There is no evidence of malicious intent or prompt injection attempts within the `SKILL.md` itself, but the power of the exposed commands warrants a 'suspicious' classification.