ClawHub
Back to skill

Security audit

vmware-avi

Security checks across malware telemetry and agentic risk

Overview

This is a coherent VMware AVI/NSX ALB administration skill with disclosed load balancer and AKO read/write controls, but it should be installed only with scoped credentials and careful TLS settings.

Install this only for agents that should administer AVI/NSX ALB and AKO environments. Use least-privilege controller and Kubernetes accounts, keep production write rules in vmware-policy, review previews before confirmed=True or --no-dry-run actions, and avoid curl -k or verify_ssl:false outside isolated labs; configure trusted CA certificates instead.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Vague Triggers

Medium
Confidence
95% confidence
Finding
The trigger description is overly broad and includes common operational terms like "load balancer," "ingress," and related phrases that may appear in contexts outside VMware AVI/NSX ALB. This can cause unintended invocation of a skill that has write-capable tooling, increasing the chance of acting on the wrong system or using a privileged workflow when a narrower read-only or different domain skill would be more appropriate.

Tool Parameter Abuse

High
Category
Tool Misuse
Content
### "Controller unreachable" in doctor

1. Verify the `host` and `port` in config.yaml are correct
2. Test network connectivity: `curl -k https://avi-controller.example.com/api/cluster`
3. For self-signed certs, set `verify_ssl: false` in config.yaml
4. Check if a firewall or VPN is blocking port 443
Confidence
88% confidence
Finding
curl -k

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
references/setup-guide.md:158