Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Esxi Debian Deploy
v0.1.3Zero-touch Debian 13 VM deployment on VMware ESXi 8. Builds custom preseed ISO, creates NVMe+vmxnet3 VM with serial console, and runs unattended installation...
⭐ 0· 691·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The scripts and SKILL.md implement zero-touch Debian installs on ESXi (building a preseed ISO, uploading it, creating a VMX with NVMe/vmxnet3 and telnet serial, and resizing disks). Those capabilities match the name and description. However, the registry metadata claims no required environment variables while the SKILL.md and scripts clearly require ESXI_HOST, ESXI_PASS (and VM_PASS for resizing) — a packaging/metadata mismatch that should be corrected.
Instruction Scope
Runtime instructions and included scripts stay within the deployment domain: they download the official Debian ISO, build a preseeded ISO, upload it to the ESXi datastore, SSH into the ESXi host to create VM files, and SSH into deployed VMs for resize operations. No unexpected external endpoints or obfuscated network calls are present. Notable scope-relevant behaviors: the preseed enables root login and password authentication on the guest, the generated VM password is printed to stdout and embedded in the uploaded ISO, and serial consoles are configured over unencrypted telnet — all intentional for this use-case but sensitive and should be considered before running in production.
Install Mechanism
This is instruction-only with included scripts; there is no installer that downloads arbitrary code. The only remote download is the Debian ISO from an official debian cdimage URL. Required external tooling (govc, xorriso, isolinux, sshpass) are standard and explicitly documented. No high-risk arbitrary URL downloads or archive extraction from unknown hosts were observed.
Credentials
The environment variables used (ESXI_HOST, ESXI_PASS, ESXI_USER, ESXI_DATASTORE, NETWORK, DOMAIN, VM_PASS) are relevant to the stated purpose and the scripts actually use them. That said, the metadata did not declare these requirements which is inconsistent. The script requires the ESXi root password (sensitive) and uses sshpass/GOVC_PASSWORD via environment variables. The VM root password is generated and both printed to stdout and written into the preseed ISO that gets uploaded to your datastore — a significant sensitive-data exposure risk if left on the host or logs.
Persistence & Privilege
The skill does not request permanent platform-level privileges (always:false) and does not modify other skills or agent configuration. It performs privileged operations on the remote ESXi host and VMs (via SSH/govc), which is expected for VM provisioning but requires that you trust the scripts and limit credentials accordingly.
What to consider before installing
This skill largely does what it claims, but review and operationally harden before using: 1) Fix the packaging metadata: the registry incorrectly lists no required env vars while the scripts require ESXI_HOST and ESXI_PASS (and VM_PASS for resize). 2) Audit the scripts yourself (they will run commands as root on your ESXi host and VMs). 3) Prefer SSH key-based access instead of passing ESXi root password via sshpass where possible. 4) Be aware that the generated VM password is printed to stdout and embedded in the preseed ISO uploaded to your datastore — remove the ISO and clear logs after deployment; consider modifying the preseed to force password reset on first boot or use SSH keys for guests. 5) Serial console uses telnet (unencrypted) — restrict ESXi network access or disable the serial port after use. 6) Run first in an isolated/test ESXi environment to confirm behavior (including the truncated parts of the script you should inspect for full commands like vmkfstools usage). If you need to proceed in production, require minimal privileged credentials, keep them ephemeral, and manually verify the uploaded ISO and generated VM configuration before powering on VMs.Like a lobster shell, security has layers — review code before you run it.
latestvk9767ezae40kp9d145f6fhvwnn8197fj
License
MIT-0
Free to use, modify, and redistribute. No attribution required.