vmware-storage

• Outcome: Pass
• Latest audit: Oct 19, 2026 · 12:39 AM UTC
• Version: 2.4.2

Overview

This is a VMware storage administration skill with clearly disclosed credentials, audit logging, and gated write operations, but it should be installed only by users who are comfortable granting it vCenter/ESXi storage access.

Install this only for operators who should administer VMware storage. Use a least-privilege vSphere service account, prefer read-only MCP exposure unless writes are needed, keep ~/.vmware-storage/.env out of backups and repositories, consider injecting passwords from a secret manager instead of storing them, and do not expose the optional HTTPS MCP mode without tokens, TLS, and network controls.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (38)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

The skill requires long-lived vCenter/ESXi passwords to be stored in a local .env file, which creates a credential-at-rest exposure if the workstation is compromised, backups are leaked, or the file is accidentally included in logs or tooling. Although the document recommends restrictive permissions, plaintext environment-file storage remains a weaker secret-management model for infrastructure credentials.

Content

Scanner excerpt · SKILL.md (reported line 17)May include surrounding context.

md

metadata: {"openclaw":{"requires":{"anyBins":["vmware-storage","uvx"]},"optional":{"env":["VMWARE_STORAGE_CONFIG","VMWARE_<TARGET>_PASSWORD","VMWARE_<TARGET>_USERNAME","VMWARE_AUDIT_APPROVED_BY"],"bins":["vmware-policy"]},"homepage":"https://github.com/vmware-skills/VMware-Storage","emoji":"🗄️","os":["macos","linux"]}}
compatibility: >
  vmware-policy auto-installed as Python dependency (provides @vmware_tool decorator and audit logging). All write operations audited to ~/.vmware/audit.db.
  Credentials: Each vCenter/ESXi target requires a per-target password env var in ~/.vmware-storage/.env following the pattern VMWARE_<TARGET_NAME_UPPER>_PASSWORD (e.g., target "my-vcenter" → VMWARE_MY_VCENTER_PASSWORD). No webhooks or outbound network calls — this skill is local-only (stdio MCP + vSphere API). Audit logs written to ~/.vmware/audit.db (SQLite WAL, local only).
---

# VMware Storage

Credential Access

High

• Category: Privilege Escalation
• Confidence: 68% confidence

Finding

The setup flow explicitly writes configuration plus a .env containing passwords, reinforcing the use of local plaintext credential storage. In a skill that administers VMware storage, compromise of those credentials could enable broad read access and potentially destructive storage actions depending on assigned privileges.

Content

Scanner excerpt · SKILL.md (reported line 44)May include surrounding context.

bash

uv tool install vmware-storage==2.4.2
vmware-storage init      # guided setup: writes config + .env (chmod 600, password grep-safe), then verifies
vmware-storage doctor

Credential Access

High

• Category: Privilege Escalation
• Confidence: 72% confidence

Finding

The document confirms that .env contains passwords, meaning the skill's normal operation depends on locally persisted secrets. Given this skill can modify iSCSI configuration and rescan storage, theft of those credentials could materially affect storage availability or expose infrastructure metadata.

Content

Scanner excerpt · SKILL.md (reported line 241)May include surrounding context.

md

The password is right; the account has no vSphere role, so vCenter shows no session for it and every call fails. `doctor` now reports this on the auth row. Assign the account a role (Read-Only or higher) on the vCenter root folder under Administration > Access Control > Global Permissions. Seen mid-run, the same fault can also be an expired session: run the command again.

### Doctor reports ".env permissions too open"

The `.env` file contains passwords and must have owner-only permissions:

Credential Access

High

• Category: Privilege Escalation
• Confidence: 72% confidence

Finding

Even though the guidance is about securing the .env file, it also confirms sensitive passwords are stored there. Plaintext credential files are a real security concern in administrative tooling because local compromise, sync/backup leakage, or accidental disclosure can expose powerful infrastructure credentials.

Content

Scanner excerpt · SKILL.md (reported line 246)May include surrounding context.

The .env file contains passwords and must have owner-only permissions:

bash

chmod 600 ~/.vmware-storage/.env

Connection timeout to vCenter

Credential Access

High

• Category: Privilege Escalation
• Confidence: 75% confidence

Finding

This setup section explicitly instructs users to place a VMware password into ~/.vmware-storage/.env. Because the skill manages storage operations against vCenter/ESXi, exposure of this file can lead to unauthorized access to sensitive inventory and potentially disruptive storage changes.

Content

Scanner excerpt · SKILL.md (reported line 279)May include surrounding context.

md

cp config.example.yaml ~/.vmware-storage/config.yaml
# Edit config.yaml with your vCenter/ESXi targets

# Add to ~/.vmware-storage/.env (create if missing, chmod 600):
# VMWARE_MY_VCENTER_PASSWORD=<your-password>
chmod 600 ~/.vmware-storage/.env

Credential Access

High

• Category: Privilege Escalation
• Confidence: 75% confidence

Finding

This is a duplicate occurrence of the same credential-storage issue: a local file is used to persist VMware passwords. In context, these are operational credentials for storage infrastructure, so compromise could have meaningful availability and confidentiality consequences.

Content

Scanner excerpt · SKILL.md (reported line 281)May include surrounding context.

Add to ~/.vmware-storage/.env (create if missing, chmod 600):

VMWARE_MY_VCENTER_PASSWORD=

chmod 600 ~/.vmware-storage/.env

vmware-storage doctor

text

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/setup-guide.md (reported line 90)May include surrounding context.

md

*name* is not used for scoping. Read-only operations are never affected. Run
`vmware-audit policy` to see the rules actually in force.

### 3. Create .env for credentials

Passwords are **never stored in config.yaml**. They must be set as environment variables via the `.env` file.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/setup-guide.md (reported line 97)May include surrounding context.

md

*name* is not used for scoping. Read-only operations are never affected. Run
`vmware-audit policy` to see the rules actually in force.

### 3. Create .env for credentials

Passwords are **never stored in config.yaml**. They must be set as environment variables via the `.env` file.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/setup-guide.md (reported line 115)May include surrounding context.

md

*name* is not used for scoping. Read-only operations are never affected. Run
`vmware-audit policy` to see the rules actually in force.

### 3. Create .env for credentials

Passwords are **never stored in config.yaml**. They must be set as environment variables via the `.env` file.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 82% confidence

Finding

The example instructs users to place privileged vCenter/ESXi passwords into a persistent plaintext .env file using shell echo. Even with restrictive file permissions and optional base64 obfuscation, this leaves long-lived credentials at rest on disk for a highly privileged management tool.

Content

Scanner excerpt · references/setup-guide.md (reported line 95)May include surrounding context.

Passwords are never stored in config.yaml. They must be set as environment variables via the .env file.

bash

echo "VMWARE_MY_VCENTER_PASSWORD=your_password" > ~/.vmware-storage/.env
echo "VMWARE_ESXI_STANDALONE_PASSWORD=root_password" >> ~/.vmware-storage/.env
chmod 600 ~/.vmware-storage/.env

Credential Access

High

• Category: Privilege Escalation
• Confidence: 82% confidence

Finding

This line continues the plaintext credential storage pattern for a root ESXi password, increasing risk because standalone ESXi root credentials are especially sensitive. On a workstation or shared admin host, compromise of the .env file could enable full storage and host management access.

Content

Scanner excerpt · references/setup-guide.md (reported line 96)May include surrounding context.

bash

echo "VMWARE_MY_VCENTER_PASSWORD=your_password" > ~/.vmware-storage/.env
echo "VMWARE_ESXI_STANDALONE_PASSWORD=root_password" >> ~/.vmware-storage/.env
chmod 600 ~/.vmware-storage/.env

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 70% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 202)May include surrounding context.

This runs six checks: config file, .env file, targets, network connectivity, authentication, and MCP server module.

Use --skip-auth if vCenter is temporarily unreachable:

bash

vmware-storage doctor --skip-auth

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 70% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 251)May include surrounding context.

This runs six checks: config file, .env file, targets, network connectivity, authentication, and MCP server module.

Use --skip-auth if vCenter is temporarily unreachable:

bash

vmware-storage doctor --skip-auth

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 70% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/cli-reference.md (reported line 234)May include surrounding context.

This runs six checks: config file, .env file, targets, network connectivity, authentication, and MCP server module.

Use --skip-auth if vCenter is temporarily unreachable:

bash

vmware-storage doctor --skip-auth

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 70% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/cli-reference.md (reported line 239)May include surrounding context.

This runs six checks: config file, .env file, targets, network connectivity, authentication, and MCP server module.

Use --skip-auth if vCenter is temporarily unreachable:

bash

vmware-storage doctor --skip-auth

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 70% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/setup-guide.md (reported line 117)May include surrounding context.

This runs six checks: config file, .env file, targets, network connectivity, authentication, and MCP server module.

Use --skip-auth if vCenter is temporarily unreachable:

bash

vmware-storage doctor --skip-auth

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 70% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/setup-guide.md (reported line 120)May include surrounding context.

This runs six checks: config file, .env file, targets, network connectivity, authentication, and MCP server module.

Use --skip-auth if vCenter is temporarily unreachable:

bash

vmware-storage doctor --skip-auth

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 16)May include surrounding context.

md

- Bash
metadata: {"openclaw":{"requires":{"anyBins":["vmware-storage","uvx"]},"optional":{"env":["VMWARE_STORAGE_CONFIG","VMWARE_<TARGET>_PASSWORD","VMWARE_<TARGET>_USERNAME","VMWARE_AUDIT_APPROVED_BY"],"bins":["vmware-policy"]},"homepage":"https://github.com/vmware-skills/VMware-Storage","emoji":"🗄️","os":["macos","linux"]}}
compatibility: >
  vmware-policy auto-installed as Python dependency (provides @vmware_tool decorator and audit logging). All write operations audited to ~/.vmware/audit.db.
  Credentials: Each vCenter/ESXi target requires a per-target password env var in ~/.vmware-storage/.env following the pattern VMWARE_<TARGET_NAME_UPPER>_PASSWORD (e.g., target "my-vcenter" → VMWARE_MY_VCENTER_PASSWORD). No webhooks or outbound network calls — this skill is local-only (stdio MCP + vSphere API). Audit logs written to ~/.vmware/audit.db (SQLite WAL, local only).
---

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 44)May include surrounding context.

bash

uv tool install vmware-storage==2.4.2
vmware-storage init      # guided setup: writes config + .env (chmod 600, password grep-safe), then verifies
vmware-storage doctor

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 246)May include surrounding context.

bash

uv tool install vmware-storage==2.4.2
vmware-storage init      # guided setup: writes config + .env (chmod 600, password grep-safe), then verifies
vmware-storage doctor

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 281)May include surrounding context.

bash

uv tool install vmware-storage==2.4.2
vmware-storage init      # guided setup: writes config + .env (chmod 600, password grep-safe), then verifies
vmware-storage doctor

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/setup-guide.md (reported line 97)May include surrounding context.

bash

uv tool install vmware-storage==2.4.2
vmware-storage init      # guided setup: writes config + .env (chmod 600, password grep-safe), then verifies
vmware-storage doctor

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 65% confidence

Finding

uvx/uv tool run commands without ==version create a rug-pull risk.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 262)May include surrounding context.

md

- **No VM operations**: This skill cannot power on/off, create, delete, or modify VMs — that scope belongs to `vmware-aiops`
- **Read-heavy**: 11 of 15 tools are read-only (list, browse, scan, cached images, status, health, capacity, efficiency, FC adapters, device paths, access info)
- **Audit logging**: All operations (including reads) are logged to `~/.vmware/audit.db` (SQLite WAL, via vmware-policy) with timestamp, user, target, operation, parameters, and result
- **Double confirmation**: CLI write commands (iSCSI enable, add/remove target) require two separate "Are you sure?" prompts before executing
- **Dry-run mode**: All write commands support `--dry-run` to preview API calls without executing
- **Input validation**: IP addresses validated via `ipaddress.ip_address()`, ports checked for 1-65535 range, host/cluster/datastore names looked up before operations
- **Prompt injection defense**: Datastore file names and paths from vSphere are sanitized via `_sanitize()` — strips control characters (C0/C1), truncates to 500 chars — preventing malicious file names from injecting instructions into downstream LLM agents

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 279)May include surrounding context.

md

cp config.example.yaml ~/.vmware-storage/config.yaml
# Edit config.yaml with your vCenter/ESXi targets

# Add to ~/.vmware-storage/.env (create if missing, chmod 600):
# VMWARE_MY_VCENTER_PASSWORD=<your-password>
chmod 600 ~/.vmware-storage/.env

Static analysis

No suspicious patterns detected.