vmware-monitor

• Outcome: Pass
• Latest audit: Oct 19, 2026 · 12:27 AM UTC
• Version: 2.4.2

Overview

This is a clearly disclosed VMware monitoring skill with sensitive but purpose-aligned read-only infrastructure access and optional user-started notifications.

Install with a dedicated read-only VMware account, avoid administrator credentials, prefer a secret manager over storing passwords in .env, and enable webhooks or the daemon only when you are comfortable sending operational details such as hostnames, IPs, usernames, alarms, and event text to that destination.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (44)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

The skill documents storing vCenter credentials in a local .env file and optional webhook transmission of sanitized operational data. Even though it says credentials are not sent and files are permission-restricted, local plaintext-equivalent secret storage and outbound notifications expand the exposure surface if the host is compromised or logs/webhooks are misconfigured.

Content

Scanner excerpt · SKILL.md (reported line 17)May include surrounding context.

md

metadata: {"openclaw":{"requires":{"anyBins":["vmware-monitor","uvx"]},"optional":{"env":["VMWARE_MONITOR_CONFIG","VMWARE_TARGET_PASSWORD","VMWARE_<TARGET>_USERNAME","SLACK_WEBHOOK_URL","DISCORD_WEBHOOK_URL","VMWARE_AUDIT_APPROVED_BY"],"bins":["vmware-policy"]},"homepage":"https://github.com/vmware-skills/VMware-Monitor","emoji":"📊","os":["macos","linux"]}}
compatibility: >
  vmware-policy auto-installed as Python dependency (provides @vmware_tool decorator and audit logging). MCP tool calls and remote CLI commands audited to ~/.vmware/audit.db; CLI queries also to ~/.vmware-monitor/audit.log.
  Credentials: Each vCenter/ESXi target requires a per-target password env var in ~/.vmware-monitor/.env following the pattern VMWARE_<TARGET_NAME_UPPER>_PASSWORD (e.g., target "vcenter-prod" → VMWARE_VCENTER_PROD_PASSWORD). SLACK_WEBHOOK_URL and DISCORD_WEBHOOK_URL are optional — disabled by default, user-configured only, used solely by the opt-in daemon scanner. Daemon: the background scanner (vmware-monitor daemon start) is user-initiated only, never auto-started. Webhook payloads carry issue counts plus every critical issue and every alarm/event warning (host-log warnings and info rows are not sent): entity name and the sanitized, truncated alarm, vCenter event, or ESXi log text, or a connection error — which can include host names, IPs, and user names. No credentials from the skill's config are sent.
---

# VMware Monitor (Read-Only)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 88% confidence

Finding

The setup flow explicitly writes config and .env files containing authentication material, with only reversible obfuscation noted elsewhere. This is sensitive because local secret material on disk can be recovered by other processes, backups, or users if endpoint security or file handling is weak.

Content

Scanner excerpt · SKILL.md (reported line 272)May include surrounding context.

bash

uv tool install vmware-monitor==2.4.2
vmware-monitor init      # guided: prompts for host/user/password, writes config + .env (chmod 600), then verifies

init stores the password grep-safe (obfuscated b64:, never plaintext) and

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 70% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 233)May include surrounding context.

Diagnostics

bash

vmware-monitor doctor [--skip-auth]

Checks config file, connectivity, authentication, and pyVmomi version. Use --skip-auth to test config parsing without connecting.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 70% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/cli-reference.md (reported line 13)May include surrounding context.

Diagnostics

bash

vmware-monitor doctor [--skip-auth]

Checks config file, connectivity, authentication, and pyVmomi version. Use --skip-auth to test config parsing without connecting.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 70% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/cli-reference.md (reported line 16)May include surrounding context.

Diagnostics

bash

vmware-monitor doctor [--skip-auth]

Checks config file, connectivity, authentication, and pyVmomi version. Use --skip-auth to test config parsing without connecting.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/cli-reference.md (reported line 174)May include surrounding context.

bash

mkdir -p ~/.vmware-monitor
cp config.example.yaml ~/.vmware-monitor/config.yaml
cp .env.example ~/.vmware-monitor/.env
chmod 600 ~/.vmware-monitor/.env

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/cli-reference.md (reported line 175)May include surrounding context.

bash

mkdir -p ~/.vmware-monitor
cp config.example.yaml ~/.vmware-monitor/config.yaml
cp .env.example ~/.vmware-monitor/.env
chmod 600 ~/.vmware-monitor/.env

Credential Access

High

• Category: Privilege Escalation
• Confidence: 91% confidence

Finding

The setup guide instructs users to create and populate ~/.vmware-monitor/.env with VMware credentials, which encourages storage of plaintext or reversibly obfuscated secrets on disk. Even though the file is permission-restricted and later obfuscated as b64:, the guide itself admits this is not encryption, so compromise of the local account or backups exposes vCenter credentials.

Content

Scanner excerpt · references/setup-guide.md (reported line 74)May include surrounding context.

3. Configure

mkdir -p ~/.vmware-monitor cp config.example.yaml ~/.vmware-monitor/config.yaml cp .env.example ~/.vmware-monitor/.env chmod 600 ~/.vmware-monitor/.env

Edit ~/.vmware-monitor/config.yaml and .env with your target details

text

Credential Access

High

• Category: Privilege Escalation
• Confidence: 91% confidence

Finding

This line continues the workflow that places service credentials into a local .env file. In a tool that connects to infrastructure management systems, local credential persistence materially raises the blast radius of workstation compromise or accidental file exposure.

Content

Scanner excerpt · references/setup-guide.md (reported line 75)May include surrounding context.

mkdir -p ~/.vmware-monitor cp config.example.yaml ~/.vmware-monitor/config.yaml cp .env.example ~/.vmware-monitor/.env chmod 600 ~/.vmware-monitor/.env

Edit ~/.vmware-monitor/config.yaml and .env with your target details

text

Credential Access

High

• Category: Privilege Escalation
• Confidence: 89% confidence

Finding

Telling users to edit .env with target details reinforces a pattern of manually handling infrastructure credentials in local files. Because these credentials grant access to vCenter/ESXi, exposure could enable broad reconnaissance and, depending on account privileges, further operational abuse.

Content

Scanner excerpt · references/setup-guide.md (reported line 76)May include surrounding context.

cp config.example.yaml ~/.vmware-monitor/config.yaml cp .env.example ~/.vmware-monitor/.env chmod 600 ~/.vmware-monitor/.env

Edit ~/.vmware-monitor/config.yaml and .env with your target details

text

### Declare `environment:` on each target

Self-Modification

High

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · SKILL.md (reported line 263)May include surrounding context.

md

`environment` is an optional label. This skill has zero write tools, so nothing
it exposes is ever gated by it — reads are never gated under any setting. It
matters for the write skills (`vmware-aiops`, `vmware-storage`, `vmware-nsx`)
pointed at the same vCenter: an environment-scoped `deny` rule in
`~/.vmware/rules.yaml` can match on the label to block their writes (e.g. freeze
`production`). A target with no label is simply not matched by such a rule.

Self-Modification

High

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · references/setup-guide.md (reported line 90)May include surrounding context.

md

`environment` is an optional label. This skill has zero write tools, so nothing
it exposes is ever gated by it — reads are never gated under any setting. It
matters for the write skills (`vmware-aiops`, `vmware-storage`, `vmware-nsx`)
pointed at the same vCenter: an environment-scoped `deny` rule in
`~/.vmware/rules.yaml` can match on the label to block their writes (e.g. freeze
`production`). A target with no label is simply not matched by such a rule.

Agent Config Directory Access

High

• Category: Agent Snooping
• Confidence: 90% confidence

Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · references/setup-guide.md (reported line 143)May include surrounding context.

MCP Mode Configuration

For Claude Code / Cursor users who prefer structured tool calls, add to ~/.claude/settings.json:

json

{

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest description says to always use the skill when users ask phrases like "is anything on fire," "what needs attention now," and "investigate this VM." Several of these are natural conversational phrases rather than narrowly scoped commands, and the file does not provide negative examples or tighter routing constraints for when they should not activate.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 7)May include surrounding context.

md

Use this skill for safe, read-only queries of VMware infrastructure — no destructive operations exist in the codebase; a test enforces it.
  Directly handles: a one-glance cross-cluster health summary, object-centered VM/host/datastore investigation drill-downs (correlating surrounding infrastructure + recent events), a cross-vCenter "what needs attention now?" rollup, list VMs/hosts/datastores/clusters, active alarms, recent events, VM details.
  Always use vmware-monitor when the user asks to "list VMs", "check vSphere alarms", "show host status", "is anything on fire", "what needs attention now", "what is happening around this VM/host/datastore", "investigate this VM" — or needs read-only VMware info before making changes.
  Do NOT use for any write operations — this skill is read-only and has no code path that creates, modifies, or deletes a vSphere resource.
  For VM modifications use vmware-aiops, for networking use vmware-nsx, for metrics/capacity use vmware-aria. For load balancing/AVI/AKO use vmware-avi.
installer:
  kind: uv

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 263)May include surrounding context.

md

### Should I set `environment:` on a read-only skill?
Optional: add `environment: production` (or `staging`, `lab`, your own label)
to each target in `~/.vmware-monitor/config.yaml`. Reads are never gated by it.
It matters for the write skills (`vmware-aiops`, `vmware-storage`, `vmware-nsx`)
on the same vCenter: an environment-scoped `deny` rule in `~/.vmware/rules.yaml`
can match the label to block their writes (e.g. freeze `production`).
Config example: `references/setup-guide.md`.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/capabilities.md (reported line 80)May include surrounding context.

md

| **L5** | Auto-remediation from learned pattern | *N/A* | — *(remediation is out of scope by design)* |

**Notes**:
- No tool changes vCenter/ESXi state, so agents can call them without confirmation — gated by [`tests/eval/regression/test_read_only_enforcement.py`](https://github.com/vmware-skills/VMware-Monitor/blob/main/tests/eval/regression/test_read_only_enforcement.py) (source repository; a check on the code as written, run by the test suite — there is no CI). Results still carry sensitive inventory, event, log, and session data: scope the account as in `setup-guide.md` → Least Privilege.
- Local files the skill writes (config, `.env`, audit logs, HTML snapshots, daemon state) are listed in `setup-guide.md` → What "read-only" covers.

## 0. Cluster Health Summary (triage)

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · SKILL.md (reported line 233)May include surrounding context.

Diagnostics

bash

vmware-monitor doctor [--skip-auth]

Checks config file, connectivity, authentication, and pyVmomi version. Use --skip-auth to test config parsing without connecting.

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · references/cli-reference.md (reported line 13)May include surrounding context.

Diagnostics

bash

vmware-monitor doctor [--skip-auth]

Checks config file, connectivity, authentication, and pyVmomi version. Use --skip-auth to test config parsing without connecting.

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · references/cli-reference.md (reported line 16)May include surrounding context.

Diagnostics

bash

vmware-monitor doctor [--skip-auth]

Checks config file, connectivity, authentication, and pyVmomi version. Use --skip-auth to test config parsing without connecting.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The manifest frames the skill as a read-only query tool for VMware infrastructure and enumerates user-facing capabilities around summaries, investigations, inventory, alarms, events, and VM details. This reference adds additional operational behaviors: reading ESXi host logs and running a background APScheduler daemon, which materially extends the described behavior beyond simple on-demand queries and 'no destructive operations' messaging.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The manifest emphasizes read-only vSphere inventory, alarms, events, summaries, and object investigations via VMware APIs. Accessing and pattern-scanning hostd/vmkernel/vpxa logs is a different capability surface that reaches into host log contents, and that broader diagnostic access is not explicitly declared in the skill purpose statement.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/cli-reference.md (reported line 172)May include surrounding context.

Setup

bash

mkdir -p ~/.vmware-monitor
cp config.example.yaml ~/.vmware-monitor/config.yaml
cp .env.example ~/.vmware-monitor/.env
chmod 600 ~/.vmware-monitor/.env

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 82% confidence

Finding

npx skills add invokes an npm package (skills) without pinning its version, which can cause users to execute whatever latest package version npm resolves at install time. That creates a supply-chain risk if the package is compromised or a breaking/malicious release is published.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.