ClawHub
Back to skill

Security audit

nutanix-aiops

Security checks across malware telemetry and agentic risk

Overview

This skill is clearly for Nutanix administration, but it can perform high-impact infrastructure changes without a built-in read-only mode or approval gate.

Install only if you are comfortable giving an agent Nutanix Prism Central operational authority. Start with a read-only Prism account, isolate the ~/.nutanix-aiops state directory, avoid putting the master password in shared shells or CI logs, and require your own external approval process before destructive or LCM/DR actions.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The guide recommends placing the master password in an environment variable for unattended use, but does not warn that environment variables can be exposed through process listings, crash dumps, shell history, CI logs, or inherited child processes. Because this password unlocks the encrypted credential store, disclosure can compromise all stored Prism Central credentials for that user profile.

Session Persistence

Medium
Category
Rogue Agent
Content
compatibility: >
  Standalone, self-governed Nutanix Prism Central operations. The governance harness (audit, token/runaway budget, undo, descriptive risk-tier labels) is bundled in the package — no external skill-family dependency.
  Connects to Prism Central on HTTPS :9440 with HTTP Basic auth (username + password). The v4 REST API requires an ETag/If-Match on every mutation; nutanix-aiops fetches and sends it automatically. All list tools paginate automatically; vm_list returns both AHV and ESXi VMs.
  All write operations are audited to a local SQLite DB under ~/.nutanix-aiops/ (relocatable via NUTANIX_AIOPS_HOME).
  Credentials: the Prism Central password is stored ENCRYPTED in ~/.nutanix-aiops/secrets.enc (Fernet/AES-128 + scrypt-derived key) — never plaintext on disk. Run 'nutanix-aiops init' to onboard, or 'nutanix-aiops secret set <target>' to add one. The store is unlocked by a master password from NUTANIX_AIOPS_MASTER_PASSWORD (non-interactive/MCP/CI) or an interactive prompt (CLI on a TTY). A legacy plaintext env var NUTANIX_<TARGET_NAME_UPPER>_PASSWORD is still honoured as a fallback with a deprecation warning (migrate with 'nutanix-aiops secret migrate'). The account needs REST API rights, not just Web UI access.
  State-changing operations require the @governed_tool decorator (budget guard + audit + risk-tier tagging). The skill does not decide whether a write is permitted — that is the agent's judgement or the connecting account's permissions. High-risk ops (vm_delete, vm_migrate, storage_container_delete, subnet_delete, snapshot_delete, snapshot_restore, pd_failover, image_delete, lcm_update) support dry_run and, at the CLI, double confirmation; reversible writes record an undo descriptor (vm_update → prior CPU/memory, vm_migrate → prior host).
  NUTANIX_AUDIT_APPROVED_BY and NUTANIX_AUDIT_RATIONALE are optional annotations recorded on the audit row (who/why); they are never required and never block a call.
Confidence
91% confidence
Finding
The skill explicitly persists sensitive operational state locally: an audit database for write actions and an encrypted credential store unlocked by a master password or fallback environment variable. Even though the password is encrypted at rest, this still creates persistent local secret/session material and operational logs that could be exposed through weak filesystem permissions, host compromise, or use of the deprecated plaintext environment-variable fallback.

Session Persistence

Medium
Category
Rogue Agent
Content
## Governance & Safety

The skill delivers reads and writes and records them; it does **not** decide whether a write is
permitted. That is your agent's judgement, or the permission of the account you connect it with
(connect with a Prism Central account holding only a read-only (Viewer) role — writes then fail
at the server). There is no read-only switch, policy file, or approval gate.
Confidence
95% confidence
Finding
The skill is designed to perform state-changing operations and explicitly states there is no built-in read-only switch, policy file, or approval gate; write authorization is left entirely to the agent or connected account permissions. In an agentic context, this increases the chance of unintended destructive actions because local audit and confirmation mechanisms do not prevent misuse via MCP/tool invocation, especially for high-risk operations like VM deletion, failover, subnet deletion, or LCM updates.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.prompt_injection_instructions

Prompt-injection style instruction pattern detected.

Warn
Code
suspicious.prompt_injection_instructions
Location
references/agent-guardrails.md:31