Security audit

Pve Automation

Security checks across malware telemetry and agentic risk

Overview

This Proxmox skill is not malicious, but it combines broad infrastructure admin powers with an unsafe TLS default that can expose privileged API tokens.

Install only after review. Use a least-privilege Proxmox API token, avoid root@pam automation tokens, enable certificate verification before real use, and require explicit target confirmation for delete, rollback, ACL, firewall, certificate, storage, and host-maintenance actions.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (8)

Description-Behavior Mismatch

High

Confidence: 95% confidence
Finding: The skill goes far beyond VM/container lifecycle automation and documents identity management, ACLs, certificates, storage backends, notifications, and node maintenance. In a Proxmox environment, these are tenant-wide or cluster-wide administrative controls, so bundling them into a broad automation skill meaningfully increases blast radius.

Context-Inappropriate Capability

High

Confidence: 96% confidence
Finding: The skill includes user, group, role, ACL, and pool management that are not necessary for routine VM/container automation. These actions can create privileged identities, widen access, or remove controls, making them especially dangerous in an infrastructure-management assistant.

Context-Inappropriate Capability

Medium

Confidence: 88% confidence
Finding: Certificate and ACME plugin management is outside the stated virtualization-management scope and can affect trust, TLS identity, and external DNS/provider integrations. In the wrong context, this could enable service disruption or misuse of certificate automation secrets.

Context-Inappropriate Capability

High

Confidence: 95% confidence
Finding: Node maintenance operations such as subscription upload, apt update/upgrade, and support/report actions are host-administration functions, not ordinary VM automation. These operations can change host state, trigger outages, or exfiltrate diagnostic data, making scope expansion particularly risky.

Vague Triggers

Medium

Confidence: 86% confidence
Finding: The activation guidance says to use the skill whenever the user mentions broad virtualization-related terms like Proxmox, PVE, qemu, or container operations. This overbroad routing increases the chance the skill is invoked in contexts where powerful infrastructure actions are unnecessary or unsafe.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The document lists destructive operations like VM and container deletion inline with ordinary lifecycle commands without adjacent warnings, safeguards, or confirmation requirements. In an agent setting, that normalization can increase the likelihood of accidental destructive actions being generated or executed.

Missing User Warnings

High

Confidence: 99% confidence
Finding: The client disables TLS certificate verification for API calls while transmitting a Proxmox API token in the Authorization header. In a PVE automation context, this enables man-in-the-middle interception or spoofing of the management API, potentially leading to credential theft and full control over VM, container, storage, and cluster operations.

Unsafe Defaults

Medium

Category: Tool Misuse
Content: ## Production Notes - Current implementation uses `verify=False` (SSL verification disabled), suitable only for trusted internal environments - For production, use valid certificates and enable SSL verification - Apply least-privilege principles to API tokens; avoid over-privileged root tokens
Confidence: 95% confidence
Finding: verify=False

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal, suspicious.insecure_tls_verification

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: SKILL.md:61

HTTPS certificate verification is disabled.

Warn

Code: suspicious.insecure_tls_verification
Location: scripts/pve_client.py:60