Vmware Vks

• Outcome: Review
• Latest audit: Jul 21, 2026 · 12:45 PM UTC
• Version: 1.8.7

Overview

This VMware VKS skill is purpose-aligned, but it gives agents sensitive Kubernetes access-token retrieval and infrastructure mutation capability that users should review before installing.

Install only if you intend an agent to help administer vSphere Kubernetes Service. Use a least-privilege vCenter/Supervisor account, prefer read-only credentials unless writes are required, require explicit user approval before any kubeconfig retrieval, avoid printing kubeconfigs or tokens into chat, store exported kubeconfigs only in restricted paths, and use a secret manager rather than a persistent .env password when possible.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (10)

Credential Access

High

• Category: Privilege Escalation

Content

| Level | Meaning | Agent autonomy | Examples in this skill |
|:-:|---|---|---|
| **L1** | Read-only, raw data | Always auto-run | `check_vks_compatibility`, `get_supervisor_status`, `list_supervisor_storage_policies`, `list_namespaces`, `get_namespace`, TKC list/get, kubeconfig fetch |
| **L2** | Read + analysis / recommendation | Always auto-run | namespace quota analysis, TKC health correlation, storage policy compatibility checks |
| **L3** | Single write — user must approve | Only after explicit confirmation; destructive ops require double-confirm + `--dry-run` | `create_namespace`, `update_namespace`, `delete_namespace`, `create_tkc_cluster`, `upgrade_tkc_cluster`, `scale_tkc_cluster`, `delete_tkc_cluster` |
| **L4** | Multi-step plan / apply workflow | Plan generation auto; apply gated by user approval | *(roadmap — TKC fleet upgrades, multi-namespace bootstrapping plans)* |

• Confidence: 94% confidence
• Finding: kubeconfig

Credential Access

High

• Category: Privilege Escalation

Content

**Notes**:
- L1/L2 tools are always safe for agents to call without confirmation.
- L3 tools always pass through the `@vmware_tool` decorator: connection check → policy check → audit log → double-confirm.
- Kubeconfig retrieval (L1) returns short-lived session tokens; agents should write to file (`-o <path>`) rather than displaying tokens in conversation context.

## 1. Supervisor Layer (Read-Only)

• Confidence: 96% confidence
• Finding: Kubeconfig

Credential Access

High

• Category: Privilege Escalation

Content

| Tool | What it returns |
|------|----------------|
| `get_supervisor_kubeconfig` | Kubeconfig for Supervisor-level K8s API |
| `get_tkc_kubeconfig` | Kubeconfig for a specific TKC cluster (stdout or write to file) |
| `get_harbor_info` | Per registry: `id`, `cluster`, `version`, `url`, `status` (health), `storage_used_mb` — status/storage come from a per-registry detail call and are null if it fails. Never returns credentials |
| `list_namespace_storage_usage` | PVC list and usage stats per Namespace |

• Confidence: 95% confidence
• Finding: kubeconfig

Credential Access

High

• Category: Privilege Escalation

Content

| Tool | What it returns |
|------|----------------|
| `get_supervisor_kubeconfig` | Kubeconfig for Supervisor-level K8s API |
| `get_tkc_kubeconfig` | Kubeconfig for a specific TKC cluster (stdout or write to file) |
| `get_harbor_info` | Per registry: `id`, `cluster`, `version`, `url`, `status` (health), `storage_used_mb` — status/storage come from a per-registry detail call and are null if it fails. Never returns credentials |
| `list_namespace_storage_usage` | PVC list and usage stats per Namespace |

• Confidence: 95% confidence
• Finding: Kubeconfig

Credential Access

High

• Category: Privilege Escalation

Content

| Audit Trail | All write operations logged to `~/.vmware/audit.db` (SQLite WAL, via vmware-policy) plus a local JSON-Lines mirror at `~/.vmware-vks/audit.log`, with timestamp, target, operation, parameters, result, user |
| Read-Only Majority | 13/20 tools are read-only |
| SSL Support | `verify_ssl: false` supported for self-signed vCenter certs (enterprise standard) |
| In-Memory Kubeconfig | Supervisor/TKC kubeconfig is constructed as a Python dict and loaded into the kubernetes client via `load_kube_config_from_dict()`. The vCenter session bearer token never persists to disk during MCP/CLI calls — eliminates the temp-file TOCTOU window present pre-v1.5.18. Explicit `kubeconfig get -o <path>` export still writes to the user-chosen file for downstream `kubectl` use. |

## Version Compatibility

• Confidence: 90% confidence
• Finding: Kubeconfig

Credential Access

High

• Category: Privilege Escalation

Content

| Audit Trail | All write operations logged to `~/.vmware/audit.db` (SQLite WAL, via vmware-policy) plus a local JSON-Lines mirror at `~/.vmware-vks/audit.log`, with timestamp, target, operation, parameters, result, user |
| Read-Only Majority | 13/20 tools are read-only |
| SSL Support | `verify_ssl: false` supported for self-signed vCenter certs (enterprise standard) |
| In-Memory Kubeconfig | Supervisor/TKC kubeconfig is constructed as a Python dict and loaded into the kubernetes client via `load_kube_config_from_dict()`. The vCenter session bearer token never persists to disk during MCP/CLI calls — eliminates the temp-file TOCTOU window present pre-v1.5.18. Explicit `kubeconfig get -o <path>` export still writes to the user-chosen file for downstream `kubectl` use. |

## Version Compatibility

• Confidence: 90% confidence
• Finding: kubeconfig

Credential Access

High

• Category: Privilege Escalation

Content

| Audit Trail | All write operations logged to `~/.vmware/audit.db` (SQLite WAL, via vmware-policy) plus a local JSON-Lines mirror at `~/.vmware-vks/audit.log`, with timestamp, target, operation, parameters, result, user |
| Read-Only Majority | 13/20 tools are read-only |
| SSL Support | `verify_ssl: false` supported for self-signed vCenter certs (enterprise standard) |
| In-Memory Kubeconfig | Supervisor/TKC kubeconfig is constructed as a Python dict and loaded into the kubernetes client via `load_kube_config_from_dict()`. The vCenter session bearer token never persists to disk during MCP/CLI calls — eliminates the temp-file TOCTOU window present pre-v1.5.18. Explicit `kubeconfig get -o <path>` export still writes to the user-chosen file for downstream `kubectl` use. |

## Version Compatibility

• Confidence: 90% confidence
• Finding: kubeconfig

Credential Access

High

• Category: Privilege Escalation

Content

environment: production
EOF

echo "VMWARE_VKS_VCENTER01_PASSWORD=your_password" > ~/.vmware-vks/.env
chmod 600 ~/.vmware-vks/.env

# 3. Verify

• Confidence: 87% confidence
• Finding: .env

Session Persistence

Medium

• Category: Rogue Agent

Content

`delete_tkc_cluster` — requires `confirmed=True` and checks for running workloads. Rejects if found unless `force=True`.

**Credential handling**: `get_supervisor_kubeconfig` and `get_tkc_kubeconfig` return short-lived session tokens (not long-lived credentials). Tokens are derived from the authenticated vCenter session and expire when the session ends. Kubeconfig output is intended for local `kubectl` use — agents should write it to a file (`-o <path>`) rather than displaying tokens in conversation context.

> Full capability details and safety features: see `references/capabilities.md`

• Confidence: 74% confidence
• Finding: write it to a file (`-o <path>`) rather than displaying tokens in conversation context. > Full capability details and safety features: see `references/capabilities.md` ## CLI Quick Reference ```bas

Session Persistence

Medium

• Category: Rogue Agent

Content

| "Confirm before deleting anything" | **`confirmed=True` is required.** `delete_namespace` additionally refuses while TKC clusters still exist inside it, and `delete_tkc_cluster` refuses while workloads are running unless `force=True`. |
| "Use explicit limits for queries that may return large amounts of data" | **The list envelope.** `list_namespaces`, `list_supervisor_storage_policies` and `list_vm_classes` return `{items, returned, limit, total, truncated, hint}`, so the model reads truncation instead of guessing at it. These three read their collection in one un-paged call, so `total` is the real count and `truncated` is always `false`. |
| "If a listing came back empty, say so rather than claiming the call failed" | Same envelope. Empty `items` with `truncated: false` means checked-and-none — a stated result, not a silence the model has to interpret. |
| "Log every state change you make" | **The `@vmware_tool` decorator.** Every write is recorded to `~/.vmware/audit.db` before the model sees the result, and policy rules are evaluated ahead of execution. |

---

• Confidence: 80% confidence
• Finding: write is recorded to `~/.vmware

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.