ClawHub
Back to skill

Security audit

Veeam MCP

Security checks across malware telemetry and agentic risk

Overview

This skill appears purpose-built for Veeam monitoring, but it asks users to store and pass powerful backup-system credentials in ways that are under-scoped and partly misrepresented.

Install only if you trust the external Veeam MCP Docker image and can use a least-privilege service account. Treat ~/.veeam-mcp-creds.json as a high-value secret, avoid entering passwords in example shell commands, prefer validated TLS certificates, and review what tools the MCP server exposes before using the interactive mode.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (9)

Lp3

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding
The skill clearly describes network-capable behavior through a Dockerized MCP server talking to Veeam APIs, yet no explicit permissions declaration is documented. That creates a transparency and governance gap: users or platforms may underestimate that the skill can transmit administrative credentials and sensitive infrastructure data off-process and over the network.

Intent-Code Divergence

Medium
Confidence
99% confidence
Finding
The manual test command passes the admin password directly on the shell command line via an environment assignment, contradicting the claim that credentials are not exposed in command history. Shell history, process listings, audit logs, or terminal recording can capture the secret, leading to credential disclosure for backup infrastructure administrative accounts.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The README instructs users to place Veeam administrative credentials in a plaintext JSON file under their home directory. Although it recommends restrictive file permissions, it does not warn about the sensitivity of the data, risks of local compromise, shell history/editor backups, or safer secret-management alternatives. In the context of backup infrastructure, stolen credentials could expose backup inventories, operational data, and potentially enable destructive actions against recovery systems.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The skill instructs users to provide administrator credentials and send backup and infrastructure data through a beta Dockerized MCP service with AI-backed processing, but it does not clearly disclose the privacy, retention, and trust implications. In this context, the missing warning is security-significant because the queried data can reveal internal topology, outages, repository capacity, and privileged operational details.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The example enables ACCEPT_SELF_SIGNED_CERT=true without a visible warning or guidance on certificate validation. Accepting self-signed certificates weakens transport authenticity and can enable man-in-the-middle interception of administrator credentials and sensitive Veeam data if users normalize insecure TLS practices.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The script reads credentials from a local file and injects them into a Docker container as environment variables. Passing secrets this way increases exposure because environment variables may be visible via process inspection, container metadata, debug logs, or error output, and the script gives no warning or hardening around this sensitive handling.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The script sends both user queries and privileged Veeam credentials into a Docker container without any explicit user warning, trust verification of the image, or output sanitization. Because the container is the main trust boundary here, a malicious, outdated, or substituted image could capture the credentials and query contents, and the hardcoded acceptance of self-signed certificates further weakens transport trust to the downstream service.

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The script reads Veeam credentials from a local file and injects them into the container as environment variables. Environment variables are commonly exposed through process inspection, container metadata, crash logs, or debugging output, so this increases the chance of credential disclosure even if the script itself is not overtly malicious.

Session Persistence

Medium
Category
Rogue Agent
Content
## Configuration

### Create Credentials File

Create `~/.veeam-mcp-creds.json`:
Confidence
88% confidence
Finding
Create Credentials File Create `~/.veeam-mcp-creds.json`: ```json { "vbr": { "url": "https://veeam-server.yourdomain.com:443/", "username": ".\\administrator", "password": "your_secure

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.