vmware-nsx-security

• Outcome: Pass
• Latest audit: Oct 15, 2026 · 5:36 PM UTC
• Version: 1.16.0

Overview

This skill manages VMware NSX security settings and uses high-impact access, but the artifacts disclose the scope, credentials, writes, audit logs, and confirmation controls clearly.

Install only if you are comfortable giving the skill an NSX account that can read or modify firewall and security objects. Use a dedicated least-privilege service account, prefer secret-manager injection over storing production passwords in .env, keep config files owner-readable only, and consider running the MCP server with read-only exposure unless writes are needed.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence

Findings (32)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 17)May include surrounding context.

md

metadata: {"openclaw":{"requires":{"anyBins":["vmware-nsx-security","uvx"]},"optional":{"env":["VMWARE_NSX_SECURITY_CONFIG","VMWARE_NSX_SECURITY_<TARGET>_PASSWORD","VMWARE_NSX_SECURITY_<TARGET>_USERNAME","VMWARE_AUDIT_APPROVED_BY"],"bins":["vmware-policy"]},"homepage":"https://github.com/vmware-skills/VMware-NSX-Security","emoji":"🔒","os":["macos","linux"]}}
compatibility: >
  vmware-policy auto-installed as Python dependency (provides @vmware_tool decorator and audit logging). All write operations audited to ~/.vmware/audit.db.
  Credentials: Each NSX Manager target requires a per-target password env var in ~/.vmware-nsx-security/.env following the pattern VMWARE_NSX_SECURITY_<TARGET_NAME_UPPER>_PASSWORD. Passwords are never logged or echoed.
  Destructive operations: DFW policy delete checks for active rules, security group delete checks for references. The three MCP delete tools preview by default — without confirm=True they return the blast radius and change nothing, and confirm=True is refused while a blocker remains or a read failed. IDS/IPS config changes require double confirmation. Traceflow is read-only.
  No webhooks, no outbound network calls, no guest operations. Local only: stdio MCP + NSX Policy API (HTTPS 443).
  Transitive dependencies: Only vmware-policy (audit/policy). No post-install scripts or background services.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 51)May include surrounding context.

md

metadata: {"openclaw":{"requires":{"anyBins":["vmware-nsx-security","uvx"]},"optional":{"env":["VMWARE_NSX_SECURITY_CONFIG","VMWARE_NSX_SECURITY_<TARGET>_PASSWORD","VMWARE_NSX_SECURITY_<TARGET>_USERNAME","VMWARE_AUDIT_APPROVED_BY"],"bins":["vmware-policy"]},"homepage":"https://github.com/vmware-skills/VMware-NSX-Security","emoji":"🔒","os":["macos","linux"]}}
compatibility: >
  vmware-policy auto-installed as Python dependency (provides @vmware_tool decorator and audit logging). All write operations audited to ~/.vmware/audit.db.
  Credentials: Each NSX Manager target requires a per-target password env var in ~/.vmware-nsx-security/.env following the pattern VMWARE_NSX_SECURITY_<TARGET_NAME_UPPER>_PASSWORD. Passwords are never logged or echoed.
  Destructive operations: DFW policy delete checks for active rules, security group delete checks for references. The three MCP delete tools preview by default — without confirm=True they return the blast radius and change nothing, and confirm=True is refused while a blocker remains or a read failed. IDS/IPS config changes require double confirmation. Traceflow is read-only.
  No webhooks, no outbound network calls, no guest operations. Local only: stdio MCP + NSX Policy API (HTTPS 443).
  Transitive dependencies: Only vmware-policy (audit/policy). No post-install scripts or background services.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 314)May include surrounding context.

md

metadata: {"openclaw":{"requires":{"anyBins":["vmware-nsx-security","uvx"]},"optional":{"env":["VMWARE_NSX_SECURITY_CONFIG","VMWARE_NSX_SECURITY_<TARGET>_PASSWORD","VMWARE_NSX_SECURITY_<TARGET>_USERNAME","VMWARE_AUDIT_APPROVED_BY"],"bins":["vmware-policy"]},"homepage":"https://github.com/vmware-skills/VMware-NSX-Security","emoji":"🔒","os":["macos","linux"]}}
compatibility: >
  vmware-policy auto-installed as Python dependency (provides @vmware_tool decorator and audit logging). All write operations audited to ~/.vmware/audit.db.
  Credentials: Each NSX Manager target requires a per-target password env var in ~/.vmware-nsx-security/.env following the pattern VMWARE_NSX_SECURITY_<TARGET_NAME_UPPER>_PASSWORD. Passwords are never logged or echoed.
  Destructive operations: DFW policy delete checks for active rules, security group delete checks for references. The three MCP delete tools preview by default — without confirm=True they return the blast radius and change nothing, and confirm=True is refused while a blocker remains or a read failed. IDS/IPS config changes require double confirmation. Traceflow is read-only.
  No webhooks, no outbound network calls, no guest operations. Local only: stdio MCP + NSX Policy API (HTTPS 443).
  Transitive dependencies: Only vmware-policy (audit/policy). No post-install scripts or background services.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 316)May include surrounding context.

md

metadata: {"openclaw":{"requires":{"anyBins":["vmware-nsx-security","uvx"]},"optional":{"env":["VMWARE_NSX_SECURITY_CONFIG","VMWARE_NSX_SECURITY_<TARGET>_PASSWORD","VMWARE_NSX_SECURITY_<TARGET>_USERNAME","VMWARE_AUDIT_APPROVED_BY"],"bins":["vmware-policy"]},"homepage":"https://github.com/vmware-skills/VMware-NSX-Security","emoji":"🔒","os":["macos","linux"]}}
compatibility: >
  vmware-policy auto-installed as Python dependency (provides @vmware_tool decorator and audit logging). All write operations audited to ~/.vmware/audit.db.
  Credentials: Each NSX Manager target requires a per-target password env var in ~/.vmware-nsx-security/.env following the pattern VMWARE_NSX_SECURITY_<TARGET_NAME_UPPER>_PASSWORD. Passwords are never logged or echoed.
  Destructive operations: DFW policy delete checks for active rules, security group delete checks for references. The three MCP delete tools preview by default — without confirm=True they return the blast radius and change nothing, and confirm=True is refused while a blocker remains or a read failed. IDS/IPS config changes require double confirmation. Traceflow is read-only.
  No webhooks, no outbound network calls, no guest operations. Local only: stdio MCP + NSX Policy API (HTTPS 443).
  Transitive dependencies: Only vmware-policy (audit/policy). No post-install scripts or background services.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/cli-reference.md (reported line 238)May include surrounding context.

md

metadata: {"openclaw":{"requires":{"anyBins":["vmware-nsx-security","uvx"]},"optional":{"env":["VMWARE_NSX_SECURITY_CONFIG","VMWARE_NSX_SECURITY_<TARGET>_PASSWORD","VMWARE_NSX_SECURITY_<TARGET>_USERNAME","VMWARE_AUDIT_APPROVED_BY"],"bins":["vmware-policy"]},"homepage":"https://github.com/vmware-skills/VMware-NSX-Security","emoji":"🔒","os":["macos","linux"]}}
compatibility: >
  vmware-policy auto-installed as Python dependency (provides @vmware_tool decorator and audit logging). All write operations audited to ~/.vmware/audit.db.
  Credentials: Each NSX Manager target requires a per-target password env var in ~/.vmware-nsx-security/.env following the pattern VMWARE_NSX_SECURITY_<TARGET_NAME_UPPER>_PASSWORD. Passwords are never logged or echoed.
  Destructive operations: DFW policy delete checks for active rules, security group delete checks for references. The three MCP delete tools preview by default — without confirm=True they return the blast radius and change nothing, and confirm=True is refused while a blocker remains or a read failed. IDS/IPS config changes require double confirmation. Traceflow is read-only.
  No webhooks, no outbound network calls, no guest operations. Local only: stdio MCP + NSX Policy API (HTTPS 443).
  Transitive dependencies: Only vmware-policy (audit/policy). No post-install scripts or background services.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/setup-guide.md (reported line 88)May include surrounding context.

md

metadata: {"openclaw":{"requires":{"anyBins":["vmware-nsx-security","uvx"]},"optional":{"env":["VMWARE_NSX_SECURITY_CONFIG","VMWARE_NSX_SECURITY_<TARGET>_PASSWORD","VMWARE_NSX_SECURITY_<TARGET>_USERNAME","VMWARE_AUDIT_APPROVED_BY"],"bins":["vmware-policy"]},"homepage":"https://github.com/vmware-skills/VMware-NSX-Security","emoji":"🔒","os":["macos","linux"]}}
compatibility: >
  vmware-policy auto-installed as Python dependency (provides @vmware_tool decorator and audit logging). All write operations audited to ~/.vmware/audit.db.
  Credentials: Each NSX Manager target requires a per-target password env var in ~/.vmware-nsx-security/.env following the pattern VMWARE_NSX_SECURITY_<TARGET_NAME_UPPER>_PASSWORD. Passwords are never logged or echoed.
  Destructive operations: DFW policy delete checks for active rules, security group delete checks for references. The three MCP delete tools preview by default — without confirm=True they return the blast radius and change nothing, and confirm=True is refused while a blocker remains or a read failed. IDS/IPS config changes require double confirmation. Traceflow is read-only.
  No webhooks, no outbound network calls, no guest operations. Local only: stdio MCP + NSX Policy API (HTTPS 443).
  Transitive dependencies: Only vmware-policy (audit/policy). No post-install scripts or background services.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 88% confidence

Finding

Documenting a diagnostic command with --skip-auth can normalize use of an authentication-bypassing flag and encourage agents or users to run checks without validating credentials. In an administrative security tool, that weakens assurance, can hide misconfiguration, and may produce misleading health results that operators treat as trustworthy.

Content

Scanner excerpt · SKILL.md (reported line 247)May include surrounding context.

vmware-nsx-security idps status

Diagnostics

vmware-nsx-security doctor [--skip-auth]

text

## Troubleshooting

Memory Manipulation

High

• Category: Memory Poisoning
• Confidence: 85% confidence

Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · references/capabilities.md (reported line 146)May include surrounding context.

md

| Update policy | PATCH | /policy/api/v1/infra/domains/default/security-policies/{id} |
| Delete policy | DELETE | /policy/api/v1/infra/domains/default/security-policies/{id} (MCP first GETs the policy and walks its `/rules`) |
| List rules | GET | /policy/api/v1/infra/domains/default/security-policies/{id}/rules |
| Create/replace rule | PUT | .../rules/{rule-id} |
| Update rule | PATCH | .../rules/{rule-id} |
| Delete rule | DELETE | .../rules/{rule-id} (MCP first GETs the policy and walks its `/rules` for the rule) |
| Rule statistics | GET | .../rules/{rule-id}/statistics |

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 70% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/cli-reference.md (reported line 241)May include surrounding context.

Run pre-flight checks: config file, .env permissions, config parse, passwords, network reachability, NSX authentication, NSX version, MCP server import.

bash

vmware-nsx-security doctor [--skip-auth] [--config <path>]

| Option | Description |

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 70% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/cli-reference.md (reported line 246)May include surrounding context.

Run pre-flight checks: config file, .env permissions, config parse, passwords, network reachability, NSX authentication, NSX version, MCP server import.

bash

vmware-nsx-security doctor [--skip-auth] [--config <path>]

| Option | Description |

Credential Access

High

• Category: Privilege Escalation
• Confidence: 92% confidence

Finding

The guide instructs users to store NSX passwords in a local .env file. Even with chmod 600, plaintext secrets on disk are a credential-exposure risk through backups, endpoint compromise, shell/editor artifacts, accidental inclusion in home-directory sync, or local privilege abuse; in this skill's context, those credentials may grant firewall and microsegmentation write access to production NSX.

Content

Scanner excerpt · references/setup-guide.md (reported line 67)May include surrounding context.

Passwords are never stored in config.yaml. Use environment variables or a .env file:

bash

# Create .env file
cat > ~/.vmware-nsx-security/.env << 'EOF'
VMWARE_NSX_SECURITY_NSX_PROD_PASSWORD=your_prod_password
VMWARE_NSX_SECURITY_NSX_LAB_PASSWORD=your_lab_password

Credential Access

High

• Category: Privilege Escalation
• Confidence: 92% confidence

Finding

The example writes actual password variables directly into ~/.vmware-nsx-security/.env, normalizing on-disk secret storage. In a security-management tool, compromise of these credentials could enable unauthorized policy changes, security group modification, or disabling/probing of NSX protections.

Content

Scanner excerpt · references/setup-guide.md (reported line 68)May include surrounding context.

bash

# Create .env file
cat > ~/.vmware-nsx-security/.env << 'EOF'
VMWARE_NSX_SECURITY_NSX_PROD_PASSWORD=your_prod_password
VMWARE_NSX_SECURITY_NSX_LAB_PASSWORD=your_lab_password
EOF

Credential Access

High

• Category: Privilege Escalation
• Confidence: 89% confidence

Finding

Although this line is about securing .env permissions, it reinforces reliance on a local file containing credentials. Restrictive permissions help, but they do not eliminate exposure if the account, host, backup system, or synced home directory is compromised.

Content

Scanner excerpt · references/setup-guide.md (reported line 74)May include surrounding context.

EOF

Secure the file — IMPORTANT

chmod 600 ~/.vmware-nsx-security/.env

text

**Password variable naming convention**: `VMWARE_NSX_SECURITY_<TARGET>_PASSWORD`

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 6)May include surrounding context.

md

description: >
  Use this skill whenever the user needs to manage VMware NSX security (rebranded VMware vDefend in VCF 9) — distributed firewall (DFW) policies, security groups, microsegmentation, and IDS/IPS.
  Directly handles: create/manage DFW policies and rules, security groups, VM tags, network traceflow diagnostics, IDPS profiles and status.
  Always use this skill for "create firewall rule", "set up microsegmentation", "add VM to security group", "run traceflow", "check IDS status", "vDefend firewall rule", or any NSX security / vDefend / DFW task.
  Do NOT use for NSX networking operations like segments, gateways, NAT, or routing (use vmware-nsx), or VM lifecycle (use vmware-aiops).
  For load balancing/AVI/AKO use vmware-avi.
installer:

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 51)May include surrounding context.

bash

uv tool install vmware-nsx-security==1.16.0
vmware-nsx-security init      # guided setup: writes config + .env (chmod 600, password grep-safe), then verifies
vmware-nsx-security doctor

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 316)May include surrounding context.

bash

uv tool install vmware-nsx-security==1.16.0
vmware-nsx-security init      # guided setup: writes config + .env (chmod 600, password grep-safe), then verifies
vmware-nsx-security doctor

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/setup-guide.md (reported line 74)May include surrounding context.

bash

uv tool install vmware-nsx-security==1.16.0
vmware-nsx-security init      # guided setup: writes config + .env (chmod 600, password grep-safe), then verifies
vmware-nsx-security doctor

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 221)May include surrounding context.

md

# DFW Policy
vmware-nsx-security policy list [--target <name>]
vmware-nsx-security policy get <policy-id>
vmware-nsx-security policy create <id> --name "Display Name" --category Application [--dry-run]
vmware-nsx-security policy delete <id> [--dry-run]

# DFW Rules

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

An exposed skip-auth option in a diagnostic path is an unsafe default-adjacent design because it lowers the barrier to bypassing a core safety check. Even if optional, its presence in the quick reference may cause automation to adopt it broadly, masking broken auth and undermining operator confidence in the tool's validation workflow.

Content

Scanner excerpt · SKILL.md (reported line 247)May include surrounding context.

vmware-nsx-security idps status

Diagnostics

vmware-nsx-security doctor [--skip-auth]

text

## Troubleshooting

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The manifest at L007 limits this skill away from NSX networking operations such as gateways, positioning it as a security-only skill. However, the documented behavior for delete_group explicitly scans gateway policies for references, which crosses into networking-policy handling beyond the stated scope.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/agent-guardrails.md (reported line 40)May include surrounding context.

md

| "Show me what a delete would remove before it happens" | **The three delete tools preview by default.** Without `confirm=True` they return `blast_radius` and delete nothing; `confirm=True` is refused while a blocker remains or a read failed. Pass it only after the user has seen the preview. |
| "Use explicit limits for queries that may return large amounts of data" | **The list envelope.** `list_dfw_policies`, `list_dfw_rules`, `list_groups` and `list_idps_profiles` return `{items, returned, limit, total, truncated, hint}`, so the model reads truncation instead of guessing at it. A 50-row default page and a whole estate look identical without it. |
| "If a listing came back empty, say so rather than claiming the call failed" | Same envelope. Empty `items` with `truncated: false` means checked-and-none — a stated result, not a silence the model has to interpret. Note `total` is `null` for name-filtered and capped listings; `truncated: true` means `items` is not the whole collection and stays true on the last page, so page with `next_offset` and stop when it is `null`. |
| "Log every state change you make" | **The `@vmware_tool` decorator.** Every write is recorded to `~/.vmware/audit.db` before the model sees the result, and policy rules are evaluated ahead of execution. |
| "Block state-changing writes against a production target" | **Policy.** An opt-in environment-scoped `deny` rule in `~/.vmware/rules.yaml` matches a target's `environment:` label and refuses matching writes before execution. |

---

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/capabilities.md (reported line 16)May include surrounding context.

md

| **L5** | Auto-remediation from learned pattern | Pattern library only; requires `risk:low` + `reversible:true` + `repeatable:true` | *(roadmap — candidates: orphaned-SG cleanup, expired temp-block rule removal)* |

**Notes**:
- L1/L2 tools are always safe for agents to call without confirmation.
- **List envelope**: `list_dfw_policies`, `list_dfw_rules`, `list_groups` and `list_idps_profiles` return `{items, returned, limit, total, truncated, hint}` instead of a bare array, so an agent can tell a complete answer from a first page rather than inferring it (VMware-AIops issue #31). `total` is reported only where the scan proved it — the real count on an unfiltered listing under the 1000-item `get_all` cap; `null` for name-filtered listings (the Search API returns matches, not a countable set), for scans that stopped at the cap, and for `list_dfw_rules` (bounded to `offset + limit` by design). Page with the `next_offset` extra — pass it back as `offset` and stop when it is `null`. Never loop on `truncated`: it answers "is `items` the whole collection?", which is still `true` on the last page of a walk. The `hint` distinguishes them — mid-walk it names the next offset; on the last page it says there is no next page; past the end it says so and points back to offset 0. It never advises raising a limit that cannot return another row.
- **`rule_count` on `list_dfw_policies`**: an int where NSX reported one, `null` where it did not — `null` means "not retrieved", never "no rules". The unfiltered listing asks for the count via `include_rule_count` (NSX omits the field otherwise); a name-filtered listing is resolved through the Policy Search API, which carries no rule counts, so every count there reads `null`. Any `null` adds a `rule_count_note` to the envelope. To find out what a `null` policy enforces, call `list_dfw_rules` on it — never read `null` as an empty policy.
- L3 tools always pass through the `@vmware_tool` decorator: connection check → policy check → audit log
...[truncated 25 chars]

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · references/cli-reference.md (reported line 241)May include surrounding context.

Run pre-flight checks: config file, .env permissions, config parse, passwords, network reachability, NSX authentication, NSX version, MCP server import.

bash

vmware-nsx-security doctor [--skip-auth] [--config <path>]

| Option | Description |

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · references/cli-reference.md (reported line 246)May include surrounding context.

Run pre-flight checks: config file, .env permissions, config parse, passwords, network reachability, NSX authentication, NSX version, MCP server import.

bash

vmware-nsx-security doctor [--skip-auth] [--config <path>]

| Option | Description |

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/setup-guide.md (reported line 6)May include surrounding context.

md

## Prerequisites

- NSX Manager 3.x or 4.x (NSX-T)
- An NSX admin account with DFW read/write permissions
- Python 3.10+ and `uv` installed

## 1. Install

Static analysis

No suspicious patterns detected.