Security audit
Security checks for vulnerabilities and agentic risk
This skill is a VMware compliance scanner that stores local scan history and can optionally send findings to Anthropic for advice, but those behaviors are disclosed and aligned with its purpose.
Install only where VMware compliance posture data may be stored locally. Use a least-privilege read-only VMware account in the upstream collector skills, protect or relocate the DuckDB if running on shared machines or CI, avoid exposing the web dashboard beyond localhost without access controls, and set ANTHROPIC_API_KEY only if sending violation evidence to Anthropic is acceptable for your environment.
The advise command can use AnthropicProvider when ANTHROPIC_API_KEY is set, but the documentation does not warn that violation data may be transmitted to an external LLM service. In a cyber compliance product, violation details can expose sensitive architecture, hostnames, control failures, and hardening gaps, making silent third-party disclosure a significant privacy and security risk.
The documentation references vmware-harden apply --pilot real, which directly contradicts the skill metadata stating this skill only suggests remediations and does not execute them. In a security/compliance tool, undocumented or scope-violating remediation execution materially increases risk because operators may grant higher trust or permissions than intended, enabling configuration changes in sensitive VMware environments.
The guide recommends persisting ANTHROPIC_API_KEY in ~/.vmware-harden/.env and sourcing it in the shell. Storing long-lived API secrets in plaintext dotfiles increases the risk of accidental disclosure through backups, shell misuse, support bundles, or other local tooling that reads home-directory configuration files.
export ANTHROPIC_API_KEY=sk-ant-...
# or persist in ~/.vmware-harden/.env (chmod 600) and source it in your shell.
When the variable is unset, the advisor uses MockProvider and prints
Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.
~/.claude/settings.json (Claude Code) or the MCP section of your
Claude Desktop config:
The scan command persists collected environment evidence, snapshots, and drift history to a local DuckDB, but the documentation does not prominently warn users about that retention. In a VMware compliance context, persisted inventories, control states, and historical drift can contain sensitive security posture data that users may unintentionally store on shared workstations or CI runners.
The web command supports --host 0.0.0.0, but the documentation does not warn that binding to a non-local interface can expose compliance dashboards and stored findings over the network. Because the dashboard is read-only but likely contains sensitive posture and drift data, accidental broad exposure could leak security-relevant information to unauthorized users on the same network.
Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
export ANTHROPIC_API_KEY=sk-ant-...
# or persist in ~/.vmware-harden/.env (chmod 600) and source it in your shell.
When the variable is unset, the advisor uses MockProvider and prints
uvx/uv tool run commands without ==version create a rug-pull risk.
uvx/uv tool run commands without ==version create a rug-pull risk.
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- **No credentials of its own.** All vSphere / NSX authentication lives
in the upstream skills (`~/.vmware-aiops/.env`,
`~/.vmware-nsx-security/.env`, etc.) under `chmod 600`.
- **No outbound network calls** beyond:
1. Upstream sibling-skill collectors during `scan`.
2. Optional `api.anthropic.com` calls when `ANTHROPIC_API_KEY` is set
L17 states that vmware-harden exposes 8 MCP tools, while L36 says all 6 tools carry the [READ] marker. Because these lines are used to justify the skill's non-destructive, read-only posture, the inconsistency is an intent/documentation contradiction rather than a mere omission.
The markdown primarily uses English but line L431 includes Chinese text ("等保 2.0 三级") embedded in operational guidance. This introduces a language/locale inconsistency without user opt-in or documentation that the skill is region-specific, which can violate organizational language policy expectations.
Line L458 references "踩坑 #28" in Chinese within otherwise English documentation. Because the file does not indicate that multilingual content is expected or provide a language preference mechanism, this is a natural-language policy issue.
Line L469 again uses the Chinese phrase "踩坑 #29" in an otherwise English reference file. This forces a locale/language shift on readers without opt-in or a stated regional scope.
The file says the CLI has exactly seven top-level command groups: scan, report, baseline, drift, advise, web, and doctor. Later, it documents vmware-harden mcp as a CLI subcommand, which directly contradicts the earlier statement about the command surface.
The markdown explains that baseline import copies a YAML file into ~/.vmware-harden/baselines/, but does not surface this as a user-facing warning about persistent file creation. Because this command modifies files under the user's home directory, the description should explicitly disclose that behavior.
Line L57 introduces a workflow titled in Chinese ('等保 2.0 audit lifecycle'), and the family map at L91 also references the same term. This can indicate a locale-specific orientation in the skill documentation without an explicit opt-in or justification that the skill is region-specific.
No suspicious patterns detected.