Proxmox Wazuh Enroll

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:48 AM UTC
• Version: 1.0.0

Overview

The skill is coherent for enrolling Windows Proxmox VMs into Wazuh, but its documented workflow gives very high system access and includes unsafe installer and API-token handling patterns.

Review this skill carefully before installing. Use it only for trusted operators and known target VMs, require explicit confirmation before guest execution, do not use curl -k with Proxmox API tokens, pin and verify the Wazuh MSI hash and publisher signature, and keep the registration password out of command lines, logs, and chat.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: references/qga-exec.md:28

Finding

Proxmox API token transmitted without TLS certificate verification

Content

View full analysis

Remediation

View remediation

T03 · Remote Payload Retrieval and Execution

Error

• Location: references/wazuh-agent-enroll.md:37

Finding

Externally retrieved MSI is installed as SYSTEM without integrity or publisher verification

Content

View full analysis

", "agentName": "", "group": "", "msiUrl": "https://packages.wazuh.com/4.x/windows/wazuh-agent-.msi", "regPassword": "FROM YOUR VAULT — never hardcode. Pass over QGA stdin, not on the command line." } ``` ```bat curl.exe -sL -o C:\Windows\Temp\wz.msi msiexec /i C:\Windows\Temp\wz.msi /qn ^ WAZUH_MANAGER= ^ WAZUH_REGISTRATION_PASSWORD= ^ WAZUH_AGENT_NAME= ^ WAZUH_AGENT_GROUP= ``` ### Technical Analysis The workflow downloads an MSI from the operator-supplied `msiUrl` and immediately installs it through QGA as `NT AUTHORITY\SYSTEM`. It does not verify a pinned SHA-256 digest, validate the MSI's Authenticode signature and expected signer, or restrict redirects to approved hosts. Although the documented example uses the official Wazuh package domain and HTTPS, the URL remains externally supplied and `curl -L` follows redirects. The effective executable payload can therefore differ from what was reviewed in this Skill. Package retrieval is required for installation, but executing the downloaded artifact without independent integrity and publisher validation exceeds the minimum safe behavior needed for enrollment. ### Attack Path 1. An operator supplies or accepts an incorrect, compromised, or attacker-influenced `msiUrl`; alternatively, the approved download endpoint or redirect path is compromised. 2. `curl.exe -L` retrieves the attacker-controlled MSI and follows redirects without enforcing an approved final hostname. 3. The file is written to the predictable path `C:\Windows\Temp\wz.msi`. 4. No cryptographic digest or Authenticode signer validation is perfor ...[truncated 844 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · references/qga-exec.md (reported line 58)May include surrounding context.

qm guest exec takes --pass-stdin 1 (REST: input-data=). Feed the Wazuh registration password as stdin and read it in-guest with [Console]::In.ReadLine(), so it never lands in the process table, the command line, or QGA logs.

bash

printf '%s\n' "$REG_PW" | sudo qm guest exec <vmid> --timeout 180 --pass-stdin 1 -- \
  powershell.exe -NoProfile -NonInteractive -Command \
  "\$pw=[Console]::In.ReadLine(); <build the msiexec arg list from \$pw and run it>"

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/qga-exec.md (reported line 16)May include surrounding context.

bash

# simple cmd — instant
sudo qm guest exec <vmid> --timeout 120 -- cmd /c "hostname"

# base64 PowerShell — avoids quoting hell, decodes & runs in-guest
b64=$(printf '%s' '<powershell>' | base64 -w0)

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/qga-exec.md (reported line 58)May include surrounding context.

bash

# simple cmd — instant
sudo qm guest exec <vmid> --timeout 120 -- cmd /c "hostname"

# base64 PowerShell — avoids quoting hell, decodes & runs in-guest
b64=$(printf '%s' '<powershell>' | base64 -w0)

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 91% confidence

Finding

This example decodes attacker-controllable Base64 and executes it with Invoke-Expression inside the Windows guest as NT AUTHORITY\SYSTEM. In this skill's context, that creates a powerful arbitrary-code-execution primitive in the VM, and the surrounding text explicitly highlights no-auth in-guest execution, increasing the danger if inputs are influenced by an untrusted user.

Content

Scanner excerpt · references/qga-exec.md (reported line 20)May include surrounding context.

base64 PowerShell — avoids quoting hell, decodes & runs in-guest

b64=$(printf '%s' '' | base64 -w0) sudo qm guest exec --timeout 180 --
powershell.exe -NoProfile -NonInteractive -Command
"$d=[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('$b64')); Invoke-Expression $d" 2>&1

text

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The document explicitly warns operators not to place the Wazuh registration password on the command line, yet the primary example does exactly that by passing it as an MSI property. Command-line arguments are commonly exposed through process listings, logging, EDR telemetry, shell history, Proxmox task traces, and audit tooling, so this can leak a live enrollment secret that could be reused to register rogue agents or interfere with agent trust.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

Line 31 states that group creation is the one manager-side prerequisite and that everything else happens in-guest over QGA. Later, Step 4 instructs the operator to verify agent state and inspect /var/ossec/logs/ossec.log on the manager, which contradicts the earlier claim about where the workflow occurs.

Content

No source excerpt is available for this finding.