vmware-storage

• Outcome: Review
• Latest audit: Sep 12, 2026 · 12:34 AM UTC
• Version: 1.9.0

Overview

The skill is coherent for VMware storage management, but its setup examples and external runtime installation create review-worthy risk for privileged infrastructure use.

Review before installing in production. Use a verified source for the vmware-storage runtime, enable TLS certificate verification, avoid copying the root/administrator examples, use least-privilege VMware service accounts, prefer a secret manager over plaintext .env passwords, and do not treat doctor --skip-auth as a successful authentication or connectivity check.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:10
• Finding: Runtime Installed from an Unreviewed External Package<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:10-12, 47-50`; `references/setup-guide.md:14-27` **Vulnerability Type**: Supply-chain exposure through an external runtime package **Risk Level**: Medium ### Vulnerable Code ```yaml installer: kind: uv package: vmware-storage ``` ```bash uv tool install vmware-storage==1.9.0 vmware-storage init vmware-storage doctor ``` ```bash # Via uv uv tool install vmware-storage==1.9.0 # Via pip pip install vmware-storage==1.9.0 # From source git clone --branch v1.9.0 https://github.com/vmware-skills/VMware-Storage.git cd VMware-Storage pip install -e . ``` ### Technical Analysis The audited project contains only Markdown documentation and evaluation data. It does not contain the runtime source implementing credential loading, vSphere authentication, password-file rewriting, policy enforcement, audit logging, or storage changes. Instead, users are instructed to retrieve and execute `vmware-storage` from an external package registry or Git repository. Pinning version `1.9.0` limits unintentional upgrades, but it does not verify package integrity, publisher identity, source-to-artifact correspondence, or registry provenance. No package hash, lockfile, signature, trusted-index restriction, or reproducible-build evidence is supplied in the artifact. Consequently, the security claims made by the Skill cannot be independently verified against the code users are instructed to execute. ### Attack Path 1. An attacker compromises the package publisher account, registry distribution path, source repository, or release process. 2. The attacker publishes or substitutes a malicious artifact under the expected package and version. 3. An operator follows the documented `uv tool install` or `pip install` command. 4. The unreviewed package executes locally during installation or invocation. 5. Because the runtime is expected to access VMware password environment variables and connect to vCenter or ESXi, a maliciou ...[truncated 814 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Include the runtime source in the reviewed artifact or provide an immutable reference to the exact audited source revision. 2. Publish cryptographic hashes for all installation artifacts and require hash verification during installation. 3. Provide signed releases and verifiable build provenance, such as Sigstore attestations or SLSA provenance. 4. Use a lockfile with hashes for transitive dependencies. 5. Configure installation commands to use an explicitly trusted package index rather than any implicitly configured index. 6. Document the publisher identity and a procedure for verifying signatures before installation. 7. Run the package under a dedicated, minimally privileged operating-system account. 8. Use VMware RBAC accounts limited to the specific read or storage-management operations required. 9. Independently review the runtime implementation of secret handling, outbound network behavior, policy enforcement, and destructive-operation confirmation before deployment. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: references/setup-guide.md:33
• Finding: TLS Certificate Verification Disabled in Primary Target Examples<![CDATA[ ## Vulnerability Details **File Location**: `references/setup-guide.md:33-49` **Vulnerability Type**: Insecure TLS configuration **Risk Level**: High ### Vulnerable Code ```yaml targets: - name: my-vcenter # Target identifier (used in CLI --target flag) host: vcenter.example.com # Hostname or IP username: [e-mail] type: vcenter # "vcenter" or "esxi" port: 443 verify_ssl: false # Set true if using valid certs environment: production # Which environment this target is — see below - name: esxi-standalone host: 10.0.0.50 username: root type: esxi port: 443 verify_ssl: false environment: lab ``` ### Technical Analysis The primary configuration example disables server-certificate verification for both vCenter and standalone ESXi targets. Although the connection still uses TLS, disabling verification prevents the client from authenticating the server and detecting an untrusted, expired, mismatched, or attacker-controlled certificate. This is particularly dangerous because the Skill authenticates with vCenter administrator or ESXi root credentials in the example and performs storage-management operations. Users frequently copy example configurations unchanged, making an insecure example function as an insecure default. ### Attack Path 1. An operator copies the documented configuration with `verify_ssl: false`. 2. The operator invokes the Skill from a network where an attacker can intercept or redirect traffic through ARP spoofing, DNS poisoning, a compromised proxy, routing manipulation, or another man-in-the-middle technique. 3. The attacker presents an arbitrary TLS certificate while impersonating the configured vCenter or ESXi endpoint. 4. The client accepts the certificate because verification is disabled. 5. Depending on the authentication and session behavior of the unreviewed runtime, the attacker may capture authentication material, proxy ...[truncated 863 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Set `verify_ssl: true` in every production and general-purpose configuration example. 2. Document installation of the organization's vCenter or ESXi CA certificate into the operating system or application trust store. 3. Support an explicit CA-bundle path and certificate or public-key pinning where private PKI is used. 4. Fail closed when certificate verification fails rather than silently downgrading verification. 5. If disabling verification is retained, place it only in a clearly labeled temporary lab example with a prominent warning that it must never be used in production. 6. Add a `doctor` check that reports disabled certificate verification as a security failure for production targets. 7. Consider refusing state-changing operations against targets with certificate verification disabled unless an explicit, separately recorded exception is approved. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: references/setup-guide.md:86
• Finding: Credential Setup Commands Can Expose or Misinterpret Passwords<![CDATA[ ## Vulnerability Details **File Location**: `references/setup-guide.md:86-92` **Vulnerability Type**: Unsafe plaintext credential entry and file creation **Risk Level**: Medium ### Vulnerable Code ```bash echo "VMWARE_MY_VCENTER_PASSWORD=your_password" > ~/.vmware-storage/.env echo "VMWARE_ESXI_STANDALONE_PASSWORD=root_password" >> ~/.vmware-storage/.env chmod 600 ~/.vmware-storage/.env ``` ### Technical Analysis Storing per-target credentials is necessary for the declared authentication functionality, and applying owner-only permissions is appropriate. However, the documented method encourages users to type real passwords directly into shell commands. This creates several risks: - The command containing the password may be retained in shell history or terminal logging. - Password characters interpreted inside double quotes, including command substitution and variable expansion syntax, can alter the stored value or cause unintended shell evaluation. - The `.env` file is created before `chmod 600` runs. Its initial permissions depend on the user's `umask`, creating a possible exposure window. - The documentation states that plaintext values may later be rewritten as `b64:<encoded>`. Base64 is obfuscation rather than encryption and provides no protection to anyone who can read the file. The secret-related path itself does not exceed the minimum privilege required by the Skill, but the documented secret-entry method is weaker than necessary. ### Attack Path 1. An operator replaces the placeholders with actual vCenter or ESXi passwords. 2. The shell records the full command in history, or a terminal/session recorder captures it. 3. Another local user, support process, backup system, or compromised program obtains access to that history or recording. 4. Alternatively, shell-sensitive content in the password is expanded or evaluated before being written. 5. The exposed or incorrectly stored credential is then used to authenticate to the associated V ...[truncated 782 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Do not instruct users to place real passwords directly in shell command lines. 2. Prefer a supported secret manager and inject each password into the process environment at startup. 3. For local setup, use a no-echo interactive prompt such as `read -r -s`, and write the value without re-evaluating it. 4. Set `umask 077` before creating the credential directory or file. 5. Create the file atomically with owner-only permissions, for example using `install -m 600 /dev/null ~/.vmware-storage/.env`, before adding credentials. 6. Ensure the writer correctly escapes dotenv syntax, newlines, quotes, dollar signs, backticks, and backslashes. 7. Avoid presenting base64 encoding as a security control; clearly retain the warning that it is not encryption. 8. Use separate, least-privileged VMware service accounts instead of vCenter administrator or ESXi root credentials. 9. Add automated checks that reject credential files owned by another user, symbolic links, non-regular files, and permissions broader than `0600`. 10. Where feasible, migrate existing plaintext `.env` credentials into an operating-system keychain or enterprise secret-management system. ]]>

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (42)

Credential Access

High

• Category: Privilege Escalation

Content

metadata: {"openclaw":{"requires":{"anyBins":["vmware-storage","uvx"]},"optional":{"env":["VMWARE_STORAGE_CONFIG","VMWARE_<TARGET>_PASSWORD","VMWARE_<TARGET>_USERNAME","VMWARE_AUDIT_APPROVED_BY"],"bins":["vmware-policy"]},"homepage":"https://github.com/vmware-skills/VMware-Storage","emoji":"🗄️","os":["macos","linux"]}}
compatibility: >
  vmware-policy auto-installed as Python dependency (provides @vmware_tool decorator and audit logging). All write operations audited to ~/.vmware/audit.db.
  Credentials: Each vCenter/ESXi target requires a per-target password env var in ~/.vmware-storage/.env following the pattern VMWARE_<TARGET_NAME_UPPER>_PASSWORD (e.g., target "my-vcenter" → VMWARE_MY_VCENTER_PASSWORD). No webhooks or outbound network calls — this skill is local-only (stdio MCP + vSphere API). Audit logs written to ~/.vmware/audit.db (SQLite WAL, local only).
---

# VMware Storage

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

metadata: {"openclaw":{"requires":{"anyBins":["vmware-storage","uvx"]},"optional":{"env":["VMWARE_STORAGE_CONFIG","VMWARE_<TARGET>_PASSWORD","VMWARE_<TARGET>_USERNAME","VMWARE_AUDIT_APPROVED_BY"],"bins":["vmware-policy"]},"homepage":"https://github.com/vmware-skills/VMware-Storage","emoji":"🗄️","os":["macos","linux"]}}
compatibility: >
  vmware-policy auto-installed as Python dependency (provides @vmware_tool decorator and audit logging). All write operations audited to ~/.vmware/audit.db.
  Credentials: Each vCenter/ESXi target requires a per-target password env var in ~/.vmware-storage/.env following the pattern VMWARE_<TARGET_NAME_UPPER>_PASSWORD (e.g., target "my-vcenter" → VMWARE_MY_VCENTER_PASSWORD). No webhooks or outbound network calls — this skill is local-only (stdio MCP + vSphere API). Audit logs written to ~/.vmware/audit.db (SQLite WAL, local only).
---

# VMware Storage

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

metadata: {"openclaw":{"requires":{"anyBins":["vmware-storage","uvx"]},"optional":{"env":["VMWARE_STORAGE_CONFIG","VMWARE_<TARGET>_PASSWORD","VMWARE_<TARGET>_USERNAME","VMWARE_AUDIT_APPROVED_BY"],"bins":["vmware-policy"]},"homepage":"https://github.com/vmware-skills/VMware-Storage","emoji":"🗄️","os":["macos","linux"]}}
compatibility: >
  vmware-policy auto-installed as Python dependency (provides @vmware_tool decorator and audit logging). All write operations audited to ~/.vmware/audit.db.
  Credentials: Each vCenter/ESXi target requires a per-target password env var in ~/.vmware-storage/.env following the pattern VMWARE_<TARGET_NAME_UPPER>_PASSWORD (e.g., target "my-vcenter" → VMWARE_MY_VCENTER_PASSWORD). No webhooks or outbound network calls — this skill is local-only (stdio MCP + vSphere API). Audit logs written to ~/.vmware/audit.db (SQLite WAL, local only).
---

# VMware Storage

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

metadata: {"openclaw":{"requires":{"anyBins":["vmware-storage","uvx"]},"optional":{"env":["VMWARE_STORAGE_CONFIG","VMWARE_<TARGET>_PASSWORD","VMWARE_<TARGET>_USERNAME","VMWARE_AUDIT_APPROVED_BY"],"bins":["vmware-policy"]},"homepage":"https://github.com/vmware-skills/VMware-Storage","emoji":"🗄️","os":["macos","linux"]}}
compatibility: >
  vmware-policy auto-installed as Python dependency (provides @vmware_tool decorator and audit logging). All write operations audited to ~/.vmware/audit.db.
  Credentials: Each vCenter/ESXi target requires a per-target password env var in ~/.vmware-storage/.env following the pattern VMWARE_<TARGET_NAME_UPPER>_PASSWORD (e.g., target "my-vcenter" → VMWARE_MY_VCENTER_PASSWORD). No webhooks or outbound network calls — this skill is local-only (stdio MCP + vSphere API). Audit logs written to ~/.vmware/audit.db (SQLite WAL, local only).
---

# VMware Storage

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

metadata: {"openclaw":{"requires":{"anyBins":["vmware-storage","uvx"]},"optional":{"env":["VMWARE_STORAGE_CONFIG","VMWARE_<TARGET>_PASSWORD","VMWARE_<TARGET>_USERNAME","VMWARE_AUDIT_APPROVED_BY"],"bins":["vmware-policy"]},"homepage":"https://github.com/vmware-skills/VMware-Storage","emoji":"🗄️","os":["macos","linux"]}}
compatibility: >
  vmware-policy auto-installed as Python dependency (provides @vmware_tool decorator and audit logging). All write operations audited to ~/.vmware/audit.db.
  Credentials: Each vCenter/ESXi target requires a per-target password env var in ~/.vmware-storage/.env following the pattern VMWARE_<TARGET_NAME_UPPER>_PASSWORD (e.g., target "my-vcenter" → VMWARE_MY_VCENTER_PASSWORD). No webhooks or outbound network calls — this skill is local-only (stdio MCP + vSphere API). Audit logs written to ~/.vmware/audit.db (SQLite WAL, local only).
---

# VMware Storage

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

metadata: {"openclaw":{"requires":{"anyBins":["vmware-storage","uvx"]},"optional":{"env":["VMWARE_STORAGE_CONFIG","VMWARE_<TARGET>_PASSWORD","VMWARE_<TARGET>_USERNAME","VMWARE_AUDIT_APPROVED_BY"],"bins":["vmware-policy"]},"homepage":"https://github.com/vmware-skills/VMware-Storage","emoji":"🗄️","os":["macos","linux"]}}
compatibility: >
  vmware-policy auto-installed as Python dependency (provides @vmware_tool decorator and audit logging). All write operations audited to ~/.vmware/audit.db.
  Credentials: Each vCenter/ESXi target requires a per-target password env var in ~/.vmware-storage/.env following the pattern VMWARE_<TARGET_NAME_UPPER>_PASSWORD (e.g., target "my-vcenter" → VMWARE_MY_VCENTER_PASSWORD). No webhooks or outbound network calls — this skill is local-only (stdio MCP + vSphere API). Audit logs written to ~/.vmware/audit.db (SQLite WAL, local only).
---

# VMware Storage

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

metadata: {"openclaw":{"requires":{"anyBins":["vmware-storage","uvx"]},"optional":{"env":["VMWARE_STORAGE_CONFIG","VMWARE_<TARGET>_PASSWORD","VMWARE_<TARGET>_USERNAME","VMWARE_AUDIT_APPROVED_BY"],"bins":["vmware-policy"]},"homepage":"https://github.com/vmware-skills/VMware-Storage","emoji":"🗄️","os":["macos","linux"]}}
compatibility: >
  vmware-policy auto-installed as Python dependency (provides @vmware_tool decorator and audit logging). All write operations audited to ~/.vmware/audit.db.
  Credentials: Each vCenter/ESXi target requires a per-target password env var in ~/.vmware-storage/.env following the pattern VMWARE_<TARGET_NAME_UPPER>_PASSWORD (e.g., target "my-vcenter" → VMWARE_MY_VCENTER_PASSWORD). No webhooks or outbound network calls — this skill is local-only (stdio MCP + vSphere API). Audit logs written to ~/.vmware/audit.db (SQLite WAL, local only).
---

# VMware Storage

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

metadata: {"openclaw":{"requires":{"anyBins":["vmware-storage","uvx"]},"optional":{"env":["VMWARE_STORAGE_CONFIG","VMWARE_<TARGET>_PASSWORD","VMWARE_<TARGET>_USERNAME","VMWARE_AUDIT_APPROVED_BY"],"bins":["vmware-policy"]},"homepage":"https://github.com/vmware-skills/VMware-Storage","emoji":"🗄️","os":["macos","linux"]}}
compatibility: >
  vmware-policy auto-installed as Python dependency (provides @vmware_tool decorator and audit logging). All write operations audited to ~/.vmware/audit.db.
  Credentials: Each vCenter/ESXi target requires a per-target password env var in ~/.vmware-storage/.env following the pattern VMWARE_<TARGET_NAME_UPPER>_PASSWORD (e.g., target "my-vcenter" → VMWARE_MY_VCENTER_PASSWORD). No webhooks or outbound network calls — this skill is local-only (stdio MCP + vSphere API). Audit logs written to ~/.vmware/audit.db (SQLite WAL, local only).
---

# VMware Storage

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

metadata: {"openclaw":{"requires":{"anyBins":["vmware-storage","uvx"]},"optional":{"env":["VMWARE_STORAGE_CONFIG","VMWARE_<TARGET>_PASSWORD","VMWARE_<TARGET>_USERNAME","VMWARE_AUDIT_APPROVED_BY"],"bins":["vmware-policy"]},"homepage":"https://github.com/vmware-skills/VMware-Storage","emoji":"🗄️","os":["macos","linux"]}}
compatibility: >
  vmware-policy auto-installed as Python dependency (provides @vmware_tool decorator and audit logging). All write operations audited to ~/.vmware/audit.db.
  Credentials: Each vCenter/ESXi target requires a per-target password env var in ~/.vmware-storage/.env following the pattern VMWARE_<TARGET_NAME_UPPER>_PASSWORD (e.g., target "my-vcenter" → VMWARE_MY_VCENTER_PASSWORD). No webhooks or outbound network calls — this skill is local-only (stdio MCP + vSphere API). Audit logs written to ~/.vmware/audit.db (SQLite WAL, local only).
---

# VMware Storage

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

vmware-storage vsan capacity <cluster> [--target <name>]

# Diagnostics
vmware-storage doctor [--skip-auth]
```

> Full CLI reference with all options and output formats: see `references/cli-reference.md`

• Confidence: 95% confidence
• Finding: Documenting `doctor [--skip-auth]` exposes a diagnostic mode that bypasses both connectivity and authentication checks. In an agent-driven environment, a model may select this option to suppress failures and falsely treat a target as healthy or ready, weakening assurance around credential and connection validation.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

### Connection timeout to vCenter

The `doctor` command tests connectivity with a 5-second TCP timeout. If your vCenter is on a high-latency network, the check may fail even though the connection works. Use `--skip-auth` to bypass both connectivity and auth checks, then test manually.

### `invalid peer certificate: UnknownIssuer` when starting MCP via uvx

• Confidence: 98% confidence
• Finding: The troubleshooting guidance explicitly recommends using `--skip-auth` to bypass both connectivity and auth checks. That creates a realistic misuse path where an agent under error pressure suppresses security-relevant failures, leading to incorrect trust decisions and potentially unsafe follow-on operations against misconfigured or impersonated infrastructure.

Credential Access

High

• Category: Privilege Escalation

Content

Passwords are **never stored in config.yaml**. They must be set as environment variables via the `.env` file.

```bash
echo "VMWARE_MY_VCENTER_PASSWORD=your_password" > ~/.vmware-storage/.env
echo "VMWARE_ESXI_STANDALONE_PASSWORD=root_password" >> ~/.vmware-storage/.env
chmod 600 ~/.vmware-storage/.env
```

• Confidence: 84% confidence
• Finding: The setup guide instructs users to place vCenter and ESXi passwords into a local `.env` file using shell `echo` commands, which encourages plaintext credential storage on disk. Although permissions are restricted and the document notes this later, the pattern still increases exposure from local compromise, backups, shell history mishandling, or accidental file disclosure.

Credential Access

High

• Category: Privilege Escalation

Content

```bash
echo "VMWARE_MY_VCENTER_PASSWORD=your_password" > ~/.vmware-storage/.env
echo "VMWARE_ESXI_STANDALONE_PASSWORD=root_password" >> ~/.vmware-storage/.env
chmod 600 ~/.vmware-storage/.env
```

• Confidence: 84% confidence
• Finding: This line continues the same plaintext `.env` credential storage pattern for a root password, which is especially sensitive in an infrastructure-management context. A compromise of this file could provide direct privileged access to standalone ESXi hosts.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

This runs six checks: config file, .env file, targets, network connectivity, authentication, and MCP server module.

Use `--skip-auth` if vCenter is temporarily unreachable:

```bash
vmware-storage doctor --skip-auth

• Confidence: 70% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

This runs six checks: config file, .env file, targets, network connectivity, authentication, and MCP server module.

Use `--skip-auth` if vCenter is temporarily unreachable:

```bash
vmware-storage doctor --skip-auth

• Confidence: 70% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

This runs six checks: config file, .env file, targets, network connectivity, authentication, and MCP server module.

Use `--skip-auth` if vCenter is temporarily unreachable:

```bash
vmware-storage doctor --skip-auth

• Confidence: 70% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

This runs six checks: config file, .env file, targets, network connectivity, authentication, and MCP server module.

Use `--skip-auth` if vCenter is temporarily unreachable:

```bash
vmware-storage doctor --skip-auth

• Confidence: 70% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Session Persistence

Medium

• Category: Rogue Agent

Content

- Bash
metadata: {"openclaw":{"requires":{"anyBins":["vmware-storage","uvx"]},"optional":{"env":["VMWARE_STORAGE_CONFIG","VMWARE_<TARGET>_PASSWORD","VMWARE_<TARGET>_USERNAME","VMWARE_AUDIT_APPROVED_BY"],"bins":["vmware-policy"]},"homepage":"https://github.com/vmware-skills/VMware-Storage","emoji":"🗄️","os":["macos","linux"]}}
compatibility: >
  vmware-policy auto-installed as Python dependency (provides @vmware_tool decorator and audit logging). All write operations audited to ~/.vmware/audit.db.
  Credentials: Each vCenter/ESXi target requires a per-target password env var in ~/.vmware-storage/.env following the pattern VMWARE_<TARGET_NAME_UPPER>_PASSWORD (e.g., target "my-vcenter" → VMWARE_MY_VCENTER_PASSWORD). No webhooks or outbound network calls — this skill is local-only (stdio MCP + vSphere API). Audit logs written to ~/.vmware/audit.db (SQLite WAL, local only).
---

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

```bash
uv tool install vmware-storage==1.9.0
vmware-storage init      # guided setup: writes config + .env (chmod 600, password grep-safe), then verifies
vmware-storage doctor
```

• Confidence: 80% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

```bash
uv tool install vmware-storage==1.9.0
vmware-storage init      # guided setup: writes config + .env (chmod 600, password grep-safe), then verifies
vmware-storage doctor
```

• Confidence: 80% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

```bash
uv tool install vmware-storage==1.9.0
vmware-storage init      # guided setup: writes config + .env (chmod 600, password grep-safe), then verifies
vmware-storage doctor
```

• Confidence: 80% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

```bash
uv tool install vmware-storage==1.9.0
vmware-storage init      # guided setup: writes config + .env (chmod 600, password grep-safe), then verifies
vmware-storage doctor
```

• Confidence: 80% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The activation guidance includes the catch-all phrase "Any storage-focused VMware operation," which is broader than the otherwise specific examples around it. Because it lacks scope boundaries or negative examples for edge cases, an agent may invoke this skill for loosely related storage discussions rather than only the intended tasks.

Session Persistence

Medium

• Category: Rogue Agent

Content

| | `vsan_capacity` | Read | Total/used/free capacity in GB and usage % |
| | `vsan_efficiency` | Read | Dedup + compression status (vSAN Management SDK) |

**Read/write split**: 8 tools are read-only, 4 modify state. Write tools require explicit parameters (host name, IP address), support `dry_run`, and are audit-logged. `storage_iscsi_remove_target` is classified `risk:high` (destructive — LUNs can become inaccessible) and goes through the policy confirmation gate.

Running with local or small models? See [`references/agent-guardrails.md`](references/agent-guardrails.md).

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Unsafe Defaults

Medium

• Category: Tool Misuse

Content

vmware-storage vsan capacity <cluster> [--target <name>]

# Diagnostics
vmware-storage doctor [--skip-auth]
```

> Full CLI reference with all options and output formats: see `references/cli-reference.md`

• Confidence: 92% confidence
• Finding: Even though `--skip-auth` is optional, advertising it in the primary CLI reference normalizes an unsafe validation bypass. In a tool used by autonomous agents, making bypass flags easy to discover increases the chance they become de facto defaults during failure handling.

Static analysis

No suspicious patterns detected.