VCF LCM Pre-check Analyzer

• Outcome: Review
• Latest audit: May 28, 2026 · 8:47 AM UTC
• Version: 1.0.1

Overview

The skill appears to do what it claims, but it uses an SDDC Manager API token while disabling TLS certificate verification, so it needs review before installation.

Review before installing, especially in production. Use a minimally scoped read-only SDDC Manager token where possible, do not store it in shared config or source control, pin dependencies, and change the server to verify TLS with your VCF CA bundle instead of disabling certificate verification.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill requires sensitive environment variables and clearly instructs users to run a local Python MCP server that connects over the network to SDDC Manager, yet it does not declare corresponding permissions. This creates a transparency and trust problem: an agent/operator may enable the skill without realizing it can access credentials and make authenticated network requests into infrastructure management systems.

Vague Triggers

Medium

• Confidence: 78% confidence
• Finding: The description says the skill interfaces directly with SDDC Manager and provides remediation guidance, but it does not define when the skill should be invoked or what user intent must be present. In agentic systems, vague activation criteria can cause unnecessary or unintended use of a network-connected tool against sensitive infrastructure, increasing the chance of credential use or data retrieval outside user expectations.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The documentation shows configuration of an API token for SDDC Manager without any warning about secure storage, least-privilege scoping, rotation, or the risk of exposing infrastructure-management credentials. Because this token grants access to a high-value management plane, poor handling could lead to unauthorized access, information disclosure, or broader environment compromise.

Missing User Warnings

Medium

• Confidence: 99% confidence
• Finding: The request disables TLS certificate verification, which allows a machine-in-the-middle attacker to intercept or modify traffic to SDDC Manager even though a bearer token is used. In this skill's context, that can expose the API token and permit falsified pre-check results or response manipulation from a privileged infrastructure management endpoint.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

mcp
requests

• Confidence: 97% confidence
• Finding: The dependency 'mcp' is unpinned, so installations may resolve to different versions over time, including newly introduced vulnerable or breaking releases. In a security-sensitive MCP server that interfaces with infrastructure management systems, this weakens supply-chain control and can unexpectedly introduce exploitable behavior.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

mcp
requests

• Confidence: 96% confidence
• Finding: The dependency 'requests' is also unpinned, which makes builds non-reproducible and increases exposure to vulnerable or malicious upstream releases. Because this skill likely performs authenticated HTTP calls to VCF/SDDC Manager, uncontrolled dependency resolution could directly affect network trust, credential handling, and transport security.

Known Vulnerable Dependency: mcp — 3 advisory(ies): CVE-2025-53366 (MCP Python SDK vulnerability in the FastMCP Server causes validation error, lead); CVE-2025-66416 (Model Context Protocol (MCP) Python SDK does not enable DNS rebinding protection); CVE-2025-53365 (MCP Python SDK has Unhandled Exception in Streamable HTTP Transport, Leading to )

High

• Category: Supply Chain
• Confidence: 98% confidence
• Finding: The file declares 'mcp' without any version constraint, and the analyzer reports multiple advisories affecting that package. Given this is an MCP server, use of a vulnerable MCP SDK is especially relevant because issues such as DNS rebinding protection gaps, validation errors, or transport exception handling flaws may be directly reachable in normal operation.

Known Vulnerable Dependency: requests — 10 advisory(ies): CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +7 more

High

• Category: Supply Chain
• Confidence: 95% confidence
• Finding: The declared 'requests' dependency is associated with multiple known advisories, and because no version is pinned, installation may select a vulnerable release. In a tool that likely connects to SDDC Manager APIs and may use authentication, flaws in requests can lead to credential leakage, weakened certificate verification behavior, or other sensitive network-security failures.

Static analysis

No suspicious patterns detected.