Skip to content

Security: vmware-skills/VMware-Debug

Security

SECURITY.md

Security Policy

Disclaimer

This is a community-maintained open-source project and is not affiliated with, endorsed by, or sponsored by VMware, Inc. or Broadcom Inc. "VMware" and "vSphere" are trademarks of Broadcom. Source code is publicly auditable at github.com/vmware-skills/VMware-Debug under the MIT license.

Reporting Vulnerabilities

Report security issues via a GitHub private security advisory on the repository, or by email to the maintainer. Please do not open public issues for security bugs.

Security Design

Offline by construction; writes only its own ledger

vmware-debug has no network access and no credentials. It does not connect to vCenter, NSX, Aria, or any appliance. Its tools work over event data the orchestrating agent has already fetched with the other skills' read tools. Seven of its fourteen MCP tools write — only to the local investigation ledger under $OPS_HOME (default ~/.vmware/cases). Evidence, gaps, hypotheses and grade history are only ever added to; timeline.md is regenerated from the evidence and case.json holds the current grade and state. That holds with several writers too: every write to a case takes that case's lock file (.ledger.lock, created exclusively), so two processes working one case in a shared $OPS_HOME are serialised rather than losing each other's entries, and every file is written to a temporary name and moved into place, so a reader never sees half of one (on a filesystem without hard links, a new evidence file is created in place instead: still never overwritten, but readable half-written). A lock left by a crashed process is reported with its holder and never removed automatically; delete it once nothing is writing the case. Released versions up to and including 1.11.3 do not take the lock, so upgrade every machine that shares a cases folder. There is no destructive surface against any VMware system and no secret to leak.

No remediation execution

debug only diagnoses and recommends. Any fix is routed to vmware-aiops (single op, with its own confirmation) or vmware-pilot (multi-step, approval-gated, audited). The safety gates live in those skills, not here.

No cross-skill coupling

debug imports none of the other skill packages at runtime. Events arrive as plain dicts (the unified event envelope), so there is no transitive dependency surface.

Prompt-injection consideration

debug operates on text the agent supplies. Its outputs are structured data (timelines, hypotheses, routing strings); it does not execute or shell out to anything based on event content.

Static Analysis

uvx bandit -r vmware_debug/

Release bar: 0 Medium-or-higher severity findings.

Supported Versions

The latest released version receives fixes. Versions are kept aligned across the VMware skill family.

There aren't any published security advisories