ClawHub
Back to skill

Security audit

vmware-pilot

Security checks across malware telemetry and agentic risk

Overview

The skill is a coherent VMware workflow orchestrator, but its safety claims are overstated for high-impact infrastructure workflows.

Review this skill before installing in production. Treat rollback as manual and best-effort unless the installed package proves otherwise, require explicit approval before any production-changing companion skill call, avoid printing or storing kubeconfig contents in chat/logs, and protect ~/.vmware workflow, audit, and baseline files as sensitive operational data.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (6)

Intent-Code Divergence

Medium
Confidence
94% confidence
Finding
The documentation states that rollback is an explicit manual operation and does not happen automatically on crash or context loss, which directly conflicts with the skill metadata promise of 'automatic rollback.' In an orchestration skill for destructive VMware workflows, this mismatch can cause operators or calling agents to assume safety guarantees that do not actually exist, increasing the chance of incomplete remediation or production-impacting failures.

Intent-Code Divergence

Medium
Confidence
96% confidence
Finding
The validator documentation and behavior imply that approval gates are a required safety control before destructive steps, but the implementation only emits warnings and still treats the workflow as valid. In an orchestration skill designed for multi-step VMware changes with rollback and human approval, this can allow destructive operations to proceed without mandatory human review, undermining a core guardrail.

Missing User Warnings

Medium
Confidence
84% confidence
Finding
The guidance includes retrieval of kubeconfig but does not warn that kubeconfig commonly contains cluster endpoints, certificates, tokens, or authentication material that should be handled as sensitive data. In a cross-skill orchestration context, normalizing kubeconfig retrieval as a routine read-only step can lead agents or users to expose credentials in logs, chat history, or downstream tools.

Missing User Warnings

Medium
Confidence
86% confidence
Finding
The baseline_capture template stores infrastructure state in ~/.vmware/baselines/{name}.json, which may include sensitive inventory, network, storage, and alarm data. Omitting a clear warning about local persistence can cause users to unknowingly write sensitive operational data to disk where it may be exposed through weak file permissions, backups, or multi-user systems.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
# Warn about missing approval gate
    if not has_approval:
        warnings.append(
            "No approval gate found — consider adding one before destructive steps"
        )

    # Warn about destructive steps before any approval gate
Confidence
94% confidence
Finding
The code explicitly downgrades the absence of approval gates to a warning, which permits autonomous execution paths for potentially destructive infrastructure actions. Given this skill's stated purpose of adding approval gates before destructive operations, failing open here weakens human-in-the-loop protections and can enable unreviewed changes in production VMware environments.

Credential Access

High
Category
Privilege Escalation
Content
| Check VM details | monitor | -- | Read-only query |
| List network segments | nsx | -- | Read-only query |
| Check capacity | aria | -- | Read-only query |
| Get kubeconfig | vks | -- | Read-only query |
| Clone, test, approve, apply | -- | pilot | Multi-step with approval gate |
| Set up network + firewall + VMs | -- | pilot | Cross-skill orchestration |
| Incident diagnosis + remediation | -- | pilot | Needs approval before action |
Confidence
91% confidence
Finding
The documentation classifies 'Get kubeconfig' as a simple read-only query, which understates that kubeconfig retrieval is credential access and can provide cluster access if mishandled. In this skill family, agents are explicitly instructed to dispatch companion tools and report results, so treating kubeconfig as ordinary output materially raises the risk of credential disclosure through logs, prompts, transcripts, or unintended reuse.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.