中文 EN

Scan Report

Scan New Files

✓ Trusted — Risk Score 0/100
Last scan:2 days ago Rescan
0 /100
vmware-nsx
VMware NSX networking management — segments, gateways, NAT, routing, and IP pools with 31 MCP tools
vmware-nsx is a well-documented VMware NSX networking management skill that consists entirely of documentation (SKILL.md, references, evals) — no executable code is present in the skill bundle. The declared capabilities, security controls, and scope boundaries are clearly documented with no hidden behavior.
Skill Namevmware-nsx
Duration43.6s
Enginepi
✓
Safe to install
Approve for use. No code-level security issues were found in the skill bundle. For production deployment, verify the vmware-nsx-mgmt package integrity before installation.

Findings 4 items

Severity Finding Location
Info
Skill contains only documentation — no executable code
The skill bundle (5 files, 54KB) consists entirely of Markdown documentation and one evals JSON. The actual implementation is in the separately-installed vmware-nsx-mgmt package. This limits the analyzable attack surface to declared behavior in docs.
Skill bundle contains only docs; code lives in vmware-nsx-mgmt package
→ Verify the vmware-nsx-mgmt package integrity before installation
 SKILL.md:1
Info
Audit logging to local SQLite database
All operations are logged to ~/.vmware/audit.db (SQLite) via vmware-policy. This is disclosed and scoped. No exfiltration behavior.
All operations logged to ~/.vmware/audit.db (SQLite, framework-agnostic)
→ No action needed — audit logging is a positive security feature
 SKILL.md:160
Info
Optional webhook notification disclosed
The setup-guide.md mentions an optional notify.webhook_url in config.yaml for notifications. This is user-configured and requires explicit opt-in.
notify: webhook_url: ""
→ Ensure webhook_url is a trusted endpoint if configured
 references/setup-guide.md:55
Info
verify_ssl defaults to false
The default config has verify_ssl: false for targets. While documented as a setting users can enable, it presents SSL stripping risk if blindly copied.
verify_ssl: false
→ Production deployments should set verify_ssl: true with valid CA certificates
 references/setup-guide.md:50
ResourceDeclaredInferredStatusEvidence
Filesystem NONE NONE — No file system access in skill docs
Network READ READ ✓ Aligned HTTPS API calls to NSX Manager only, declared in SKILL.md
Shell WRITE WRITE ✓ Aligned Bash declared for CLI commands; all invocations documented (doctor, segment, gat…
Environment READ READ ✓ Aligned Environment variables for credentials documented and scoped to VMWARE_* vars
Skill Invoke NONE NONE — No skill-to-skill invocation described
Clipboard NONE NONE — Not used
Browser NONE NONE — Not used
Database NONE READ ✓ Aligned Audit logging to ~/.vmware-nsx/audit.log and SQLite audit.db via vmware-policy d…

File Tree

5 files · 54.3 KB · 1595 lines
Markdown 4f · 1557L JSON 1f · 38L
├─ ▾ 📁 evals
│ └─ 📋 evals.json JSON 38L · 1.3 KB
├─ ▾ 📁 references
│ ├─ 📝 capabilities.md Markdown 198L · 9.8 KB
│ ├─ 📝 cli-reference.md Markdown 637L · 16.7 KB
│ └─ 📝 setup-guide.md Markdown 401L · 10.8 KB
└─ 📝 SKILL.md Markdown 321L · 15.7 KB

Dependencies 2 items

PackageVersionSourceKnown VulnsNotes
vmware-nsx-mgmt * uv tool install No External package not analyzed — verify integrity before install
vmware-policy * auto-installed dependency No Audit/policy framework dependency

Security Positives

✓ No executable code in the skill bundle — pure documentation enables transparent review
✓ Comprehensive security controls documented: audit logging, double confirmation, dry-run mode
✓ Well-defined scope boundaries with explicit exclusions (no DFW, no VM lifecycle, no storage ops)
✓ Credential handling via environment variables only — passwords never stored in config
✓ Input validation for all user-supplied parameters (CIDR, IP, VLAN, port numbers)
✓ Prompt injection defense via _sanitize() function described
✓ Dependency checks prevent accidental cascade failures on delete operations
✓ Least-privilege NSX role recommendations provided (network_engineer vs enterprise_admin)
✓ Certificate-based authentication supported as alternative to passwords
✓ No obfuscation, no base64-encoded payloads, no suspicious network IOCs