ClawHub
Back to skill

Security audit

Vmware Storage

Security checks across malware telemetry and agentic risk

Overview

This VMware storage skill is coherent and disclosed, but it should be used only by administrators because it can change storage configuration and records local audit logs.

Install only if you intend to let an agent administer VMware storage. Use a dedicated least-privilege vSphere account, keep ~/.vmware-storage/.env at 600 permissions or inject secrets from a manager, review ~/.vmware/rules.yaml policy gates, use dry-run before iSCSI changes, and treat ~/.vmware/audit.db as sensitive operational data.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Session Persistence

Medium
Category
Rogue Agent
Content
### Credential Safety

- Passwords are **only loaded from environment variables** (via `.env` file), never from `config.yaml`
- The `.env` file permissions are checked at startup; a warning is logged if permissions are wider than `600` (owner read/write only)
- The `doctor` command verifies `.env` permissions and reports failures

### Audit Logging
Confidence
82% confidence
Finding
write only) - The `doctor` command verifies `.env` permissions and reports failures ### Audit Logging All operations are logged to `~/.vmware

Tool Parameter Abuse

High
Category
Tool Misuse
Content
### Connection timeout to vCenter

The `doctor` command tests connectivity with a 5-second TCP timeout. If your vCenter is on a high-latency network, the check may fail even though the connection works. Use `--skip-auth` to bypass both connectivity and auth checks, then test manually.

### `invalid peer certificate: UnknownIssuer` when starting MCP via uvx
Confidence
88% confidence
Finding
--skip-auth

Unsafe Defaults

Medium
Category
Tool Misuse
Content
### Connection timeout to vCenter

The `doctor` command tests connectivity with a 5-second TCP timeout. If your vCenter is on a high-latency network, the check may fail even though the connection works. Use `--skip-auth` to bypass both connectivity and auth checks, then test manually.

### `invalid peer certificate: UnknownIssuer` when starting MCP via uvx
Confidence
84% confidence
Finding
skip-auth

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.