Security audit

Esxi Debian Deploy

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a real ESXi VM automation skill, but it needs Review because it uses root-level infrastructure access with unsafe defaults that can expose credentials or damage systems.

Install only after careful review, preferably in a lab or tightly controlled admin network. Before production use, validate all inputs, avoid ESXi root where possible, enable certificate and SSH host-key verification, use SSH keys instead of persistent root passwords, delete uploaded preseed ISOs, verify Debian ISO checksums, and restrict or disable the telnet serial-console firewall rule.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (6)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/esxi-deploy.sh:20
Finding: Remote Command Injection Through Unvalidated Deployment Parameters
Content: View full analysis
\"\$VM_DIR/${HOSTNAME}.vmx\" <&1 | tail -2 ``` ### Technical Analysis Command-line parameters and environment variables such as `HOSTNAME`, `CPU`, `RAM`, `DISK`, `ESXI_DATASTORE`, and `NETWORK` are not validated against restrictive allow lists. They are embedded in a large double-quoted string and transmitted to SSH, after which the ESXi shell parses that string as shell code. Local shell quoting does not make these values safe for the second parsing operation on the remote host. A value containing quote characters, command separators, command substitutions, newlines, or heredoc delimiters can escape its intended VMX or shell contex ...[truncated 1398 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/esxi-deploy.sh:39
Finding: ESXi and Guest Server Authentication Is Disabled
Content: View full analysis
/dev/null 2>&1; then ``` The resize script repeats both insecure configurations: ```bash export GOVC_URL="https://${ESXI_HOST}" export GOVC_USERNAME="${ESXI_USER:-root}" export GOVC_PASSWORD="${ESXI_PASS}" export GOVC_INSECURE=true ``` ```bash SSHPASS="$VM_PASS" sshpass -e ssh -o StrictHostKeyChecking=no "root@$VM_IP" bash -s <<'REMOTE' ``` ```bash SSHPASS="$VM_PASS" sshpass -e ssh -o StrictHostKeyChecking=no "root@$VM_IP" "df -h / | tail -1" ``` ### Technical Analysis `GOVC_INSECURE=true` causes `govc` to accept an untrusted or invalid HTTPS certificate. `StrictHostKeyChecking=no` similarly permits SSH connections without requiring the remote endpoint to match a previously trusted host key. Encryption without endpoint authentication does not prevent active interception. An attacker positioned on the management or guest network can impersonate the ESXi host or a VM. The scripts then provid ...[truncated 1371 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/esxi-deploy.sh:92
Finding: Plaintext Root Credentials Persist in the ESXi Datastore
Content: View full analysis
/dev/null || true govc datastore.upload "$CUSTOM_ISO" "ISOs/${HOSTNAME}-preseed.iso" 2>&1 | tail -1 rm -f "$CUSTOM_ISO" ``` Post-installation processing ejects the ISO but does not delete it from the datastore: ```bash # Remove CD-ROM ISO, set boot to disk govc device.cdrom.eject -vm "$HOSTNAME" -device cdrom-16000 2>/dev/null || true SSHPASS="$ESXI_PASS" sshpass -e ssh -o StrictHostKeyChecking=no "${ESXI_USER}@${ESXI_HOST}" " VMX=\"/vmfs/volumes/${ESXI_DATASTORE}/${HOSTNAME}/${HOSTNAME}.vmx\" sed -i 's|bios.bootOrder = \"cdrom,hdd\"|bios.bootOrder = \"hdd\"|' \"\$VMX\" " 2>/dev/null || true ``` ### Technical Analysis The preseed format stores account passwords as plaintext through the `passwd/root-password` and `passwd/user-password` directives. Copying this file into the custom ISO makes the password recoverable by anyone who can read the ISO. Although t ...[truncated 1622 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: scripts/esxi-deploy.sh:52
Finding: Unverified Debian Installer ISO Is Used as Executable Supply-Chain Input
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: scripts/esxi-deploy.sh:128
Finding: Persistent Direct Root Login With Password Authentication
Content: View full analysis
Remediation: View remediation

other

Note

Location: scripts/esxi-deploy.sh:135
Finding: Security-Relevant Serial Console Service and ESXi Firewall Changes
Content: View full analysis
/dev/null || true ``` ### Technical Analysis Enabling `serial-getty@ttyS0.service` is a persistence mechanism in the literal sense because the service starts on subsequent guest boots. However, it directly implements the Skill's explicitly declared serial-console functionality. No evidence indicates that it is a hidden service, backdoor, unrelated scheduled task, or unauthorized persistence mechanism. The associated network serial transport uses Telnet and therefore provides no transport encryption. Enabling the ESXi `remoteSerialPort` ruleset changes host-level firewall state and is not reverted after deployment. The service and firewall configuration should consequently be treated as a deliberate but security-sensitive operational feature. ### Attack Path 1. A VM is deployed with the serial getty enabled. 2. The ESXi remote serial firewall ruleset permits access to network-backed serial ports. 3. An attacker with network access to the exposed ESXi serial port connects over Telnet. 4. The attacker can observe or interact with the guest login console. 5. If valid guest credentials are also available, the attacker can authenticate through the serial console. ### Impact Assessment Service enablement alone does not bypass guest authentication and is necessary for the declared serial-console feature. It is therefore not classified ...[truncated 302 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Rogue AgentSelf-Modification, Session Persistence

Findings (25)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared purpose is VM deployment, but the documentation also covers post-deployment administrative actions such as resizing disks, logging into guest VMs as root, and modifying partitions/filesystems in-guest. This scope expansion is dangerous because users may authorize a provisioning skill without realizing it also enables privileged modification of existing systems using both ESXi and VM credentials.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The preseed is explicitly configured for unattended full-disk partitioning using the entire target disk and suppresses interactive confirmation. In a zero-touch ESXi deployment context, this can irreversibly destroy data if the wrong virtual disk is attached or if the template is reused in an unintended environment.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The late_command enables PermitRootLogin and PasswordAuthentication, creating direct remote root access via password. In an unattended deployment template, especially one bringing up SSH automatically, this materially increases exposure to brute-force attacks, credential reuse, and immediate compromise if the PASSWORD placeholder is weak, reused, or mishandled.
Content: No source excerpt is available for this finding.

Chaining Abuse

High

Category: Tool Misuse
Confidence: 75% confidence
Finding: Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
Content: Scanner excerpt · scripts/esxi-deploy.sh (reported line 340)May include surrounding context.
sh
if [ -n "$VM_IP" ] && [[ "$VM_IP" =~ ^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$ ]]; then # Try SSH if SSHPASS="$VM_PASS" sshpass -e ssh -o StrictHostKeyChecking=no -o ConnectTimeout=5 "root@${VM_IP}" "hostname" >/dev/null 2>&1; then kill $SERIAL_PID 2>/dev/null; rm -f "$SERIAL_LOG" echo "" echo "============================================" echo " ✅ VM $HOSTNAME is ready!"

Chaining Abuse

High

Category: Tool Misuse
Confidence: 75% confidence
Finding: Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
Content: Scanner excerpt · scripts/esxi-deploy.sh (reported line 416)May include surrounding context.
sh
if [ -n "$VM_IP" ] && [[ "$VM_IP" =~ ^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$ ]]; then # Try SSH if SSHPASS="$VM_PASS" sshpass -e ssh -o StrictHostKeyChecking=no -o ConnectTimeout=5 "root@${VM_IP}" "hostname" >/dev/null 2>&1; then kill $SERIAL_PID 2>/dev/null; rm -f "$SERIAL_LOG" echo "" echo "============================================" echo " ✅ VM $HOSTNAME is ready!"

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This markdown file documents automated VM creation and configuration, which can affect system resources and infrastructure state, but it does not include any explicit warning or caution to the user about those effects. Under the markdown-file criteria for missing user warnings, destructive or system-integrity-impacting behavior should be disclosed clearly.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 85% confidence
Finding: The skill documents shell-capable behavior but does not declare any explicit tool scope or allowed-tools boundary. In an agent environment, that omission weakens governance and can allow broader command execution than a reviewer or user expects, especially for infrastructure automation that handles hypervisor credentials and VM provisioning.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The documentation claims secrets are never embedded in process arguments, yet it also requires or endorses use of sshpass, which commonly places passwords on the command line or in similarly exposed invocation context. This mismatch can lead operators to underestimate credential exposure through process listings, shell history, logging, or audit systems.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The file states that the generated preseed uses a German locale by default, which is a natural-language locale policy concern under the stated rules. Although later customization is mentioned, the skill description itself presents the locale as a fixed behavior rather than an opt-in choice or clearly justified regional constraint.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The repeated assurance that secrets are never embedded in process arguments is inaccurate in the presence of documented sshpass-based automation. Repeating the claim increases the chance that users will deploy the skill in environments with insufficient process-level secret protections, causing credential leakage or compliance violations.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: This line explicitly fixes locale-related settings to de_DE.UTF-8, German keyboard, and Europe/Berlin timezone. Under the policy rule, forcing a specific language or locale without user opt-in is a reportable natural-language policy violation unless clearly documented as region-specific and justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The file forces de_DE.UTF-8 and a German keyboard layout in natural-language configuration values. That is a locale policy concern because the template does not present this as an opt-in choice or explain that the skill is intended only for a Germany-specific environment.
Content: No source excerpt is available for this finding.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · references/preseed-template.cfg (reported line 52)May include surrounding context.
text
### Package selection tasksel tasksel/first multiselect ssh-server, standard d-i pkgsel/include string open-vm-tools curl sudo qemu-guest-agent cloud-guest-utils d-i pkgsel/upgrade select full-upgrade popularity-contest popularity-contest/participate boolean false

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · references/preseed-template.cfg (reported line 70)May include surrounding context.
text
### Package selection tasksel tasksel/first multiselect ssh-server, standard d-i pkgsel/include string open-vm-tools curl sudo qemu-guest-agent cloud-guest-utils d-i pkgsel/upgrade select full-upgrade popularity-contest popularity-contest/participate boolean false

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · scripts/esxi-deploy.sh (reported line 114)May include surrounding context.
sh
### Package selection tasksel tasksel/first multiselect ssh-server, standard d-i pkgsel/include string open-vm-tools curl sudo qemu-guest-agent cloud-guest-utils d-i pkgsel/upgrade select full-upgrade popularity-contest popularity-contest/participate boolean false

Session Persistence

Medium

Category: Rogue Agent
Confidence: 80% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · references/preseed-template.cfg (reported line 75)May include surrounding context.
text
in-target bash -c 'echo "blacklist floppy" > /etc/modprobe.d/blacklist-floppy.conf'; \ in-target bash -c 'echo "blacklist pcspkr" >> /etc/modprobe.d/blacklist-floppy.conf'; \ in-target bash -c 'sed -i "s/^GRUB_CMDLINE_LINUX=.*/GRUB_CMDLINE_LINUX=\"console=tty0 console=ttyS0,115200n8\"/" /etc/default/grub; echo "GRUB_TERMINAL=\"console serial\"" >> /etc/default/grub; echo "GRUB_SERIAL_COMMAND=\"serial --speed=115200 --unit=0 --word=8 --parity=no --stop=1\"" >> /etc/default/grub; update-grub'; \ in-target systemctl enable serial-getty@ttyS0.service

Session Persistence

Medium

Category: Rogue Agent
Confidence: 80% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · scripts/esxi-deploy.sh (reported line 135)May include surrounding context.
sh
in-target bash -c 'echo "blacklist floppy" > /etc/modprobe.d/blacklist-floppy.conf'; \ in-target bash -c 'echo "blacklist pcspkr" >> /etc/modprobe.d/blacklist-floppy.conf'; \ in-target bash -c 'sed -i "s/^GRUB_CMDLINE_LINUX=.*/GRUB_CMDLINE_LINUX=\"console=tty0 console=ttyS0,115200n8\"/" /etc/default/grub; echo "GRUB_TERMINAL=\"console serial\"" >> /etc/default/grub; echo "GRUB_SERIAL_COMMAND=\"serial --speed=115200 --unit=0 --word=8 --parity=no --stop=1\"" >> /etc/default/grub; update-grub'; \ in-target systemctl enable serial-getty@ttyS0.service

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: This markdown file instructs the user to enable the ESXi remoteSerialPort firewall ruleset and configure a telnet-backed serial port, which affects host network exposure and system integrity. The file provides the command to make the change but does not include any warning about the security implications of opening that service.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The preseed content hard-codes de_DE.UTF-8, German keyboard layout, and Europe/Berlin timezone for every deployment. This is a natural-language locale policy issue because the script imposes a specific language/region setting without offering user opt-in or explaining a region-specific requirement.
Content: No source excerpt is available for this finding.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 98% confidence
Finding: The late_command adds the created user to the sudo group while the same script also enables password-based SSH and sets a known generated password shared with root and the user account. This creates immediate remote administrative access paths and weakens separation of privilege, making compromise of one credential equivalent to full system compromise.
Content: Scanner excerpt · scripts/esxi-deploy.sh (reported line 130)May include surrounding context.
sh
d-i preseed/late_command string \ in-target sed -i 's/^#\\?PermitRootLogin.*/PermitRootLogin yes/' /etc/ssh/sshd_config; \ in-target sed -i 's/^#\\?PasswordAuthentication.*/PasswordAuthentication yes/' /etc/ssh/sshd_config; \ in-target usermod -aG sudo user; \ in-target bash -c 'echo -e "auto ens192\\niface ens192 inet dhcp" > /etc/network/interfaces.d/vmxnet3'; \ in-target bash -c 'echo "blacklist floppy" > /etc/modprobe.d/blacklist-floppy.conf'; \ in-target bash -c 'echo "blacklist pcspkr" >> /etc/modprobe.d/blacklist-floppy.conf'; \

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The script uses StrictHostKeyChecking=no for SSH connections to both the ESXi host and the guest, and also sets GOVC_INSECURE=true, disabling certificate validation. This makes the deployment flow susceptible to machine-in-the-middle attacks, allowing interception of credentials and tampering with commands or VM configuration during provisioning.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The script explicitly enables the ESXi remote serial port firewall ruleset and exposes a telnet-backed serial console. Telnet is unencrypted and the firewall change broadens host exposure beyond the VM itself, which increases attack surface on the ESXi host and could permit unauthorized console access if network reachability is not tightly restricted.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: Using ssh with StrictHostKeyChecking=no while authenticating as root allows silent trust of any presented host key, making man-in-the-middle interception of the root session possible. Because the session performs privileged storage operations and may install packages, an attacker who can intercept traffic could capture credentials or execute arbitrary commands in the guest.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The script goes beyond resizing a virtual disk and performs privileged in-guest modification: installing packages, altering partitions, and resizing filesystems over SSH as root. In a high-trust automation context this may be intended, but it still expands the blast radius significantly: a caller expecting only hypervisor-side disk growth will also trigger network-based package installation and destructive guest storage changes.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The script may install cloud-guest-utils inside the VM automatically and silently, without explicit user acknowledgement beyond generic logging. This changes the guest software state, depends on package repositories, and can be abused in compromised network/repository scenarios or simply violate operator expectations for a resize operation.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.