Vmware Pilot

• Outcome: Review
• Latest audit: Jul 21, 2026 · 1:19 PM UTC
• Version: 1.8.7

Overview

This VMware orchestration skill appears purpose-built, but it needs Review because its high-impact infrastructure workflows have inconsistent approval and rollback safeguards.

Install only if you are prepared to treat this as a high-impact infrastructure orchestration tool. Require explicit review before running custom templates, do not rely on rollback as automatic recovery, protect ~/.vmware workflow, audit, and baseline files, and handle kubeconfig or guest credentials as secrets even where the docs call them read-only.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (14)

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The document explicitly says rollback is not automatic on agent crash or context loss and must be invoked deliberately, which conflicts with the skill metadata promising automatic rollback. In an orchestration skill for production VMware changes, this mismatch can cause operators or calling agents to assume safety guarantees that do not actually exist, increasing the chance that failed destructive workflows remain partially applied.

Intent-Code Divergence

Medium

• Confidence: 93% confidence
• Finding: This is a genuine safety-relevant contradiction: the broader skill description markets automatic rollback, while this reference says rollback is explicit and user- or agent-initiated. Contradictory control semantics in infrastructure automation are dangerous because they can lead to unsafe operational assumptions during incidents or production maintenance.

Intent-Code Divergence

Medium

• Confidence: 92% confidence
• Finding: The document explicitly states approval gates are the safety mechanism for destructive operations, yet some workflow examples and guidance permit or imply destructive actions without a preceding approval step. In an orchestration skill that can power off VMs, delete segments, or revert snapshots, inconsistent safety guidance can lead operators or downstream agents to execute high-risk changes without human confirmation.

Intent-Code Divergence

Low

• Confidence: 83% confidence
• Finding: The best-practice section says workflows should always include both pre-check and post-verification, but documented examples omit one or both checks. In this skill context, missing health validation increases the chance of executing changes against an already unhealthy environment or failing to detect that a workflow caused a service issue.

Intent-Code Divergence

Low

• Confidence: 80% confidence
• Finding: The guide recommends always supplying an explicit target for routing, but several examples omit target on action or rollback steps. In multi-vCenter or multi-environment deployments, this can cause steps or rollback actions to run against the wrong environment, undermining safety controls and potentially impacting production unintentionally.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The script exposes an inventory of direct-action tools across multiple companion skills, including destructive and privileged operations, even though the skill manifest describes this skill as a pilot/orchestration layer with approval gates and rollback. In an agent environment, this kind of capability overexposure can enable unintended tool selection, policy bypass, or prompt-induced misuse by advertising operations the skill should not directly present.

Intent-Code Divergence

Low

• Confidence: 80% confidence
• Finding: The docstring presents the script as a benign workflow-design reference, but the content enumerates many actionable operations such as guest execution, rollback, cluster creation, and deletion. This mismatch can mislead users or higher-level agents about the operational sensitivity of the listed capabilities, increasing the chance of unsafe workflow construction or trust in an overly broad tool surface.

Intent-Code Divergence

Medium

• Confidence: 97% confidence
• Finding: The validator documentation explicitly states it checks that approval gates are present before destructive steps, but the implementation only emits warnings and still treats such workflows as valid. In a skill designed to orchestrate multi-step VMware operations with human approval and rollback, this mismatch can allow destructive actions to proceed without enforced approval, undermining a core safety control.

Missing User Warnings

Low

• Confidence: 70% confidence
• Finding: Auto-loading executable workflow definitions from ~/.vmware/workflows/ creates a local trust boundary issue: any process or user able to write there can influence future workflow behavior without an explicit review step at load time. In a skill that orchestrates potentially destructive VMware actions, silently accepting user-directory YAML increases the risk of tampering, persistence, or accidental execution of unsafe plans.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: Describing kubeconfig retrieval as a normal lifecycle step without warning about its sensitivity downplays that kubeconfig commonly contains cluster endpoints, identities, and authentication material. In this VMware orchestration context, exposing or mishandling kubeconfig can grant cluster access beyond the intended operator and enable lateral movement into Kubernetes environments.

Missing User Warnings

Low

• Confidence: 84% confidence
• Finding: The baseline capture pattern instructs saving infrastructure inventory, network, storage, and alarm state to local disk without discussing sensitivity or retention. That data can expose topology, asset inventory, operational state, and potentially security-relevant details useful to an attacker if the host or files are compromised.

Missing User Warnings

Low

• Confidence: 84% confidence
• Finding: The baseline_capture template explicitly saves collected infrastructure state to ~/.vmware/baselines/{name}.json, which can include sensitive inventory, host, network, storage, and alarm data. Omitting a clear warning about this local persistence can lead users to unknowingly create sensitive local artifacts that may be exposed through weak workstation security, backups, or multi-user access.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

# Warn about missing approval gate
    if not has_approval:
        warnings.append(
            "No approval gate found — consider adding one before destructive steps"
        )

    # Warn about destructive steps before any approval gate

• Confidence: 94% confidence
• Finding: No approval

Credential Access

High

• Category: Privilege Escalation

Content

| Check VM details | monitor | -- | Read-only query |
| List network segments | nsx | -- | Read-only query |
| Check capacity | aria | -- | Read-only query |
| Get kubeconfig | vks | -- | Read-only query |
| Clone, test, approve, apply | -- | pilot | Multi-step with approval gate |
| Set up network + firewall + VMs | -- | pilot | Cross-skill orchestration |
| Incident diagnosis + remediation | -- | pilot | Needs approval before action |

• Confidence: 94% confidence
• Finding: kubeconfig

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.