ClawHub
Back to skill

Security audit

vmware-privateai

Security checks for vulnerabilities and agentic risk

Overview

This VMware Private AI skill is purpose-aligned and transparent, but users should handle its vCenter and PAIS credentials and its one vGPU write operation with normal infrastructure-change care.

Before installing, use a dedicated least-privilege vCenter service account scoped to the GPU clusters, prefer secret-manager or environment injection over a long-lived .env file when possible, keep TLS verification enabled outside self-signed labs, and review the vGPU assignment blast radius before approving any write.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (12)

External Model or Provider Selection

High
Category
Excessive Agency
Content
vmware-privateai pais kb-list [--name N]                     # PAIS knowledge bases
vmware-privateai pais data-source-list [--name N]            # PAIS RAG data sources
vmware-privateai pais monitoring-summary [--top N]           # fleet GPU rollup (util/mem/temp, hot/idle)
vmware-privateai pais sizing --model llama-70b               # LLM GPU/storage sizing (no connection)
vmware-privateai pais bundle-verify <pais.yml>              # local air-gap image inspector (no network)
```
Full list: `references/cli-reference.md`. Per-tool response-token estimates: `references/capabilities.md`.
Confidence
90% confidence
Finding
Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Credential Access

High
Category
Privilege Escalation
Content
```bash
mkdir -p ~/.vmware-privateai
cat >> ~/.vmware-privateai/.env <<'EOF'
VMWARE_PRIVATEAI_VC_PROD_PASSWORD=your-vcenter-password
VMWARE_PRIVATEAI_PAIS_TOKEN=your-oidc-bearer-token
EOF
Confidence
76% confidence
Finding
The guide instructs users to place high-value credentials in a local `.env` file under the home directory. Although it recommends restrictive permissions and allows secret-manager injection, local plaintext-at-rest handling (with only later base64 obfuscation) increases risk of credential disclosure through backups, malware, shell history mistakes, endpoint compromise, or accidental inclusion in support bundles.

Credential Access

High
Category
Privilege Escalation
Content
VMWARE_PRIVATEAI_VC_PROD_PASSWORD=your-vcenter-password
VMWARE_PRIVATEAI_PAIS_TOKEN=your-oidc-bearer-token
EOF
chmod 600 ~/.vmware-privateai/.env
```

- **Per-target password**: `VMWARE_PRIVATEAI_<TARGET>_PASSWORD`, where `<TARGET>` is the target `name`
Confidence
78% confidence
Finding
The documentation explicitly stores a vCenter password and bearer token in a local `.env` file, then notes they are rewritten to `b64:` obfuscated form. Base64 is not a security control, so readers may overestimate the safety of persisted secrets; compromise of the user account or filesystem would expose infrastructure credentials and API tokens with potential access to VMware and PAIS resources.

Session Persistence

Medium
Category
Rogue Agent
Content
| **PAIS monitoring** | fleet GPU rollup (util/mem/temp, hot/idle, busiest) | 1 | 1 R |
| **Sizing & air-gap** | LLM GPU/storage sizing advisor, local pais.yml image inspector | 2 | 2 R |

**17 MCP tools (16 read / 1 write).** Reads are strictly non-destructive. The single write
(`vgpu_assign`) previews its blast radius, refuses a powered-on VM, never powers a VM off itself, is
double-confirmed at the CLI, and is audit-logged. Pre-flight the write with `vgpu_profile_validate`.
Confidence
60% confidence
Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium
Category
Rogue Agent
Content
with `truncated:false` means checked-and-none, not a failure. Lists paginate at `limit=50`; filter with
the tool's `name`/`vendor`/`host`/`profile`/`vm` arguments rather than paging the whole estate.

**Write safety (normative)**: `vgpu_assign` with `confirm=false` (the default) returns `blast_radius`
and changes nothing — VM name and id, current and target profile, `device_change` (`edit` the existing
vGPU device or `add` one), other passthrough devices left untouched, power state, `blockers`,
`unmeasured`. The acting response carries it too. Show it to the user and pass `confirm=true` only after
Confidence
60% confidence
Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium
Category
Rogue Agent
Content
## 2. Configure targets

Create `~/.vmware-privateai/config.yaml`:

```yaml
targets:
Confidence
60% confidence
Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Content
VMWARE_PRIVATEAI_VC_PROD_PASSWORD=your-vcenter-password
VMWARE_PRIVATEAI_PAIS_TOKEN=your-oidc-bearer-token
EOF
chmod 600 ~/.vmware-privateai/.env
```

- **Per-target password**: `VMWARE_PRIVATEAI_<TARGET>_PASSWORD`, where `<TARGET>` is the target `name`
Confidence
80% confidence
Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Content
VMWARE_PRIVATEAI_VC_PROD_PASSWORD=your-vcenter-password
VMWARE_PRIVATEAI_PAIS_TOKEN=your-oidc-bearer-token
EOF
chmod 600 ~/.vmware-privateai/.env
```

- **Per-target password**: `VMWARE_PRIVATEAI_<TARGET>_PASSWORD`, where `<TARGET>` is the target `name`
Confidence
80% confidence
Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Content
1. **Source Code** — https://github.com/vmware-skills/VMware-PrivateAI (MIT), publicly auditable.
2. **Config File Contents** — `config.yaml` holds only target host/username/port and the
   `pais.endpoint`. No passwords, no tokens. Secrets live in `~/.vmware-privateai/.env` (chmod 600,
   `b64:` obfuscated at rest).
3. **Webhook Data Scope** — none. No webhooks and no outbound network calls except to the configured
   vCenter/ESXi targets and the PAIS endpoint.
Confidence
80% confidence
Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Content
1. **Source Code** — https://github.com/vmware-skills/VMware-PrivateAI (MIT), publicly auditable.
2. **Config File Contents** — `config.yaml` holds only target host/username/port and the
   `pais.endpoint`. No passwords, no tokens. Secrets live in `~/.vmware-privateai/.env` (chmod 600,
   `b64:` obfuscated at rest).
3. **Webhook Data Scope** — none. No webhooks and no outbound network calls except to the configured
   vCenter/ESXi targets and the PAIS endpoint.
Confidence
80% confidence
Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Rp1

Medium
Category
MCP Rug Pull
Confidence
65% confidence
Finding
uvx/uv tool run commands without ==version create a rug-pull risk.

Natural-Language Policy Violations

Low
Confidence
96% confidence
Finding
The parenthetical note on L018 contains Chinese text ('踩坑 #25') in an otherwise English CLI reference. This introduces a language inconsistency without user opt-in or any indication that the skill is intentionally multilingual or region-specific, which fits the language/locale policy violation category.

Static analysis

No suspicious patterns detected.