Security audit
Security checks across malware telemetry and agentic risk
This skill has a clear disposable-VM purpose, but it gives agents infrastructure-changing power with weakly documented authentication, credential handling, deletion safeguards, and privileged setup boundaries.
Install only in a controlled OpenNebula environment after confirming the API is authenticated, bound to localhost or a protected network, uses least-privilege credentials, avoids plaintext password passing, and requires careful target verification before any hard VM deletion.
- Keep the curated `templates` allowlist small and documented with descriptions. - Add TTL-based cleanup for disposable VMs. - Restrict bind address and network exposure according to the deployment. - Ensure the service account has passwordless sudo for the exact `one*` binaries used by the API, otherwise systemd runs can hang on sudo prompts.
- Keep the curated `templates` allowlist small and documented with descriptions. - Add TTL-based cleanup for disposable VMs. - Restrict bind address and network exposure according to the deployment. - Ensure the service account has passwordless sudo for the exact `one*` binaries used by the API, otherwise systemd runs can hang on sudo prompts.
- `GET /health` - `GET /vms` - `POST /vms` - `DELETE /vms/<vm_id_or_name>` Prefer readable VM and template names over numeric identifiers whenever possible.
Delete by name when possible: ```text DELETE /vms/test-nebula-api-2026-04-10 ``` ## Expected environment inputs
64/64 vendors flagged this skill as clean.
No suspicious patterns detected.
