Security audit

vmware-debug

Security checks across malware telemetry and agentic risk

Overview

The skill is a VMware diagnostic helper, but it repeatedly says it is read-only while also documenting persistent local case-writing tools.

Review this before installing in environments that require strict read-only tools. The skill appears aimed at offline diagnosis and does not document remote VMware changes or credential use, but it can persist incident evidence locally under ~/.vmware/cases/ and may log calls to ~/.vmware/audit.db. Treat stored case data as sensitive operational data and verify storage, retention, and cleanup behavior before use.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Rogue AgentSelf-Modification, Session Persistence
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The skill repeatedly claims it is strictly read-only, but the documented toolset includes multiple write operations that persist case data under ~/.vmware/cases/. This is a security-relevant integrity issue because operators or orchestrating agents may grant it broader trust or invoke it in contexts that permit 'read-only' tools only, while it actually performs filesystem writes and creates persistent artifacts.

Intent-Code Divergence

Medium

Confidence: 96% confidence
Finding: The safety section asserts 'no write tools' even though earlier sections enumerate several [WRITE] tools and describe persistent storage locations. Contradictory safety documentation can cause policy engines, reviewers, or users to mis-scope the skill's risk and allow local state modification where it would otherwise be blocked or sandboxed.

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The guardrails describe vmware-debug as exposing write capabilities to a local investigation ledger, then later describe it as having no write tools at all. This contradiction can mislead operators, reviewers, or calling agents about the skill's true side effects, undermining assumptions about read-only safety and potentially allowing unintended local file modifications to be overlooked.

Intent-Code Divergence

Medium

Confidence: 98% confidence
Finding: The later table states there are no write tools at all, directly conflicting with the earlier statement that several writes exist to `~/.vmware/cases/`. In a security-sensitive skill, contradictory claims about mutability and side effects can cause downstream agents or users to grant broader trust than warranted, especially when the skill is advertised as 'the safest' and 'read-only.'

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: This section downplays local write behavior by emphasizing correlation and reasoning while introducing an 'investigation ledger' with multiple persistent write actions. Understating persistence is dangerous because incident data, hypotheses, and evidence may contain sensitive operational details and will remain on disk beyond the current session, affecting confidentiality and integrity expectations.

Session Persistence

Medium

Category: Rogue Agent
Content: ## Audit & Safety Read-only by construction: no write tools, no network, nothing executed. Remediation is always routed to aiops/pilot, where the double-confirm / approval / audit gates live (audit DB `~/.vmware/audit.db`). Policy rules scope by environment; debug has no config and no connection to declare one about, so it reports a constant `local` — nothing here
Confidence: 87% confidence
Finding: The skill persists state across sessions via local case folders and references an audit database, while still presenting itself as read-only/no-write. Session persistence is security-relevant because diagnostic artifacts can accumulate sensitive infrastructure data over time, be reused outside the original context, and evade user expectations about ephemeral analysis.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.