Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - `references/cli-reference.md` — CLI command reference
Security audit
nutanix-aiops
Security checks for vulnerabilities and agentic risk
Overview
This is a disclosed Nutanix infrastructure operations skill, but it exposes destructive production actions without an in-skill read-only mode or approval gate.
Install only if you intend to let an agent operate Nutanix Prism Central. Start with a read-only Prism account, separate test from production targets, keep NUTANIX_AIOPS_MASTER_PASSWORD out of logs and CI output, and require your own human approval process before enabling write credentials for delete, restore, failover, migration, or LCM update actions.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Rogue AgentSelf-Modification, Session Persistence
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (11)
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 80% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md | Tool | Risk | API path | Returns / undo | |------|------|----------|----------------| | `image_list` | read | `GET /api/vmm/v4.0/content/images` | image extId, name, type, size | | `image_delete` | write · **HIGH** | `DELETE /api/vmm/v4.0/content/images/{extId}` | **dry_run** | | `category_list` | read | `GET /api/prism/v4.0/config/categories` | key, value, extId | | `category_create` | write · low | `POST /api/prism/v4.0/config/categories` | new category extId | | `category_assign` | write · med | `POST …/categories/{extId}/$actions/associate` | **bulk-assign** a category to many VMs |
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 70% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
bash nutanix-aiops init # interactive onboarding wizard nutanix-aiops doctor [--skip-auth] # config + secret store + connectivity + REST-RBAC preflight nutanix-aiops mcp # start the MCP server (stdio transport)
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 70% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
bash nutanix-aiops init # interactive onboarding wizard nutanix-aiops doctor [--skip-auth] # config + secret store + connectivity + REST-RBAC preflight nutanix-aiops mcp # start the MCP server (stdio transport)
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 88% confidence
- Finding
The skill explicitly persists sensitive operational data locally: an audit database for all write operations and an encrypted credential store, plus support for a legacy plaintext password environment variable. Even though the password file is encrypted, local persistence of credentials and detailed audit records expands the attack surface if the host is compromised, backups are exposed, file permissions are weak, or environment variables leak via process listings, logs, or CI configuration.
- Content
md compatibility: > Standalone, self-governed Nutanix Prism Central operations. The governance harness (audit, token/runaway budget, undo, descriptive risk-tier labels) is bundled in the package — no external skill-family dependency. Connects to Prism Central on HTTPS :9440 with HTTP Basic auth (username + password). The v4 REST API requires an ETag/If-Match on every mutation; nutanix-aiops fetches and sends it automatically. All list tools paginate automatically; vm_list returns both AHV and ESXi VMs. All write operations are audited to a local SQLite DB under ~/.nutanix-aiops/ (relocatable via NUTANIX_AIOPS_HOME). Credentials: the Prism Central password is stored ENCRYPTED in ~/.nutanix-aiops/secrets.enc (Fernet/AES-128 + scrypt-derived key) — never plaintext on disk. Run 'nutanix-aiops init' to onboard, or 'nutanix-aiops secret set <target>' to add one. The store is unlocked by a master password from NUTANIX_AIOPS_MASTER_PASSWORD (non-interactive/MCP/CI) or an interactive prompt (CLI on a TTY). A legacy plaintext env var NUTANIX_<TARGET_NAME_UPPER>_PASSWORD is still honoured as a fallback with a deprecation warning (migrate with 'nutanix-aiops secret migrate'). The account needs REST API rights, not just Web UI access. State-changing operations require the @governed_tool decorator (budget guard + audit + risk-tier tagging). The skill does not decide whether a write is permitted — that is the agent's judgement or the connecting account's permissions. High-risk ops (vm_delete, vm_migrate, storage_container_delete, subnet_delete, snapshot_delete, snapshot_restore, pd_failover, image_delete, lcm_update) support dry_run and, at the CLI, double confirmation; reversible writes record an undo descriptor (vm_update → prior CPU/memory, vm_migrate → prior host). NUTANIX_AUDIT_APPROVED_BY and NUTANIX_AUDIT_RATIONALE are optional annotations recorded on the audit row (who/why); they are never required and never block a call.
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 93% confidence
- Finding
The skill is capable of high-impact write operations and explicitly states there is no built-in approval gate, policy file, or read-only switch; authorization is deferred to agent judgment or account permissions. In an LLM-agent setting, this is dangerous because prompt mistakes, coercion, or unsafe orchestration can trigger destructive actions against production Nutanix infrastructure as long as the connected account allows them.
- Content
md ## Governance & Safety The skill delivers reads and writes and records them; it does **not** decide whether a write is permitted. That is your agent's judgement, or the permission of the account you connect it with (connect with a Prism Central account holding only a read-only (Viewer) role — writes then fail at the server). There is no read-only switch, policy file, or approval gate.
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The capability document advertises extensive state-changing and destructive operations across a production Nutanix estate, including delete, failover, migration, restore, and firmware update actions, but it lacks a prominent consolidated warning section describing operational blast radius, prerequisites, and confirmation expectations. In an agent skill, that omission increases the chance that downstream orchestration or users treat these tools as routine actions rather than high-risk infrastructure changes, leading to accidental destructive use.
- Content
Unsafe Defaults
Medium
- Category
- Tool Misuse
- Confidence
- 80% confidence
- Finding
Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.
- Content
bash nutanix-aiops init # interactive onboarding wizard nutanix-aiops doctor [--skip-auth] # config + secret store + connectivity + REST-RBAC preflight nutanix-aiops mcp # start the MCP server (stdio transport)
Unsafe Defaults
Medium
- Category
- Tool Misuse
- Confidence
- 80% confidence
- Finding
Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.
- Content
bash nutanix-aiops init # interactive onboarding wizard nutanix-aiops doctor [--skip-auth] # config + secret store + connectivity + REST-RBAC preflight nutanix-aiops mcp # start the MCP server (stdio transport)
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
md - The Prism Central password is **never** written to disk in plaintext. It lives only in `~/.nutanix-aiops/secrets.enc`, encrypted with Fernet (AES-128-CBC + HMAC), the key derived from your master password via scrypt. Only a per-store random salt and the ciphertext are on disk (chmod 600); the master password itself is never stored. - A legacy plaintext env var `NUTANIX_<TARGET_NAME_UPPER>_PASSWORD` is still honoured as a fallback with a deprecation warning — migrate with
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 80% confidence
- Finding
The guide explicitly states that the skill does not enforce whether a write is permitted and instead relies on agent judgment or backend account permissions. In a high-impact infrastructure management skill that can power off, delete, migrate, snapshot, or fail over VMs, lack of in-skill authorization gates increases the risk of unintended or unauthorized destructive actions if the connected account is overprivileged or the agent is manipulated.
- Content
md ## Optional audit annotations The skill does not decide whether a write is permitted — that is the agent's judgement, or the permission of the account you connect it with (connect with a Prism Central account holding only a read-only (Viewer) role, and writes fail at the server). `NUTANIX_AUDIT_APPROVED_BY` / `NUTANIX_AUDIT_RATIONALE`
Static analysis
No suspicious patterns detected.