vmware-nsx

• Outcome: Pass
• Latest audit: Oct 18, 2026 · 1:48 AM UTC
• Version: 1.15.1

Overview

This is a clearly scoped VMware NSX administration skill with powerful but disclosed network-management capabilities and documented safeguards.

Install only with an NSX service account whose permissions match your use case. For monitoring, use a read-only NSX account and start MCP with read-only exposure. Avoid putting production passwords directly in shell history or long-lived .env files; prefer a secret manager or injected environment variables. Treat --skip-auth as temporary diagnostics only, and review delete previews before allowing confirm=True.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence

Findings (30)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 17)May include surrounding context.

md

metadata: {"openclaw":{"requires":{"anyBins":["vmware-nsx","uvx"]},"optional":{"env":["VMWARE_NSX_CONFIG","VMWARE_NSX_<TARGET>_PASSWORD","VMWARE_NSX_<TARGET>_USERNAME","VMWARE_AUDIT_APPROVED_BY"],"bins":["vmware-policy"]},"homepage":"https://github.com/vmware-skills/VMware-NSX","emoji":"🌐","os":["macos","linux"]}}
compatibility: >
  vmware-policy auto-installed as Python dependency (provides @vmware_tool decorator and audit logging). All write operations audited to ~/.vmware/audit.db.
  Credentials: Each NSX Manager target requires a per-target password env var in ~/.vmware-nsx/.env following the pattern VMWARE_NSX_<TARGET_NAME_UPPER>_PASSWORD. Username/password session auth only (client-certificate auth is not implemented). Passwords are never logged or echoed.
  Write operations: CLI write commands require double confirmation and support --dry-run. The five MCP delete tools preview by default — without confirm=True they return the blast radius and change nothing, and confirm=True is refused while a blocker remains (attached ports, Tier-1 dependents, allocated IPs) or a read failed. Other MCP write tools execute when called and are audit-logged, so the agent must call them only on the user's explicit request; ~/.vmware/rules.yaml deny rules can block them per environment.
  VMWARE_AUDIT_APPROVED_BY is an optional attestation recorded in the audit row; it is not a gate and does not carry credentials.
  No webhooks, no outbound network calls, no guest operations. Local only: stdio MCP + NSX Policy API (HTTPS 443).

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 55)May include surrounding context.

md

metadata: {"openclaw":{"requires":{"anyBins":["vmware-nsx","uvx"]},"optional":{"env":["VMWARE_NSX_CONFIG","VMWARE_NSX_<TARGET>_PASSWORD","VMWARE_NSX_<TARGET>_USERNAME","VMWARE_AUDIT_APPROVED_BY"],"bins":["vmware-policy"]},"homepage":"https://github.com/vmware-skills/VMware-NSX","emoji":"🌐","os":["macos","linux"]}}
compatibility: >
  vmware-policy auto-installed as Python dependency (provides @vmware_tool decorator and audit logging). All write operations audited to ~/.vmware/audit.db.
  Credentials: Each NSX Manager target requires a per-target password env var in ~/.vmware-nsx/.env following the pattern VMWARE_NSX_<TARGET_NAME_UPPER>_PASSWORD. Username/password session auth only (client-certificate auth is not implemented). Passwords are never logged or echoed.
  Write operations: CLI write commands require double confirmation and support --dry-run. The five MCP delete tools preview by default — without confirm=True they return the blast radius and change nothing, and confirm=True is refused while a blocker remains (attached ports, Tier-1 dependents, allocated IPs) or a read failed. Other MCP write tools execute when called and are audit-logged, so the agent must call them only on the user's explicit request; ~/.vmware/rules.yaml deny rules can block them per environment.
  VMWARE_AUDIT_APPROVED_BY is an optional attestation recorded in the audit row; it is not a gate and does not carry credentials.
  No webhooks, no outbound network calls, no guest operations. Local only: stdio MCP + NSX Policy API (HTTPS 443).

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 306)May include surrounding context.

md

metadata: {"openclaw":{"requires":{"anyBins":["vmware-nsx","uvx"]},"optional":{"env":["VMWARE_NSX_CONFIG","VMWARE_NSX_<TARGET>_PASSWORD","VMWARE_NSX_<TARGET>_USERNAME","VMWARE_AUDIT_APPROVED_BY"],"bins":["vmware-policy"]},"homepage":"https://github.com/vmware-skills/VMware-NSX","emoji":"🌐","os":["macos","linux"]}}
compatibility: >
  vmware-policy auto-installed as Python dependency (provides @vmware_tool decorator and audit logging). All write operations audited to ~/.vmware/audit.db.
  Credentials: Each NSX Manager target requires a per-target password env var in ~/.vmware-nsx/.env following the pattern VMWARE_NSX_<TARGET_NAME_UPPER>_PASSWORD. Username/password session auth only (client-certificate auth is not implemented). Passwords are never logged or echoed.
  Write operations: CLI write commands require double confirmation and support --dry-run. The five MCP delete tools preview by default — without confirm=True they return the blast radius and change nothing, and confirm=True is refused while a blocker remains (attached ports, Tier-1 dependents, allocated IPs) or a read failed. Other MCP write tools execute when called and are audit-logged, so the agent must call them only on the user's explicit request; ~/.vmware/rules.yaml deny rules can block them per environment.
  VMWARE_AUDIT_APPROVED_BY is an optional attestation recorded in the audit row; it is not a gate and does not carry credentials.
  No webhooks, no outbound network calls, no guest operations. Local only: stdio MCP + NSX Policy API (HTTPS 443).

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/setup-guide.md (reported line 77)May include surrounding context.

md

metadata: {"openclaw":{"requires":{"anyBins":["vmware-nsx","uvx"]},"optional":{"env":["VMWARE_NSX_CONFIG","VMWARE_NSX_<TARGET>_PASSWORD","VMWARE_NSX_<TARGET>_USERNAME","VMWARE_AUDIT_APPROVED_BY"],"bins":["vmware-policy"]},"homepage":"https://github.com/vmware-skills/VMware-NSX","emoji":"🌐","os":["macos","linux"]}}
compatibility: >
  vmware-policy auto-installed as Python dependency (provides @vmware_tool decorator and audit logging). All write operations audited to ~/.vmware/audit.db.
  Credentials: Each NSX Manager target requires a per-target password env var in ~/.vmware-nsx/.env following the pattern VMWARE_NSX_<TARGET_NAME_UPPER>_PASSWORD. Username/password session auth only (client-certificate auth is not implemented). Passwords are never logged or echoed.
  Write operations: CLI write commands require double confirmation and support --dry-run. The five MCP delete tools preview by default — without confirm=True they return the blast radius and change nothing, and confirm=True is refused while a blocker remains (attached ports, Tier-1 dependents, allocated IPs) or a read failed. Other MCP write tools execute when called and are audit-logged, so the agent must call them only on the user's explicit request; ~/.vmware/rules.yaml deny rules can block them per environment.
  VMWARE_AUDIT_APPROVED_BY is an optional attestation recorded in the audit row; it is not a gate and does not carry credentials.
  No webhooks, no outbound network calls, no guest operations. Local only: stdio MCP + NSX Policy API (HTTPS 443).

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/setup-guide.md (reported line 84)May include surrounding context.

md

metadata: {"openclaw":{"requires":{"anyBins":["vmware-nsx","uvx"]},"optional":{"env":["VMWARE_NSX_CONFIG","VMWARE_NSX_<TARGET>_PASSWORD","VMWARE_NSX_<TARGET>_USERNAME","VMWARE_AUDIT_APPROVED_BY"],"bins":["vmware-policy"]},"homepage":"https://github.com/vmware-skills/VMware-NSX","emoji":"🌐","os":["macos","linux"]}}
compatibility: >
  vmware-policy auto-installed as Python dependency (provides @vmware_tool decorator and audit logging). All write operations audited to ~/.vmware/audit.db.
  Credentials: Each NSX Manager target requires a per-target password env var in ~/.vmware-nsx/.env following the pattern VMWARE_NSX_<TARGET_NAME_UPPER>_PASSWORD. Username/password session auth only (client-certificate auth is not implemented). Passwords are never logged or echoed.
  Write operations: CLI write commands require double confirmation and support --dry-run. The five MCP delete tools preview by default — without confirm=True they return the blast radius and change nothing, and confirm=True is refused while a blocker remains (attached ports, Tier-1 dependents, allocated IPs) or a read failed. Other MCP write tools execute when called and are audit-logged, so the agent must call them only on the user's explicit request; ~/.vmware/rules.yaml deny rules can block them per environment.
  VMWARE_AUDIT_APPROVED_BY is an optional attestation recorded in the audit row; it is not a gate and does not carry credentials.
  No webhooks, no outbound network calls, no guest operations. Local only: stdio MCP + NSX Policy API (HTTPS 443).

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/setup-guide.md (reported line 102)May include surrounding context.

md

metadata: {"openclaw":{"requires":{"anyBins":["vmware-nsx","uvx"]},"optional":{"env":["VMWARE_NSX_CONFIG","VMWARE_NSX_<TARGET>_PASSWORD","VMWARE_NSX_<TARGET>_USERNAME","VMWARE_AUDIT_APPROVED_BY"],"bins":["vmware-policy"]},"homepage":"https://github.com/vmware-skills/VMware-NSX","emoji":"🌐","os":["macos","linux"]}}
compatibility: >
  vmware-policy auto-installed as Python dependency (provides @vmware_tool decorator and audit logging). All write operations audited to ~/.vmware/audit.db.
  Credentials: Each NSX Manager target requires a per-target password env var in ~/.vmware-nsx/.env following the pattern VMWARE_NSX_<TARGET_NAME_UPPER>_PASSWORD. Username/password session auth only (client-certificate auth is not implemented). Passwords are never logged or echoed.
  Write operations: CLI write commands require double confirmation and support --dry-run. The five MCP delete tools preview by default — without confirm=True they return the blast radius and change nothing, and confirm=True is refused while a blocker remains (attached ports, Tier-1 dependents, allocated IPs) or a read failed. Other MCP write tools execute when called and are audit-logged, so the agent must call them only on the user's explicit request; ~/.vmware/rules.yaml deny rules can block them per environment.
  VMWARE_AUDIT_APPROVED_BY is an optional attestation recorded in the audit row; it is not a gate and does not carry credentials.
  No webhooks, no outbound network calls, no guest operations. Local only: stdio MCP + NSX Policy API (HTTPS 443).

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 89% confidence

Finding

The documented diagnostic option --skip-auth can normalize running checks without authenticating to the target, which may weaken assurance and lead agents or operators to trust incomplete or misleading health results. In an admin skill that performs sensitive infrastructure changes, any parameter that bypasses authentication checks increases the risk of unsafe decision-making and accidental operation in a misconfigured or unauthorized context.

Content

Scanner excerpt · SKILL.md (reported line 255)May include surrounding context.

vmware-nsx troubleshoot vm-segment

Diagnostics

vmware-nsx doctor [--skip-auth]

text

> Full CLI reference with all options and output formats: see `references/cli-reference.md`

Credential Access

High

• Category: Privilege Escalation
• Confidence: 84% confidence

Finding

The example writes a real password directly into shell history and onto disk in plaintext using echo ... > ~/.vmware-nsx/.env. Even though the file is later permission-restricted, this pattern can leak secrets through shell history, process observation in some environments, backups, or accidental file exposure.

Content

Scanner excerpt · references/setup-guide.md (reported line 82)May include surrounding context.

Passwords are never stored in config.yaml. They must be set as environment variables via the .env file.

bash

echo "VMWARE_NSX_NSX_PROD_PASSWORD=your_password" > ~/.vmware-nsx/.env
echo "VMWARE_NSX_NSX_LAB_PASSWORD=lab_password" >> ~/.vmware-nsx/.env
chmod 600 ~/.vmware-nsx/.env

Credential Access

High

• Category: Privilege Escalation
• Confidence: 84% confidence

Finding

This line repeats the insecure pattern of appending plaintext credentials into a .env file from the shell. In an infrastructure-management skill with write access to NSX, compromise of these credentials could enable network changes, exposure, or disruption across managed environments.

Content

Scanner excerpt · references/setup-guide.md (reported line 83)May include surrounding context.

bash

echo "VMWARE_NSX_NSX_PROD_PASSWORD=your_password" > ~/.vmware-nsx/.env
echo "VMWARE_NSX_NSX_LAB_PASSWORD=lab_password" >> ~/.vmware-nsx/.env
chmod 600 ~/.vmware-nsx/.env

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 71% confidence

Finding

Documenting doctor --skip-auth introduces a bypass for authentication validation during setup verification. While limited to a diagnostic command, it can normalize running health checks without proving credentials actually work, potentially causing operators or higher-level agents to treat an incomplete setup as healthy.

Content

Scanner excerpt · references/setup-guide.md (reported line 104)May include surrounding context.

This runs six checks: config file, .env file, targets, network connectivity, authentication, and MCP server module.

Use --skip-auth if NSX Manager is temporarily unreachable:

bash

vmware-nsx doctor --skip-auth

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 70% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/cli-reference.md (reported line 455)May include surrounding context.

Use --skip-auth if NSX Manager is temporarily unreachable:

bash

vmware-nsx doctor --skip-auth

MCP Server Configuration

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 70% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/setup-guide.md (reported line 107)May include surrounding context.

Use --skip-auth if NSX Manager is temporarily unreachable:

bash

vmware-nsx doctor --skip-auth

MCP Server Configuration

Agent Config Directory Access

High

• Category: Agent Snooping
• Confidence: 90% confidence

Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · references/setup-guide.md (reported line 188)May include surrounding context.

Continue

Add to ~/.continue/config.yaml:

yaml

mcpServers:

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 6)May include surrounding context.

md

description: >
  Use this skill when the user needs to inspect or manage VMware NSX networking through NSX Manager — segments, Tier-0/Tier-1 gateways, NAT, static routes/BGP, and IP pools.
  Directly handles: list and inspect segments, gateways, NAT rules, routes and IP pools; check transport node, edge cluster and manager health; find a VM's segment. Changes (create/update/delete segments, Tier-1 gateways, NAT rules, static routes, IP pools, Tier-0 BGP) only when the user explicitly asks for that change.
  Use this skill for "create segment", "set up gateway", "create NAT rule", "check network health", "troubleshoot connectivity" when the context is explicitly NSX, NSX-T, or NSX Manager.
  Do NOT use for networking outside NSX, DFW firewall rules or security groups (use vmware-nsx-security), vSphere distributed port groups or host VMkernel adapters (use vmware-aiops), VM lifecycle (use vmware-aiops), or AVI/ALB load balancing (use vmware-avi).
  For multi-step workflows use vmware-pilot.
installer:

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 55)May include surrounding context.

bash

uv tool install vmware-nsx-mgmt==1.15.1
vmware-nsx init      # guided setup: writes config + .env (chmod 600, password grep-safe), then verifies
vmware-nsx doctor

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 306)May include surrounding context.

bash

uv tool install vmware-nsx-mgmt==1.15.1
vmware-nsx init      # guided setup: writes config + .env (chmod 600, password grep-safe), then verifies
vmware-nsx doctor

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/setup-guide.md (reported line 84)May include surrounding context.

bash

uv tool install vmware-nsx-mgmt==1.15.1
vmware-nsx init      # guided setup: writes config + .env (chmod 600, password grep-safe), then verifies
vmware-nsx doctor

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 244)May include surrounding context.

md

vmware-nsx route delete-static --tier1 <id> --route-id <id> [--dry-run]

# IP pools (write)
vmware-nsx ip-pool create <pool-id> --name <name> --start <ip> --end <ip> --cidr <cidr> [--dry-run]

# Health & Troubleshooting (read-only)
vmware-nsx health alarms [--severity CRITICAL]

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Exposing skip-auth as an available diagnostic flag creates an unsafe default path where users or agents may bypass an important validation step before using a high-privilege NSX management tool. In this context, authentication is foundational to trustworthy diagnostics, so even a seemingly limited bypass can encourage workflows that ignore identity, target selection, or credential problems.

Content

Scanner excerpt · SKILL.md (reported line 255)May include surrounding context.

vmware-nsx troubleshoot vm-segment

Diagnostics

vmware-nsx doctor [--skip-auth]

text

> Full CLI reference with all options and output formats: see `references/cli-reference.md`

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/agent-guardrails.md (reported line 40)May include surrounding context.

md

| "Show me what a delete would remove before it happens" | **The five delete tools preview by default.** Without `confirm=True` they return `blast_radius` and delete nothing; `confirm=True` is refused while a blocker remains or a read failed. |
| "Use explicit limits for queries that may return large amounts of data" | **The list envelope.** Every list-returning tool returns `{items, returned, limit, total, truncated, hint}`, so the model reads truncation instead of guessing at it. `truncated: true` means `items` is not the whole collection; `next_offset` (null on the last page) is what a paging loop stops on, and the `hint` says which of the two you are looking at. |
| "If a listing came back empty, say so rather than claiming the call failed" | Same envelope. Empty `items` with `truncated: false` means the query genuinely matched nothing — a stated result, not a silence the model has to interpret. |
| "Log every state change you make" | **The `@vmware_tool` decorator.** Every write is recorded to `~/.vmware/audit.db` before the model sees the result, and policy rules are evaluated ahead of execution. |
| "Block state-changing writes against a production target" | **Policy.** An opt-in environment-scoped `deny` rule in `~/.vmware/rules.yaml` matches a target's `environment:` label and refuses matching writes before execution. |

---

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/agent-guardrails.md (reported line 133)May include surrounding context.

md

| Multi-tool workflows take 30–50s end to end | Prefer the tools that answer a whole question in one call: `get_segment_port_for_vm` finds a VM's segment directly, `get_ip_pool_usage` gives allocation without enumerating pools, and `get_nsx_manager_status` covers cluster health in one round trip. |
| Uses a segment's display name where the Policy API id is required | The identifier rule above. The failure reads as "segment not found", which a model tends to interpret as a missing object rather than a wrong key. |
| Invents or reformats an IP address, prefix length or ASN | The "report exactly as returned" rule. In this skill a plausible-looking wrong prefix is worse than no answer. |
| Proposes a deletion without checking what is attached | Require a `get_segment` port count first. The tool warns, but the model should have looked before it asked. |
| Silently falls back to the default target in a multi-manager estate | Name the target in the request. |

## Reporting results

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/capabilities.md (reported line 18)May include surrounding context.

md

| **L5** | Auto-remediation from learned pattern | Pattern library only; requires `risk:low` + `reversible:true` + `repeatable:true` | *(roadmap — candidates: stale segment cleanup, transport-node refresh)* |

**Notes**:
- L1/L2 tools are always safe for agents to call without confirmation.
- L3 tools always pass through the `@vmware_tool` decorator: policy check (`~/.vmware/rules.yaml` deny rules, per environment) → execute → audit log. The CLI's double-confirm and `--dry-run` do not apply to MCP calls.
- **MCP deletes preview by default** (`delete_segment`, `delete_tier1_gateway`, `delete_nat_rule`, `delete_static_route`, `delete_ip_pool`). A call without `confirm=True` reads what the delete would remove and returns `{"action": "preview", "blast_radius": {...}}`, deleting nothing. `blast_radius` names the object and what it measured — a segment's gateway, subnets, `port_count`/`port_ids`; a Tier-1's `tier0_path`, the `default` locale-service and edge cluster it removes, and its `dependents` by kind; a NAT rule's gateway, action, match and translation; a route's gateway, network and next hops; a pool's `pool_usage`, `allocation_count` (Policy ip-allocations), `realized_allocation_count` (NSX's `pool_usage.allocated_ip_allocations`, which also counts addresses Policy does not list, e.g. TEP pools) and `allocated_ips` — plus `blockers` and `unmeasured`. `confirm=True` re-measures and is refused, deleting nothing, while a blocker remains (attached ports, any Tier-1 dependent, allocated IPs) or while any of those reads failed (`unmeasured` non-empty); the refusal is `{"error", "hint", "blast_radius"}`. Show the preview to the user; set `confirm=True` only after they decide — not because they asked for the delete before seeing it. The preview is logged to the skill audit log as `preview`, not `ok`.
- For DFW/security rules see [vmware-nsx-security](https://github.com/vmware-skills/VMware-NSX-Security).

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

L025 states that the skill uses the NSX Policy API for all operations and explicitly says the Management API is not used. However, the capability tables later list multiple /api/v1/ Management API operations for transport nodes, edge clusters, alarms, manager status, and VM/VIF discovery, and L185 confirms this mixed usage. This is an active contradiction in the documentation about what the skill actually does.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/setup-guide.md (reported line 10)May include surrounding context.

md

- Python 3.10+
- NSX-T 3.0+ or NSX 4.x Manager
- Network access to NSX Manager on port 443 (HTTPS)
- NSX Manager credentials with appropriate role (minimum: `network_engineer` for read-only, `enterprise_admin` for write operations)

## Installation

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · references/cli-reference.md (reported line 455)May include surrounding context.

This runs six checks: config file, .env file, targets, network connectivity, authentication, and MCP server module.

Use --skip-auth if NSX Manager is temporarily unreachable:

bash

vmware-nsx doctor --skip-auth

Static analysis

No suspicious patterns detected.