Xcpng Aiops

• Outcome: Review
• Latest audit: Jul 19, 2026 · 5:54 PM UTC
• Version: 0.2.1

Overview

This skill is a disclosed XCP-ng/Xen Orchestra operations tool with powerful but purpose-aligned VM, snapshot, storage, audit, and credential-management behavior.

Install only for an XCP-ng fleet you are authorized to manage through Xen Orchestra. Use a least-privilege dedicated XO token, start with XCPNG_READ_ONLY=1 for triage, keep dry-run enabled before writes, protect any MCP client configuration containing XCPNG_AIOPS_MASTER_PASSWORD, and review rules.yaml before allowing high-risk snapshot delete or revert actions.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The manifest description scopes the skill to XCP-ng/Xen Orchestra fleet overview, listed read operations, four RCAs, governed writes, and governance-harness behavior. However, the CLI reference documents additional capabilities such as `host missing-patches`, `secret set/list/rm/migrate/rotate-password`, `init`, `doctor`, and `mcp`, which materially expand the skill into credential management, environment setup, and service startup not described in the manifest's operational scope.

Intent-Code Divergence

Low

• Confidence: 91% confidence
• Finding: The documentation explicitly says "MCP Tools (29 — 19 read, 8 write, 2 undo)" and earlier says "29 MCP tools". But the same file also documents `host missing-patches`, multiple `secret` subcommands, `init`, `doctor`, and `mcp`, creating an active contradiction between the stated bounded tool surface and the broader documented command surface.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: This markdown file includes a concrete example placing `XCPNG_AIOPS_MASTER_PASSWORD` directly in an MCP client `env` block, which can expose sensitive credentials in client config files or local settings. Although the guide notes that MCP clients require the value in `env`, it does not warn users that this stores the master password in plaintext or advise them to protect that configuration accordingly.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

## Audit & Safety

All operations are automatically audited via the bundled `@governed_tool` decorator (`xcpng_aiops.governance`):
- XO token stored **encrypted** in `~/.xcpng-aiops/secrets.enc` (Fernet/AES-128 + scrypt key derivation; chmod 600) — never plaintext on disk; the master password is never stored, only a per-store salt + ciphertext
- Every tool call logged to `~/.xcpng-aiops/audit.db` (local SQLite audit DB; relocate with `XCPNG_AIOPS_HOME`)
- Policy rules enforced via `~/.xcpng-aiops/rules.yaml` (deny rules, maintenance windows, risk tiers)
- **Secure by default**: with no `~/.xcpng-aiops/rules.yaml`, high-risk operations are denied unless `XCPNG_AUDIT_APPROVED_BY` names an approver (set `XCPNG_AUDIT_RATIONALE` too). `xcpng-aiops init` seeds a starter rules.yaml; an operator-authored rules file is honoured as-is.

• Confidence: 80% confidence
• Finding: chmod 600

Session Persistence

Medium

• Category: Rogue Agent

Content

metadata: {"openclaw":{"requires":{"env":["XCPNG_AIOPS_CONFIG"],"bins":["xcpng-aiops"],"config":["~/.xcpng-aiops/config.yaml","~/.xcpng-aiops/secrets.enc"]},"optional":{"env":["XCPNG_AIOPS_MASTER_PASSWORD"]},"primaryEnv":"XCPNG_AIOPS_CONFIG","homepage":"https://github.com/AIops-tools/XCPng-AIops","emoji":"🖥️","os":["macos","linux"]}}
compatibility: >
  Standalone, self-governed XCP-ng operations via Xen Orchestra's REST API /rest/v0. REQUIRES a Xen Orchestra instance (XO from sources or the Xen Orchestra Appliance, 5.x) — XO is the management plane; direct per-host XAPI access is out of scope for v0.1. The governance harness (audit, policy, token/runaway budget, undo, risk-tiers) is bundled in the package — no external skill-family dependency.
  All write operations are audited to a local SQLite DB under ~/.xcpng-aiops/ (relocatable via XCPNG_AIOPS_HOME).
  Credentials: Each XO target's personal authentication token is stored ENCRYPTED in ~/.xcpng-aiops/secrets.enc (Fernet/AES-128 + scrypt-derived key) — never plaintext on disk. Run 'xcpng-aiops init' to onboard, or 'xcpng-aiops secret set <target>' to add one (create the token in the XO UI: user menu → Personal tokens, or `xo-cli --createToken`). The store is unlocked by a master password from XCPNG_AIOPS_MASTER_PASSWORD (non-interactive/MCP/CI) or an interactive prompt (CLI on a TTY). A legacy plaintext env var XCPNG_<TARGET_NAME_UPPER>_TOKEN is still honoured as a fallback with a deprecation warning (migrate with 'xcpng-aiops secret migrate'). The token is sent in headers (Authorization: Bearer + authenticationToken cookie) at request time and held only in memory; tokens are never logged or echoed.
  Destructive operations (snapshot delete/revert, vm stop/reboot/migrate) require double confirmation at the CLI layer and support --dry-run; every write MCP tool takes a dry_run preview (no API call, no undo recorded). All write tools pass through the @governed_tool decorator (pre-check + budget guard + audit + risk-
...[truncated 25 chars]

• Confidence: 60% confidence
• Finding: write operations are audited to a local SQLite DB under ~/.xcpng-aiops/ (relocatable via XCPNG_AIOPS_HOME). Credentials: Each XO target's personal authentication token is stored ENCRYPTED in ~/.xcpn

Session Persistence

Medium

• Category: Rogue Agent

Content

| Tasks | `task_list` | Read |
| Undo | `undo_list`, `undo_apply` | Read + replay |

**Harness features that light up**: `vm_start`↔`vm_stop` record each other as inverses (with `_undo_id`); `vm_migrate` captures the REAL source host BEFORE moving and records "migrate back"; `snapshot_create` captures the REAL snapshot id from the XO response and records "delete THAT snapshot". `snapshot_delete` and `snapshot_revert` are `risk_level=high`, capture BEFORE state, and declare no undo (irreversible). Every write takes `dry_run=True` (no API call, no undo). All 29 tools are audit-logged under `~/.xcpng-aiops/` and pass through the policy pre-check + budget/runaway guard + graduated risk-tier gate. Start any triage with `overview`.

## CLI Quick Reference

• Confidence: 60% confidence
• Finding: write takes `dry_run=True` (no API call, no undo). All 29 tools are audit-logged under `~/.xcpng-aiops/` and pass through the policy pre-check + budget/runaway guard + graduated risk-tier gate. Start

Session Persistence

Medium

• Category: Rogue Agent

Content

|------|------|-------------|
| `task_list(status?, limit?)` | low | XO tasks (pending / success / failure). |

## Write semantics

- `dry_run=true` → preview dict (`{"dryRun": true, "would...": {...}}`), **no API call, no undo recorded**.
- Successful reversible writes return `_undo_id` referencing the recorded inverse descriptor in `~/.xcpng-aiops/undo.db`. Undo execution is an external orchestrator's job — recording only.

• Confidence: 18% confidence
• Finding: Write semantics - `dry_run=true` → preview dict (`{"dryRun": true, "would...": {...}}`), **no API call, no undo recorded**. - Successful reversible writes return `_undo_id` referencing the recorded i

Session Persistence

Medium

• Category: Rogue Agent

Content

(XO UI → Settings → Servers). **Per-host XAPI access is out of scope.**
- Python ≥ 3.11 (`uv tool install xcpng-aiops` handles the rest).

## 1. Create an XO authentication token

In the XO UI: user menu (top-right) → **Personal tokens** → create. Or from a
shell: `xo-cli --createToken`. Use a dedicated XO user with the least

• Confidence: 18% confidence
• Finding: Create an XO authentication token In the XO UI: user menu (top-right) → **Personal tokens** → create. Or from a shell: `xo-cli --createToken`. Use a dedicated XO user with the least privilege you can

VirusTotal

63/63 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.prompt_injection_instructions

Prompt-injection style instruction pattern detected.

Warn

• Code: suspicious.prompt_injection_instructions
• Location: references/agent-guardrails.md:26