Security audit
VMware Monitor
Security checks for vulnerabilities and agentic risk
Overview
The package coherently describes VMware monitoring with disclosed credential use and optional background alerts, though its separately downloaded runtime remains unverified.
Use a dedicated Read-Only VMware account and keep TLS verification enabled. Grant additional privileges only for reads you need. Protect stored passwords; base64 does not encrypt them. Enable the daemon and webhooks deliberately, since alerts can contain internal names, addresses, and log text. All shipped files were reviewed, but the separately fetched Python runtime and dependencies were unavailable for verification; this verdict does not certify their read-only enforcement.
SkillSpector was not run because this plugin release contains no bundled skills.
Static analysis
No suspicious patterns detected.