Security audit
Security checks for vulnerabilities and agentic risk
The skill is a VMware diagnostic helper that keeps investigation records locally and does not show evidence of hidden remediation, exfiltration, or destructive behavior.
Before installing, decide where $OPS_HOME should live and how long to keep case folders, because submitted evidence can contain hostnames, IPs, and log text. If you expose the MCP server over HTTP/HTTPS, use tokens, TLS, host/origin restrictions, and preferably read-only exposure unless operators explicitly need case-write tools.
The manifest states that the skill 'never touches vSphere' and that 'its only writes are to a local case ledger.' However, the file later documents that every tool call also writes an audit row to ~/.vmware/audit.db, which is a distinct local datastore outside the case ledger. This is a real behavior-level mismatch in the declared write scope.
The skill intentionally persists investigation data, audit records, hypotheses, and evidence until manually deleted, and the case contents may include hostnames, addresses, and log/event text. Even though storage is local and owner-only, indefinite retention of sensitive operational data increases exposure from endpoint compromise, multi-user host misconfiguration, backups, or accidental disclosure.
## Audit & Safety
No network, nothing executed. The seven [WRITE] tools write only to the local case
ledger under `$OPS_HOME`; nothing here touches a remote VMware estate. Evidence, gaps,
hypotheses and grade history are only ever added to — `timeline.md` is regenerated from
the evidence and `case.json` holds the current grade and state. Remediation is always routed to
The guide states the skill has 'no network access' and is a 'pure, offline correlation engine,' but later documents exposing it over HTTP/HTTPS to remote clients. This inconsistency can mislead operators into deploying the service with weaker scrutiny, firewalling, or risk acceptance than a network-reachable service requires.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
By default the MCP server offers every tool. To offer only read tools, start it with --expose read, or set
VMWARE_DEBUG_MCP_EXPOSE=read in the MCP client's env block (useful when the client launches vmware-debug mcp itself). To offer
chosen write tools as well, add --allow-write with a comma-separated list (or VMWARE_DEBUG_MCP_ALLOW_WRITE):
vmware-debug mcp --expose read --allow-write close_case
The Security section claims 'Network — none' even though the same document explains how to serve the MCP interface over HTTP/HTTPS with bearer tokens. In a security section, such a contradiction is especially risky because readers may rely on it for threat modeling and fail to apply appropriate controls to a reachable endpoint.
uvx/uv tool run commands without ==version create a rug-pull risk.
The markdown includes the Chinese phrase "联动" in the core MCP usage description, introducing a specific language into the skill's user-facing instructions without offering a language choice or explaining a locale-specific requirement. This is a natural-language locale policy issue under the rule for language/locale violations.
The audit section says 'No network, nothing executed,' which contradicts the rest of the file showing a Bash allowed tool, CLI commands, and invocation of vmware-debug subcommands. Even if those commands are local-only and not remediation actions, they are still executed processes, so the wording is inaccurate and contradictory.
The document includes Chinese text (踩坑, 联动) embedded in otherwise English guidance. This can impose a language choice on users or maintainers without indicating any opt-in, alternative, or justification for the locale change.
No suspicious patterns detected.