ClawHub
Back to skill

Security audit

Proxmox Ops

Security checks for vulnerabilities and agentic risk

Overview

This Proxmox operations skill is mostly purpose-aligned, but it handles powerful infrastructure credentials and includes unsafe defaults that users should review before installing.

Install only if you are comfortable giving an agent Proxmox administration capability. Use a least-privilege token, prefer environment injection or a secret manager over sourcing a plaintext dotfile, enable proper TLS validation instead of curl -k, rotate any exposed tokens, and do not run provisioning or deletion examples without reviewing VMID, node, backups, and credentials.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/pve.sh:7
Finding

Credential File Is Executed as Arbitrary Shell Code

Content
View full analysis

Vulnerability Details

File Location: scripts/pve.sh, lines 7–10
Vulnerability Type: Unsafe configuration-file execution
Risk Level: High

Vulnerable Code:

bash
# Load credentials
if [[ -f ~/.proxmox-credentials ]]; then
    source ~/.proxmox-credentials
fi

Technical Analysis

The script loads ~/.proxmox-credentials with the Bash source built-in. This does not parse the file as inert key-value configuration; it executes every statement in the file within the current shell process.

Consequently, any shell command, command substitution, function definition, variable expansion, or redirection inserted into the credential file runs with the privileges of the user invoking pve.sh. The script only checks whether the path exists. It does not verify file ownership, permissions, file type, or content before execution.

The file is also sourced whenever it exists, even if all required credentials have already been supplied through environment variables. This conflicts with the documented environment-first fallback behavior and unnecessarily exposes environment-based invocations to the executable configuration file.

Attack Path

  1. An attacker or compromised local process obtains write access to the victim's ~/.proxmox-credentials file or replaces it through an insecure surrounding setup.
  2. The attacker inserts a shell command, such as a command that copies files, installs user-level persistence, or invokes another executable.
  3. The victim runs any scripts/pve.sh command.
  4. Bash executes the injected statement when processing source ~/.proxmox-credentials.
  5. The malicious command inherits the victim's account privileges, environment, and access to the Proxmox token subsequently used by the script.

Impact Assessment

Successful exploitation provides arbitrary command execution as the local user running the helper. The attacker can access files available to that account, s ...[truncated 307 chars]

Remediation
View remediation

Remediation Suggestions

  • Do not use source to load credential data.
  • Parse an explicit allowlist of PROXMOX_HOST, PROXMOX_TOKEN_ID, and PROXMOX_TOKEN_SECRET as data.
  • Reject malformed entries, unexpected keys, command substitutions, control characters, and shell metacharacters.
  • Require the credential path to be a regular file owned by the current user and inaccessible to group or other users.
  • Load the file only when one or more required environment variables are absent.
  • Prefer a structured credential store or operating-system secret manager where practical.
  • Fail closed if ownership or permission validation fails.

T09 · Insecure Skill Coding Practices

Error
Location
scripts/pve.sh:18
Finding

TLS Certificate Verification Is Disabled for Authenticated Proxmox API Requests

Content
View full analysis

Vulnerability Details

File Location: scripts/pve.sh, lines 18–23
Additional Locations: SKILL.md, lines 89–180; references/provisioning.md, lines 20–169
Vulnerability Type: Improper TLS certificate validation
Risk Level: High

Vulnerable Code:

bash
AUTH="Authorization: PVEAPIToken=$PROXMOX_TOKEN_ID=$PROXMOX_TOKEN_SECRET"

api() {
    local method="${1:-GET}"
    local endpoint="$2"
    shift 2
    curl -ks -X "$method" -H "$AUTH" "$PROXMOX_HOST/api2/json$endpoint" "$@"
}

The documentation similarly uses curl -ks for authenticated read and write operations.

Technical Analysis

The -k option instructs curl to accept an HTTPS server without validating its certificate chain or hostname. Every helper request uses this option while transmitting the reusable Proxmox API token in the Authorization header.

Encryption without server authentication does not establish that the peer is the intended Proxmox server. An attacker able to intercept traffic, manipulate DNS, compromise a gateway, or control a proxy can present an arbitrary certificate. Curl will accept it and disclose the authorization header to the impersonating endpoint.

The same unsafe pattern appears throughout the operational and provisioning documentation, including examples for VM control, provisioning, template conversion, backup operations, and deletion. Although SKILL.md acknowledges that verification is disabled, documenting the weakness does not prevent token interception.

Attack Path

  1. The victim invokes the helper or follows a documented curl -ks example.
  2. A network-positioned attacker redirects or intercepts the connection to PROXMOX_HOST.
  3. The attacker presents an untrusted or hostname-mismatched TLS certificate.
  4. Curl accepts the certificate because -k disables verification.
  5. The client sends the Proxmox API token to the attacker's endpoint.
  6. The attacker reuses the captu ...[truncated 766 chars]
Remediation
View remediation

Remediation Suggestions

  • Remove -k from the default curl options.
  • Install a certificate issued by a trusted internal or public certificate authority on the Proxmox endpoint.
  • For private certificate authorities, support a configurable CA bundle and pass it through curl's --cacert option.
  • Verify that PROXMOX_HOST uses HTTPS and that its hostname matches the certificate.
  • If insecure mode is retained for exceptional development environments, require an explicit flag such as PROXMOX_INSECURE_TLS=1, emit a prominent warning, and keep verification enabled by default.
  • Update every example in SKILL.md and references/provisioning.md to use certificate verification.
  • Rotate any API token previously transmitted across an untrusted network with verification disabled.
  • Continue applying least-privilege roles to limit the impact of token compromise.

T09 · Insecure Skill Coding Practices

Error
Location
references/provisioning.md:23
Finding

Provisioning Example Starts a Networked Container with a Predictable Root Password

Content
View full analysis

Vulnerability Details

File Location: references/provisioning.md, lines 23–35
Vulnerability Type: Hardcoded predictable credential
Risk Level: High

Vulnerable Code:

bash
# Create container
curl -ks -X POST -H "$AUTH" "$PROXMOX_HOST/api2/json/nodes/{node}/lxc" \
  -d "vmid=$NEWID" \
  -d "hostname=my-container" \
  -d "ostemplate=local:vztmpl/debian-12-standard_12.2-1_amd64.tar.zst" \
  -d "storage=local-lvm" \
  -d "rootfs=local-lvm:8" \
  -d "memory=1024" \
  -d "swap=512" \
  -d "cores=2" \
  -d "net0=name=eth0,bridge=vmbr0,ip=dhcp" \
  -d "password=changeme123" \
  -d "start=1"

Technical Analysis

The provisioning reference supplies the predictable literal password changeme123 as the container's root password. The same request connects the container to vmbr0 using DHCP and starts it immediately.

Documentation in an agent-oriented operational Skill is likely to be copied or executed with limited modification. If this example is used as written, the container becomes active with a publicly known privileged credential before the operator has an opportunity to replace it.

Exploitability depends on network reachability and whether the selected template permits remote password authentication. Nevertheless, assigning a known root credential to a running networked system is an unsafe provisioning default.

Attack Path

  1. An operator or AI agent executes the documented container-creation example without replacing the example password.
  2. Proxmox creates the container with changeme123 as its root password.
  3. The container receives an address through DHCP on vmbr0 and starts automatically.
  4. An attacker with network access discovers the new container through address scanning, DHCP information, or infrastructure visibility.
  5. If a remotely accessible service accepts root password authentication, the attacker authenticates with the documented password.
  6. The at ...[truncated 740 chars]
Remediation
View remediation

Remediation Suggestions

  • Remove the literal password from the provisioning example.
  • Prefer SSH public-key authentication and disable remote password authentication.
  • If a password is necessary, generate a unique high-entropy secret at provisioning time and retrieve it from a protected secret manager or secure interactive prompt.
  • Avoid placing plaintext credentials directly in command arguments, where they may be exposed through shell history or process inspection.
  • Do not start the container until secure authentication and access controls have been configured.
  • Add unprivileged=1 to the secure default example unless the workload explicitly requires a privileged container.
  • Restrict initial network access with firewall rules and management-network segmentation.
  • Add explicit documentation warning users never to deploy example credentials.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (20)

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

The code is clearly related to Proxmox operations and does not show unrelated or undeclared risky behavior beyond the stated Proxmox API access pattern. However, the declared description substantially overstates the implemented functionality. The actual script is a narrower helper focused on basic status/listing, lifecycle actions, snapshots, tasks, and storage. Major declared features—provisioning, cloning, deletion, backups, templates, disk resizing, guest-agent IP lookup, logs, and operational safety gates—are absent from the provided code. Therefore the description does not accurately represent what this supplied code chunk actually does.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
88% confidence
Finding

The skill is designed to access long-lived API tokens from environment variables or a sourced file, giving shell code direct access to sensitive infrastructure credentials. In an agent context, any prompt injection, logging mistake, command echo, or unintended shell expansion could expose those tokens and enable full Proxmox API abuse against VMs, storage, and backups.

Content

Scanner excerpt · SKILL.md (reported line 201)May include surrounding context.

md
- **Credential file** (`~/.proxmox-credentials`) is user-created, not auto-generated by this skill. Must be mode 600 (`chmod 600 ~/.proxmox-credentials`). Rotate tokens immediately if exposed
- **TLS verification disabled** (`-k` / `--insecure`) — Proxmox VE uses self-signed certificates by default ([Proxmox docs](https://pve.proxmox.com/wiki/Certificate_Management)). If you deploy a trusted CA cert on your Proxmox node, remove the `-k` flag from curl commands and pve.sh
- **Least-privilege tokens** — create tokens with only the roles your workflow needs. `PVEAuditor` for monitoring, `PVEVMAdmin` for VM ops. Full-access tokens are not required for most operations
- **Network scope** — all API calls target `PROXMOX_HOST` only. No external endpoints. Verify by reviewing `scripts/pve.sh` (small, readable). In agent contexts, restrict network access to your Proxmox hosts only
- **API tokens** don't need CSRF tokens for POST/PUT/DELETE
- **Power and delete operations are destructive** — confirm with user first

Session Persistence

Medium
Category
Rogue Agent
Confidence
84% confidence
Finding

The README recommends storing a long-lived Proxmox API token in ~/.proxmox-credentials and sourcing it at runtime, which creates persistent local secret storage. If the host or user account is compromised, the token can be recovered and used to administer the Proxmox environment, and the broader skill context increases risk because these credentials grant direct infrastructure control over VMs, containers, storage, and snapshots.

Content

Scanner excerpt · README.md (reported line 20)May include surrounding context.

md
- `curl`
- `jq`
- Proxmox VE API token ([how to create one](https://pve.proxmox.com/wiki/User_Management#pveum_tokens))

## Setup

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · README.md (reported line 30)May include surrounding context.

PROXMOX_TOKEN_ID=user@pam!tokenname PROXMOX_TOKEN_SECRET=xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx EOF chmod 600 ~/.proxmox-credentials

text

## Quick Start

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 39)May include surrounding context.

PROXMOX_TOKEN_ID=user@pam!tokenname PROXMOX_TOKEN_SECRET=xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx EOF chmod 600 ~/.proxmox-credentials

text

## Quick Start

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding

The skill declares shell-capable behavior but does not define an explicit tool scope or permission boundary. In an agent environment, that omission can allow broader-than-expected command execution and networked side effects, especially because the documented workflow includes credential loading and destructive infrastructure operations.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
86% confidence
Finding

The instructions encourage persistent storage of Proxmox API credentials in a reusable file under the home directory. Even with mode 600, persistence increases the blast radius of local compromise, accidental backup inclusion, or other skills/processes reading the same account context.

Content

Scanner excerpt · SKILL.md (reported line 31)May include surrounding context.

First-Time Setup

Create a credential file at ~/.proxmox-credentials:

bash
cat > ~/.proxmox-credentials <<'EOF'

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 130)May include surrounding context.

md
curl -ks -H "$AUTH" "$PROXMOX_HOST/api2/json/nodes/{node}/qemu/{vmid}/snapshot" | jq

# Create snapshot (disk-only, safe)
curl -ks -X POST -H "$AUTH" "$PROXMOX_HOST/api2/json/nodes/{node}/qemu/{vmid}/snapshot" \
  -d "snapname=snap1" -d "description=Before update"

# Rollback

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 147)May include surrounding context.

curl -ks -H "$AUTH" "$PROXMOX_HOST/api2/json/nodes/{node}/qemu/{vmid}/config" | jq

Resize disk (use absolute size, NOT relative — +10G fails regex validation)

curl -ks -X PUT -H "$AUTH" "$PROXMOX_HOST/api2/json/nodes/{node}/qemu/{vmid}/resize"
-d "disk=scsi0" -d "size=20G" | jq

text

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 177)May include surrounding context.

curl -ks -H "$AUTH" "$PROXMOX_HOST/api2/json/nodes/{node}/storage/{storage}/content?content=backup" | jq

Start backup

curl -ks -X POST -H "$AUTH" "$PROXMOX_HOST/api2/json/nodes/{node}/vzdump"
-d "vmid={vmid}" -d "storage={storage}" -d "mode=snapshot"

text

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 193)May include surrounding context.

md
## Provisioning

For create VM, create LXC, clone, convert to template, and delete operations:

→ See [references/provisioning.md](references/provisioning.md)

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 199)May include surrounding context.

md
## Security Notes

- **Credential file** (`~/.proxmox-credentials`) is user-created, not auto-generated by this skill. Must be mode 600 (`chmod 600 ~/.proxmox-credentials`). Rotate tokens immediately if exposed
- **TLS verification disabled** (`-k` / `--insecure`) — Proxmox VE uses self-signed certificates by default ([Proxmox docs](https://pve.proxmox.com/wiki/Certificate_Management)). If you deploy a trusted CA cert on your Proxmox node, remove the `-k` flag from curl commands and pve.sh
- **Least-privilege tokens** — create tokens with only the roles your workflow needs. `PVEAuditor` for monitoring, `PVEVMAdmin` for VM ops. Full-access tokens are not required for most operations
- **Network scope** — all API calls target `PROXMOX_HOST` only. No external endpoints. Verify by reviewing `scripts/pve.sh` (small, readable). In agent contexts, restrict network access to your Proxmox hosts only

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/provisioning.md (reported line 24)May include surrounding context.

md
NEWID=$(curl -ks -H "$AUTH" "$PROXMOX_HOST/api2/json/cluster/nextid" | jq -r '.data')

# Create container
curl -ks -X POST -H "$AUTH" "$PROXMOX_HOST/api2/json/nodes/{node}/lxc" \
  -d "vmid=$NEWID" \
  -d "hostname=my-container" \
  -d "ostemplate=local:vztmpl/debian-12-standard_12.2-1_amd64.tar.zst" \

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/provisioning.md (reported line 65)May include surrounding context.

md
NEWID=$(curl -ks -H "$AUTH" "$PROXMOX_HOST/api2/json/cluster/nextid" | jq -r '.data')

# Create VM
curl -ks -X POST -H "$AUTH" "$PROXMOX_HOST/api2/json/nodes/{node}/qemu" \
  -d "vmid=$NEWID" \
  -d "name=my-vm" \
  -d "memory=2048" \

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/provisioning.md (reported line 102)May include surrounding context.

bash
# Clone VM (full clone)
curl -ks -X POST -H "$AUTH" "$PROXMOX_HOST/api2/json/nodes/{node}/qemu/{vmid}/clone" \
  -d "newid=201" \
  -d "name=cloned-vm" \
  -d "full=1" \

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The document provides VM and container deletion commands, including a purge variant, without an adjacent explicit warning that these actions permanently remove workloads and may destroy attached disks. In an ops skill intended for execution-oriented use, omission of strong cautionary language increases the chance of accidental destructive actions by users or downstream agents.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/provisioning.md (reported line 165)May include surrounding context.

md
curl -ks -H "$AUTH" "$PROXMOX_HOST/api2/json/nodes/{node}/storage/local/content?content=iso" | jq '.data[] | .volid'

# Download template from Proxmox appliance repo
curl -ks -X POST -H "$AUTH" "$PROXMOX_HOST/api2/json/nodes/{node}/aplinfo" \
  -d "storage=local" \
  -d "template=debian-12-standard_12.2-1_amd64.tar.zst"

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The script sources a local credentials file containing sensitive Proxmox authentication material, but there is no visible warning, prompt, or explanatory output when doing so. For code files, access to sensitive credentials should have some form of disclosure unless clearly documented elsewhere in the reviewed file.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The helper sends privileged API credentials over the network and explicitly disables TLS certificate verification via curl -k. That creates a real man-in-the-middle risk: an attacker on the network could intercept or impersonate the Proxmox host and capture the API token or alter requests/responses.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/pve.sh (reported line 139)May include surrounding context.

sh
stop <vmid>         Force stop VM/LXC
  shutdown <vmid>     Graceful shutdown VM/LXC
  reboot <vmid>       Reboot VM/LXC
  snap <vmid> [name]  Create snapshot
  snapshots <vmid>    List snapshots
  tasks <node>        Show recent tasks
  storage <node>      Show storage status

Static analysis

No suspicious patterns detected.