vmware-policy
The skill includes an insecure environment variable that allows users to completely disable all security policy enforcement, rendering the agent's protective controls ineffective.
Skill Info
Install
npx skills add https://github.com/zw008/VMware-PolicyAssessments (2)
AI Agent Traps ↗The skill provides an environment variable `VMWARE_POLICY_DISABLED=1` to bypass all policy enforcement. If an attacker gains control over the environment, they can disable all security rules while the system continues to operate, effectively neutralizing the 'policy enforcement' claim.
To temporarily bypass: VMWARE_POLICY_DISABLED=1
NER model detected organization in skill content (confidence: 0.53)
B********
NER model detected organization in skill content (confidence: 0.88)
M*
NER model detected organization in skill content (confidence: 0.99)
M**
NER model detected organization in skill content (confidence: 0.54)
*
NER model detected organization in skill content (confidence: 0.68)
*
NER model detected organization in skill content (confidence: 0.99)
I**
The skill provides an environment variable `VMWARE_POLICY_DISABLED=1` to bypass all security policy enforcement. This allows any process with environment control to disable the audit and policy infrastructure entirely, undermining the stated purpose of the skill. [ensemble: confirmed by 3/3 passes; severity set to the agreed median (ADR-0067).]
To temporarily bypass: `VMWARE_POLICY_DISABLED=1` (still logged as bypassed).
Skill does not specify a license field. Specifying a license helps users understand usage terms.
Version History (3)
Badge
[](https://mondoo.com/ai-agent-security/skills/github/zw008/VMware-Policy/vmware-policy)<a href="https://mondoo.com/ai-agent-security/skills/github/zw008/VMware-Policy/vmware-policy"><img src="https://mondoo.com/ai-agent-security/api/badge/github/zw008/VMware-Policy/vmware-policy.svg" alt="Mondoo Skill Check" /></a>https://mondoo.com/ai-agent-security/api/badge/github/zw008/VMware-Policy/vmware-policy.svgSecure your AI agents
Skills can read files, run commands, and access credentials. Mondoo helps organizations manage the security risks of AI agent skills across their entire fleet, discover and control Shadow AI usage.
- Continuous scanning of skills across all registries
- Policy enforcement before skills reach your agents
- Integration with your existing security workflow