15Low
The skill lacks version pinning and integrity verification for its installation process, creating a significant supply chain vulnerability that could allow the execution of malicious code.
HygienePackaging & Manifest1 finding
Skill Info
Namezw008/VMware-Policy/vmware-policy
Registrygithub
Versiona053c6450774
PURLpkg:github/zw008/VMware-Policy@a053c6450774?skill=vmware-policy
Source
Install
GitHub
Skills.shDocs
npx skills add https://github.com/zw008/VMware-PolicyAssessments (2)
AI Agent Traps ↗Unverified dependency installationlowsupply chainAML.T0010AML.T0019AML.T0058LLM03:2025
The installation instructions use 'uv tool install vmware-policy' without specifying a version or hash, making the installation susceptible to supply chain poisoning.
70% confidenceline 41
uv tool install vmware-policy
Missing licenseinfopolicy violation
Skill does not specify a license field. Specifying a license helps users understand usage terms.
100% confidence
Version History (3)
Badge
Markdown
[](https://mondoo.com/ai-agent-security/skills/github/zw008/VMware-Policy/vmware-policy)HTML
<a href="https://mondoo.com/ai-agent-security/skills/github/zw008/VMware-Policy/vmware-policy"><img src="https://mondoo.com/ai-agent-security/api/badge/github/zw008/VMware-Policy/vmware-policy.svg" alt="Mondoo Skill Check" /></a>Image URL
https://mondoo.com/ai-agent-security/api/badge/github/zw008/VMware-Policy/vmware-policy.svgSecure your AI agents
Skills can read files, run commands, and access credentials. Mondoo helps organizations manage the security risks of AI agent skills across their entire fleet.
- Continuous scanning of skills across all registries
- Policy enforcement before skills reach your agents
- Integration with your existing security workflow