VSCode

• Outcome: Review
• Latest audit: Jul 27, 2026 · 10:16 AM UTC
• Version: 1.0.2

Overview

The skill is transparent and VS Code-focused, but it automatically reads, writes, and restructures persistent local memory and shared host/project inventories without asking each time.

Install only if you are comfortable with a VS Code helper keeping long-lived local notes in ~/Clawic/data, including editor setup, project paths, debug ports, extension verdicts, remote host metadata, and credential pointers. Review those files periodically and avoid using it on highly sensitive projects unless that persistence model is acceptable.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (18)

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The skill instructs the agent to read repo-specific memory and prior artifacts from a persistent directory under ~/Clawic/data/vscode before performing debugging work. That creates cross-task data access outside the immediate user request and can expose unrelated project metadata, path mappings, ports, and other sensitive context from previous engagements. In a VSCode troubleshooting skill, this is not necessary to fulfill the stated purpose and increases the risk of unauthorized data reuse.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The skill directs the agent to write debugging configurations, repo entry points, ports, and mapping surprises into a persistent knowledge store. This can exfiltrate sensitive operational details from the current repository into long-lived storage unrelated to the immediate support action, enabling later unintended disclosure across users or projects. The instruction goes beyond normal VSCode debugging assistance and establishes unnecessary persistent collection of project intelligence.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The document instructs the agent to write persistent per-repo and user-level state under ~/Clawic/data, including repo-specific formatter decisions and banned extension verdicts. That behavior exceeds normal VS Code troubleshooting guidance and creates an unnecessary persistent memory channel that can store potentially sensitive workspace metadata, influence future behavior across sessions, and be abused for data retention or prompt-state poisoning.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The skill goes beyond VS Code troubleshooting and instructs the agent to modify shared operational records under ~/Clawic/data. That creates an unnecessary side effect on external state and can cause unauthorized or incorrect documentation updates, especially if the agent is invoked in a narrower troubleshooting context.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The skill instructs the agent to read from external Clawic memory and artifact files before proposing settings, which expands access beyond the user’s immediate VSCode task and can pull in unrelated or sensitive contextual data. This creates unnecessary data exposure and couples a simple configuration action to persistent external state, increasing the risk of privacy leakage and prompt-scope overreach.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The skill directs the agent to write persistent notes into external memory, artifact, and config files after resolving a setting, including recording user preferences and environment details. This is dangerous because it causes silent long-term retention of potentially sensitive information outside the immediate task, and can poison future agent behavior through unreviewed memory/config updates.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The documentation directs the agent to read from persistent files under ~/Clawic before writing a task, which expands behavior beyond normal VS Code task troubleshooting into local file access. In an agent context, this can expose unrelated local data, create hidden cross-project state dependencies, and make the skill act on untrusted or stale information from prior sessions.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The skill instructs the agent to write task and matcher artifacts into ~/Clawic and update memory indices, causing persistent side effects outside the project being edited. This is dangerous because it enables silent data retention and cross-run contamination, and could store sensitive repo details or executable guidance in a location the user did not intend this skill to modify.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The skill instructs the agent to read from persistent memory and repo-linked artifact files before performing test-related work. That expands the agent's data access beyond immediate VSCode troubleshooting and can cause unnecessary retrieval of prior user, repository, or environment information that may be sensitive or irrelevant to the current task.

Context-Inappropriate Capability

Medium

• Confidence: 98% confidence
• Finding: The documentation directs the agent to write repo-specific framework, interpreter, working directory, and troubleshooting details into persistent memory and artifact files. This creates an unnecessary durable record of workspace-specific operational data that is not required to solve the immediate VSCode issue and may later be reused out of context.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill tells the agent to record repo-specific setup into persistent local files without any warning that these details will be retained. Even seemingly routine data like interpreter paths, project roots, monorepo layout, or container-side configuration can reveal sensitive environment and repository information and surprise users who did not consent to storage.

Missing User Warnings

Low

• Confidence: 81% confidence
• Finding: The document explicitly instructs writing files into fixed user-home paths under `~/Clawic/data/...` and updating project records there, but provides no confirmation, sandboxing, or warning that these are local persistent files outside the repository. In an agent skill context, this can cause unintended modification of a user's personal workspace metadata or notes, especially if the agent follows the instruction automatically rather than treating it as advisory documentation.

Ssd 3

Medium

• Confidence: 89% confidence
• Finding: The instruction to read shared files describing hosts, roles, access pointers, and environment details normalizes access to sensitive infrastructure metadata that is not required for most VS Code troubleshooting tasks. Even when it says to store a pointer instead of a key, the existence and location of credentials, host roles, and proxy/CA requirements can materially aid reconnaissance.

Ssd 3

Medium

• Confidence: 96% confidence
• Finding: The skill instructs the agent to write machine inventory entries, access pointers, and host-level environment facts into shared documentation. Consolidating SSH key locations, host identities, proxy/CA constraints, and agent-forwarding policy in natural-language artifacts increases the blast radius of any later disclosure and exposes sensitive infrastructure relationships beyond the immediate troubleshooting need.

Ssd 3

Medium

• Confidence: 97% confidence
• Finding: Recording repo-specific details and pain points into persistent files can capture confidential workspace structure, toolchain details, service topology, and troubleshooting history. In a VSCode support skill, this context makes the issue more dangerous because users are likely to discuss internal repository layouts, remote/container environments, and CI-like commands that should not be broadly retained or resurfaced later.

Ssd 3

Medium

• Confidence: 94% confidence
• Finding: The pre-task instruction to consult persistent memory and artifact files encourages broad reuse of previously stored user and environment data for each repo. This creates a data aggregation risk: sensitive details from prior sessions may influence responses or be exposed in unrelated contexts without fresh user authorization.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

**Contents:** [The Builds](#the-builds) · [The Marketplace Boundary](#the-marketplace-boundary) · [Extensions That Do Not Travel](#extensions-that-do-not-travel) · [What Else Changes](#what-else-changes) · [Migrating Between Builds](#migrating-between-builds) · [Running Two Builds Side By Side](#running-two-builds-side-by-side) · [Choosing](#choosing) · [Fork Failure Signatures](#fork-failure-signatures)

**Before recommending an extension or a setting**, read `## Environment` in `~/Clawic/data/vscode/memory.md` for which build is in use and which extensions were already found unavailable, and open any `artifacts/decision-*.md` its `## Boxes` index names about the build choice. `vscode_build` and `extension_marketplace` in `config.yaml` are declarations — apply them without asking.

## The Builds

• Confidence: 92% confidence
• Finding: without asking

Session Persistence

Medium

• Category: Rogue Agent

Content

Everything except artifacts and the shared boxes begins inside `memory.md`. Splitting is a procedure, not a suggestion:

1. Before appending to a section, count its entries.
2. If the append would take it past **~15 entries or ~40 lines of real content** — scaffolding, headings and comments do not count — then, in the same turn: create the new file in `~/Clawic/data/vscode/`, move the whole section into it, **delete the section from `memory.md`**, add its line to `## Boxes`, and append the new entry to the new file.
3. Keep the headings identical on both sides of the move, so the split is a copy-paste and never a rewrite.
4. Never leave a copy behind. If the same data ever appears in both places, the extracted file wins and the `memory.md` copy is deleted.

• Confidence: 70% confidence
• Finding: create the new file in `~/Clawic/data/vscode/`, move the whole section into it, **delete the section from `memory.md`**, add its line to `## Boxes`, and append the new entry to the new file. 3. Keep t

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.