70High
The skill introduces a critical security vulnerability by allowing users to disable policy enforcement via an environment variable, effectively bypassing essential audit and restriction controls.
HygienePackaging & Manifest2 findings
Skill Info
Namezw008/VMware-Policy/vmware-policy
Registrygithub
Version6d2ba431f5e3
PURLpkg:github/zw008/VMware-Policy@6d2ba431f5e3?skill=vmware-policy
Source
Install
This skill has been flagged as potentially malicious. Review the findings below before installing.
GitHub
Skills.shDocs
npx skills add https://github.com/zw008/VMware-PolicyAssessments (2)
AI Agent Traps ↗Potential for policy bypass via environment variablehighoversight evasionAML.T0054LLM01:2025LLM07:2025
The skill provides a mechanism to disable security policy enforcement via the VMWARE_POLICY_DISABLED environment variable, which could be exploited by an attacker to bypass audit and restriction controls.
80% confidence
To temporarily bypass: VMWARE_POLICY_DISABLED=1 (still logged as bypassed).
Missing licenseinfopolicy violation
Skill does not specify a license field. Specifying a license helps users understand usage terms.
100% confidence
Missing or insufficient descriptioninfopolicy violation
Skill description is empty or too short. A clear description helps users evaluate the skill's purpose.
100% confidence
Version History (3)
Badge
Markdown
[](https://mondoo.com/ai-agent-security/skills/github/zw008/VMware-Policy/vmware-policy)HTML
<a href="https://mondoo.com/ai-agent-security/skills/github/zw008/VMware-Policy/vmware-policy"><img src="https://mondoo.com/ai-agent-security/api/badge/github/zw008/VMware-Policy/vmware-policy.svg" alt="Mondoo Skill Check" /></a>Image URL
https://mondoo.com/ai-agent-security/api/badge/github/zw008/VMware-Policy/vmware-policy.svgSecure your AI agents
Skills can read files, run commands, and access credentials. Mondoo helps organizations manage the security risks of AI agent skills across their entire fleet.
- Continuous scanning of skills across all registries
- Policy enforcement before skills reach your agents
- Integration with your existing security workflow