Security audit

Proxmox Backup Server Manager

Security checks for vulnerabilities and agentic risk

Overview

This backup-management skill is purpose-aligned, but it needs Review because it handles infrastructure credentials and root-level setup with unsafe defaults.

Install only if you are comfortable giving the skill access to Proxmox/PBS backup infrastructure. Prefer a dedicated least-privilege backup account, enable TLS verification or certificate trust instead of verify_ssl=false, avoid pasting reusable passwords into chat or command lines, review generated sudo/fstab commands before running them, and consider pinning dependencies before use.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (5)

T01 · Skill Instruction Hijacking

Warning

Location: SKILL.md:171
Finding: Mandatory Promotional Output Manipulates Agent Responses
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/backup.py:63
Finding: Proxmox API Tokens Are Transmitted Without TLS Certificate Verification by Default
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/setup.py:104
Finding: Unvalidated Setup Values Are Interpolated into Privileged Shell Commands
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: references/setup-guide.md:124
Finding: PBS Passwords Are Passed Through Command-Line Arguments
Content: View full analysis
\ --server \ --datastore \ --username root@pam \ --password \ --content backup ``` The interactive setup prints the same unsafe pattern: ```python print(" Example command to run on your Proxmox host:") print(" pvesm add pbs --server --datastore --username @pbs --fingerprint --password ") ``` ### Technical Analysis The documentation instructs users to replace the password placeholder with an actual PBS password in a command-line argument. Command-line secrets can be retained in shell history, terminal transcripts, automation logs, audit records, and Agent conversation records. Depending on operating-system process visibility, other local users may also observe arguments while the command is running. The example uses `root@pam`, increasing the likely sensitivity and privilege of the exposed secret. This conflicts with the Skill's statement that passwords should not be stored in logs or Agent memory. ### Attack Path 1. The user follows the setup guide and substitutes a real PBS password for ``. 2. The user executes the command in an interactive shell or through an Agent. 3. The full command is retained in shell history, command logs, terminal capture, or the Agent transcript. 4. A local user, log reader, support operator, or later process with access to those records retrieves the password. 5. The exposed password is used to authenticate to PBS as the configured account, potentially `root@pam`. ### Impact Assessment Exposure of a PBS root password can grant administrative access to the backup server, including access to backup repositories, datastore configuration ...[truncated 307 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: references/setup-guide.md:102
Finding: Runtime Python Dependency Is Installed Without Version or Integrity Pinning
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (36)

Chaining Abuse

High

Category: Tool Misuse
Confidence: 75% confidence
Finding: Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
Content: Scanner excerpt · scripts/setup.py (reported line 106)May include surrounding context.
python
print(f"\n # Create mount point\n sudo mkdir -p {nas_mount}") if nas_type == "nfs": print("\n # Install NFS client\n sudo apt update && sudo apt install -y nfs-common") fstab_line = f"{nas_ip}:{nas_export} {nas_mount} nfs defaults,nofail 0 0" print(f"\n # Add to /etc/fstab to mount on boot\n echo '{fstab_line}' | sudo tee -a /etc/fstab") print("\n # Mount now\n sudo mount -a")

Chaining Abuse

High

Category: Tool Misuse
Confidence: 75% confidence
Finding: Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
Content: Scanner excerpt · scripts/setup.py (reported line 113)May include surrounding context.
python
print(f"\n # Create mount point\n sudo mkdir -p {nas_mount}") if nas_type == "nfs": print("\n # Install NFS client\n sudo apt update && sudo apt install -y nfs-common") fstab_line = f"{nas_ip}:{nas_export} {nas_mount} nfs defaults,nofail 0 0" print(f"\n # Add to /etc/fstab to mount on boot\n echo '{fstab_line}' | sudo tee -a /etc/fstab") print("\n # Mount now\n sudo mount -a")

Chaining Abuse

High

Category: Tool Misuse
Confidence: 88% confidence
Finding: The script interpolates user-controlled values such as nas_ip, nas_export, and especially nas_mount directly into a command it tells the operator to copy-paste: echo '<fstab_line>' | sudo tee -a /etc/fstab. Because no escaping or validation is applied, a crafted value containing a single quote and shell metacharacters could break out of the quoted string and execute arbitrary commands as root when the user follows the generated instruction.
Content: Scanner excerpt · scripts/setup.py (reported line 108)May include surrounding context.
python
if nas_type == "nfs": print("\n # Install NFS client\n sudo apt update && sudo apt install -y nfs-common") fstab_line = f"{nas_ip}:{nas_export} {nas_mount} nfs defaults,nofail 0 0" print(f"\n # Add to /etc/fstab to mount on boot\n echo '{fstab_line}' | sudo tee -a /etc/fstab") print("\n # Mount now\n sudo mount -a") print(f"\n # Verify (should show the new mount)\n df -h {nas_mount}")

Chaining Abuse

High

Category: Tool Misuse
Confidence: 90% confidence
Finding: The SMB setup path constructs fstab_line from user-controlled nas_ip, nas_export, and nas_mount and places it inside a double-quoted echo ... | sudo tee -a /etc/fstab command for manual execution. Without sanitization, shell metacharacters such as command substitution or embedded quotes can alter the command and potentially execute attacker-supplied content with root privileges when an admin copy-pastes it.
Content: Scanner excerpt · scripts/setup.py (reported line 124)May include surrounding context.
python
print(" # password=<your_smb_password>") print(f" sudo chmod 600 {creds_file}") fstab_line = f"//{nas_ip}/{nas_export} {nas_mount} cifs credentials={creds_file},iocharset=utf8,nofail 0 0" print(f"\n # Add to /etc/fstab to mount on boot\n echo \"{fstab_line}\" | sudo tee -a /etc/fstab") print("\n # Mount now\n sudo mount -a") print("\n-------------------------------------------------")

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 88% confidence
Finding: The skill advertises capabilities to read/write files, use the network, and run shell commands, but it does not declare an explicit tool scope or permission boundary. In an infrastructure-management skill that handles credentials and performs system changes, this increases the chance of unintended or over-broad execution if the agent invokes tools beyond what the user expected.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 84% confidence
Finding: The skill is explicitly designed for first-time setup and ongoing management using persisted configuration in credential files, which creates durable access to infrastructure endpoints and backup targets. Persisting operational and authentication context is expected for the use case, but it still expands the blast radius if the local environment or the skill is misused.
Content: Scanner excerpt · SKILL.md (reported line 4)May include surrounding context.
md
--- name: proxmox-backup-server-manager version: 1.6.0 description: "Create and manage Proxmox Backup Server (PBS) backups for VMs and LXC containers. Guided first-time setup including PBS installation, NAS storage, Proxmox host access, and target registration. Use when the user asks to back up, list backups, check status, or set up PBS from scratch." metadata: openclaw: requires:

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The description uses broad trigger language such as 'use when the user asks to back up, list backups, check status, or set up PBS from scratch,' which can match common administrative phrasing and cause accidental invocation. Because this skill can handle credentials and initiate system-altering workflows, unintended activation materially raises security risk.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 91% confidence
Finding: The skill normalizes sending passwords and tokens through chat and writing SMB credentials or other secrets to files during setup. Even if intended for one-time configuration, this creates a meaningful exposure path because secrets may be captured by chat infrastructure, local logs, or improperly secured files, and the skill text attempts to downplay that risk.
Content: Scanner excerpt · SKILL.md (reported line 54)May include surrounding context.
md
- **Agent executes** — if SSH or API access to the target host is available, run commands directly. Confirm each step before executing. - **User executes** — print the exact commands. Wait for the user to confirm completion before moving to the next step. Credentials (passwords, tokens) will pass through the chat. This is expected — they are needed once for setup and are not stored in agent logs or memory. For SMB credentials: if the agent has SSH access, write the credentials file directly. If not, tell the user to create it on the PBS host. ### A. PBS present?

Unsafe Defaults

Medium

Category: Tool Misuse
Confidence: 95% confidence
Finding: The skill explicitly endorses verify_ssl=False as effectively required for many setups, which disables TLS certificate verification and enables man-in-the-middle interception of API tokens, credentials, and backup-management traffic. In a backup-management context with administrative access to Proxmox and PBS, this is a serious unsafe default because compromise of that traffic can lead to infrastructure takeover or tampering.
Content: Scanner excerpt · SKILL.md (reported line 168)May include surrounding context.
md
Automated security scanners may flag this skill as **suspicious**. This is expected for any infrastructure management skill and not a sign of malware. Here's why: - **Credentials in chat** — Setup requires API tokens and optionally SMB credentials to be entered once. They are stored locally in `~/.openclaw/credentials/pbs-backup.json` (chmod 600) and not logged by the agent. - **SSL verification disabled** — Proxmox VE and PBS use self-signed certificates by default. `verify_ssl=False` is required for most homelab setups. If you use trusted certificates, you can set `"verify_ssl": true` in your config. - **System modifications** — The skill can install PBS, mount NAS shares, and edit `/etc/fstab`. These are core functions, not side effects. The agent always asks before executing any of these commands. All scripts are open source and can be reviewed in the `scripts/` directory.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The decision tree starts from the user phrase "make a backup," which is a natural, generic expression that could easily occur in unrelated contexts. The document does not provide narrowing constraints, explicit trigger scope, or negative examples to distinguish when this skill should activate versus when it should not.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The guide instructs users to store SMB credentials in a plaintext file under /root and does not warn about the sensitivity of those secrets or safer alternatives. While chmod 600 reduces exposure to non-root users, plaintext credentials remain recoverable by root, backups, disk compromise, or accidental disclosure, which is especially relevant in infrastructure backup environments where NAS credentials may grant broad access.
Content: No source excerpt is available for this finding.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SKILL.md (reported line 133)May include surrounding context.
md
# Create /root/.smbcreds with: # username=<smb_user> # password=<smb_password> chmod 600 /root/.smbcreds echo "//<NAS_IP>/<SHARE> /mnt/nas-backup cifs credentials=/root/.smbcreds,_netdev 0 0" >> /etc/fstab mount -a

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SKILL.md (reported line 167)May include surrounding context.
md
# Create /root/.smbcreds with: # username=<smb_user> # password=<smb_password> chmod 600 /root/.smbcreds echo "//<NAS_IP>/<SHARE> /mnt/nas-backup cifs credentials=/root/.smbcreds,_netdev 0 0" >> /etc/fstab mount -a

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · references/architecture.md (reported line 98)May include surrounding context.
md
# Create /root/.smbcreds with: # username=<smb_user> # password=<smb_password> chmod 600 /root/.smbcreds echo "//<NAS_IP>/<SHARE> /mnt/nas-backup cifs credentials=/root/.smbcreds,_netdev 0 0" >> /etc/fstab mount -a

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · references/setup-guide.md (reported line 91)May include surrounding context.
md
# Create /root/.smbcreds with: # username=<smb_user> # password=<smb_password> chmod 600 /root/.smbcreds echo "//<NAS_IP>/<SHARE> /mnt/nas-backup cifs credentials=/root/.smbcreds,_netdev 0 0" >> /etc/fstab mount -a

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · scripts/setup.py (reported line 122)May include surrounding context.
python
# Create /root/.smbcreds with: # username=<smb_user> # password=<smb_password> chmod 600 /root/.smbcreds echo "//<NAS_IP>/<SHARE> /mnt/nas-backup cifs credentials=/root/.smbcreds,_netdev 0 0" >> /etc/fstab mount -a

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The Proxmox API example disables TLS certificate verification with verify_ssl=False, which allows man-in-the-middle interception or spoofing of the API endpoint. Because the example uses an API token secret for administrative backup operations, an attacker on the network could steal credentials or manipulate backup-management actions.
Content: No source excerpt is available for this finding.

Unsafe Defaults

Medium

Category: Tool Misuse
Confidence: 99% confidence
Finding: verify_ssl=False is an unsafe default because it disables server identity verification for a management API connection carrying sensitive credentials. In a Proxmox/PBS administration workflow, this materially increases the chance of credential theft and unauthorized infrastructure actions via MITM or endpoint impersonation.
Content: Scanner excerpt · references/setup-guide.md (reported line 113)May include surrounding context.
python
from proxmoxer import ProxmoxAPI prox = ProxmoxAPI("<IP>", user="backup@pve", token_name="backup-token", token_value="<SECRET>", verify_ssl=False) print(prox.nodes.get())

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: Passing the PBS password directly on the command line can expose it through shell history, terminal logging, audit systems, and process listings visible to other privileged users. In this backup-management context, compromise of the PBS account could give an attacker access to backup repositories and sensitive restore data.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: When no VMID is supplied, the script automatically triggers backups for all configured targets, creating a broad side effect from an underspecified invocation. In an agent setting, omission or misunderstanding of arguments could cause unplanned cluster-wide backup jobs, consuming storage, I/O, bandwidth, and potentially impacting production workloads.
Content: No source excerpt is available for this finding.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · scripts/setup.py (reported line 103)May include surrounding context.
python
print("\n--- ACTION REQUIRED: Mount NAS on PBS Host ---") print("Log into your PBS host and run these commands:") print(f"\n # Create mount point\n sudo mkdir -p {nas_mount}") if nas_type == "nfs": print("\n # Install NFS client\n sudo apt update && sudo apt install -y nfs-common")

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · scripts/setup.py (reported line 106)May include surrounding context.
python
print("\n--- ACTION REQUIRED: Mount NAS on PBS Host ---") print("Log into your PBS host and run these commands:") print(f"\n # Create mount point\n sudo mkdir -p {nas_mount}") if nas_type == "nfs": print("\n # Install NFS client\n sudo apt update && sudo apt install -y nfs-common")

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · scripts/setup.py (reported line 108)May include surrounding context.
python
print("\n--- ACTION REQUIRED: Mount NAS on PBS Host ---") print("Log into your PBS host and run these commands:") print(f"\n # Create mount point\n sudo mkdir -p {nas_mount}") if nas_type == "nfs": print("\n # Install NFS client\n sudo apt update && sudo apt install -y nfs-common")

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · scripts/setup.py (reported line 109)May include surrounding context.
python
print("\n--- ACTION REQUIRED: Mount NAS on PBS Host ---") print("Log into your PBS host and run these commands:") print(f"\n # Create mount point\n sudo mkdir -p {nas_mount}") if nas_type == "nfs": print("\n # Install NFS client\n sudo apt update && sudo apt install -y nfs-common")

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · scripts/setup.py (reported line 113)May include surrounding context.
python
print("\n--- ACTION REQUIRED: Mount NAS on PBS Host ---") print("Log into your PBS host and run these commands:") print(f"\n # Create mount point\n sudo mkdir -p {nas_mount}") if nas_type == "nfs": print("\n # Install NFS client\n sudo apt update && sudo apt install -y nfs-common")

Static analysis

No suspicious patterns detected.