Security audit
Security checks for vulnerabilities and agentic risk
This skill received a suspicious verdict because scanners report a VM shutdown instruction without a workload warning or separate approval, and a HIGH-severity concern that it creates and prints an audit token beyond its stated purpose.
Consider the suspicious verdict and Skillspector's DO_NOT_INSTALL recommendation before installing. In particular, review how the skill handles audit tokens and VM shutdown approvals. The scan was partial: several referenced paths were unresolved, so the available evidence does not establish that all related material was assessed.
Creating an audit token is a credential-management operation not covered by the declared GPU/PAIS functions or supporting access checks. The MCP server startup can reasonably be treated as supporting deployment configuration and is not independently flagged. The snippet does not demonstrate transmission of the token or contact with a model provider.
Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.
vmware-privateai pais kb-list [--name N] # PAIS knowledge bases vmware-privateai pais data-source-list [--name N] # PAIS RAG data sources vmware-privateai pais monitoring-summary [--top N] # fleet GPU rollup (util/mem/temp, hot/idle) vmware-privateai pais sizing --model llama-70b # LLM GPU/storage sizing (no connection) vmware-privateai pais bundle-verify <pais.yml> # local air-gap image inspector (no network) vmware-privateai access-info [--tool T] [--target T] # what may this account do? (root folder)
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
mkdir -p ~/.vmware-privateai
(
umask 077
set -C # Refuse existing files; edit an existing .env locally instead
cat > ~/.vmware-privateai/.env <<'EOF'
VMWARE_PRIVATEAI_VC_PROD_PASSWORD=REPLACE_IN_LOCAL_EDITOR
VMWARE_PRIVATEAI_PAIS_TOKEN=REPLACE_IN_LOCAL_EDITOR
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
(
umask 077
set -C # Refuse existing files; edit an existing .env locally instead
cat > ~/.vmware-privateai/.env <<'EOF'
VMWARE_PRIVATEAI_VC_PROD_PASSWORD=REPLACE_IN_LOCAL_EDITOR
VMWARE_PRIVATEAI_PAIS_TOKEN=REPLACE_IN_LOCAL_EDITOR
EOF
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
VMWARE_PRIVATEAI_PAIS_TOKEN=REPLACE_IN_LOCAL_EDITOR EOF )
This writes placeholders only. Enter passwords or tokens using a local editor after creation; do not paste live credentials into terminal commands, chat or commits. If the file exists, the command refuses to overwrite it; edit the existing file after checking its permissions are `600`.
The failure branch directs the agent to power off a VM through another skill when vGPU assignment is refused, without requiring explicit approval for the shutdown or warning about workload interruption. Approval for a GPU profile change does not necessarily authorize stopping the workload, and confirmation protections around assign_vgpu do not themselves cover this separate operation.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Create ~/.vmware-privateai/config.yaml:
targets:
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Passwords and the PAIS bearer token live only in ~/.vmware-privateai/.env:
mkdir -p ~/.vmware-privateai
(
umask 077
set -C # Refuse existing files; edit an existing .env locally instead