T09 · Insecure Skill Coding Practices
Error
- Location
scripts/pve.sh:31- Finding
TLS Certificate Verification Is Disabled for Authenticated Proxmox Requests
- Content
View full analysis
- Remediation
View remediation
Security audit
Proxmox Complete
Security checks for vulnerabilities and agentic risk
Overview
This Proxmox administration skill is not deceptive, but it needs Review because it can change infrastructure and has unsafe credential, TLS, and approval-control gaps.
Install only if you are comfortable reviewing and tightening it first. Use a least-privilege Proxmox token, enable TLS verification with a trusted certificate, avoid the Bash fallback credential file, pin dependencies, and require an explicit per-action confirmation before any power, snapshot, rollback, deletion, or backup command runs.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/pve.sh:8- Finding
Shell Credential File Is Executed as Arbitrary Code
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
README.md:101- Finding
Proxmoxer Dependency Is Installed Without Version or Integrity Pinning
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/pve.sh:178- Finding
Destructive Proxmox Operations Do Not Enforce the Documented Approval Requirement
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Rogue AgentSelf-Modification, Session Persistence
Findings (21)
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
The script interpolates user-controlled values such as node, vmtype, vmid, and especially snapname directly into REST API path segments without validation or URL encoding. This can allow path manipulation or malformed requests against the Proxmox API, potentially causing deletion of unintended snapshots or other destructive actions if crafted values alter endpoint resolution.
- Content
sh fi vmtype=$(get_type_for_vmid "$vmid") echo "Deleting snapshot '$snapname' from $vmtype $vmid..." api DELETE "/nodes/$node/$vmtype/$vmid/snapshot/$snapname" | jq ;; backups)
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md - **Power Control**: Start, stop, reboot, shutdown VMs and containers - **Snapshots**: Create, list, delete, rollback (with optional RAM state) - **Backups**: List and create backups - **Storage**: View storage pools and content - **Tasks**: Track async operations and logs - **Cluster Overview**: Nodes, resources, health stats
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md - Snapshots: `snapshot`, `delete_snapshot`, `rollback` - Backups: `backup` Read-only (no approval): - `nodes`, `vms`, `status`, `list_snapshots` - `backups` (list), `storage`, `tasks`, `health`
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md - Snapshots: `snapshot`, `delete_snapshot`, `rollback` - Backups: `backup` Read-only (no approval): - `nodes`, `vms`, `status`, `list_snapshots` - `backups` (list), `storage`, `tasks`, `health`
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 89% confidence
- Finding
The skill advertises and documents shell and environment-based operations but does not declare any explicit tool scope such as allowed-tools or permissions. That mismatch weakens least-privilege controls and can cause the agent to invoke broader capabilities than a reviewer or runtime policy would expect, especially for a skill that performs administrative actions against infrastructure.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The description is broad enough to trigger on general Proxmox-related conversation, not just explicit requests to administer a cluster. In an agent setting, ambiguous activation boundaries can cause the skill to engage during informational discussions and then expose credentials, enumerate infrastructure, or suggest/perform sensitive commands without sufficiently clear user intent.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md Comprehensive Proxmox VE management combining: - **Power control**: Start, stop, reboot, shutdown VMs/containers - **Snapshots**: Create, list, delete, rollback (with optional RAM state) - **Backups**: List and create backups - **Storage**: View storage pools and content - **Tasks**: Track async operations and logs - **Cluster overview**: Nodes, resources, health
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The example credential configuration sets verify_ssl to false with no warning. Disabling TLS certificate verification enables man-in-the-middle interception of API traffic and token theft, which is especially dangerous because this skill manages hypervisor infrastructure and can perform high-impact administrative actions.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The environment variable example explicitly sets PVE_VERIFY_SSL="false" without any caution. This normalizes insecure transport settings and can lead operators to send authentication tokens over connections that do not validate the server identity, exposing cluster administration to interception.
- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
PROXMOX_TOKEN_ID=clawd@pve!tokenname PROXMOX_TOKEN_SECRET=your-token-secret EOF chmod 600 ~/.proxmox-credentials
text ### Create API Token
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The notes recommend using -k or disabling SSL verification without warning that it is insecure. For an API-driven infrastructure management skill, this materially increases the chance of credential compromise and unauthorized administrative control through spoofed endpoints or network interception.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The script executes destructive infrastructure actions like stop, shutdown, delete_snapshot, and rollback immediately based on command-line arguments, with no confirmation, dry-run mode, or secondary safety check. In the context of a Proxmox administration skill, this is more dangerous because a mistaken invocation or prompt-influenced agent action can directly disrupt workloads, cause downtime, or revert systems to unsafe states.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
sh PROXMOX_HOST="${PROXMOX_HOST#https://}" PROXMOX_HOST="https://${PROXMOX_HOST}" : "${PROXMOX_HOST:?Set PROXMOX_HOST or create ~/.openclaw/credentials/proxmox.json}" : "${PROXMOX_TOKEN_ID:?Set PROXMOX_TOKEN_ID}" : "${PROXMOX_TOKEN_SECRET:?Set PROXMOX_TOKEN_SECRET}"
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
sh delsnap <vmid> <snap> Delete snapshot backups <node> [storage] List backups backup <vmid> [storage] Create backup storage <node> List storage pools content <node> [storage] List storage content
Dynamic attribute access via getattr()
Low
- Category
- Dangerous Code Execution
- Confidence
- 50% confidence
- Finding
Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.
- Content
python return p.cluster.resources.get(type="vm") def status_current(p: ProxmoxAPI, node: str, kind: str, vmid: str): endpoint = getattr(p.nodes(node), kind) return endpoint(vmid).status.current.get() def action_vm(p: ProxmoxAPI, node: str, kind: str, vmid: str, action: str):
Dynamic attribute access via getattr()
Low
- Category
- Dangerous Code Execution
- Confidence
- 50% confidence
- Finding
Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.
- Content
python return p.cluster.resources.get(type="vm") def status_current(p: ProxmoxAPI, node: str, kind: str, vmid: str): endpoint = getattr(p.nodes(node), kind) return endpoint(vmid).status.current.get() def action_vm(p: ProxmoxAPI, node: str, kind: str, vmid: str, action: str):
Dynamic attribute access via getattr()
Low
- Category
- Dangerous Code Execution
- Confidence
- 50% confidence
- Finding
Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.
- Content
python return p.cluster.resources.get(type="vm") def status_current(p: ProxmoxAPI, node: str, kind: str, vmid: str): endpoint = getattr(p.nodes(node), kind) return endpoint(vmid).status.current.get() def action_vm(p: ProxmoxAPI, node: str, kind: str, vmid: str, action: str):
Dynamic attribute access via getattr()
Low
- Category
- Dangerous Code Execution
- Confidence
- 50% confidence
- Finding
Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.
- Content
python return p.cluster.resources.get(type="vm") def status_current(p: ProxmoxAPI, node: str, kind: str, vmid: str): endpoint = getattr(p.nodes(node), kind) return endpoint(vmid).status.current.get() def action_vm(p: ProxmoxAPI, node: str, kind: str, vmid: str, action: str):
Dynamic attribute access via getattr()
Low
- Category
- Dangerous Code Execution
- Confidence
- 50% confidence
- Finding
Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.
- Content
python return p.cluster.resources.get(type="vm") def status_current(p: ProxmoxAPI, node: str, kind: str, vmid: str): endpoint = getattr(p.nodes(node), kind) return endpoint(vmid).status.current.get() def action_vm(p: ProxmoxAPI, node: str, kind: str, vmid: str, action: str):
Dynamic attribute access via getattr()
Low
- Category
- Dangerous Code Execution
- Confidence
- 50% confidence
- Finding
Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.
- Content
python return p.cluster.resources.get(type="vm") def status_current(p: ProxmoxAPI, node: str, kind: str, vmid: str): endpoint = getattr(p.nodes(node), kind) return endpoint(vmid).status.current.get() def action_vm(p: ProxmoxAPI, node: str, kind: str, vmid: str, action: str):
Dynamic attribute access via getattr()
Low
- Category
- Dangerous Code Execution
- Confidence
- 77% confidence
- Finding
This line dynamically invokes an action method on the guest status object using unvalidated input. If the callable surface exposed by proxmoxer changes or includes additional state-changing methods, an attacker or mistaken caller could trigger unintended operations beyond the documented start/stop/reboot/shutdown set, which is especially risky in an infrastructure-management skill.
- Content
python def action_vm(p: ProxmoxAPI, node: str, kind: str, vmid: str, action: str): endpoint = getattr(p.nodes(node), kind) return getattr(endpoint(vmid).status, action).post() def snapshot_vm(p: ProxmoxAPI, node: str, kind: str, vmid: str, snapname: str, vmstate: bool = False): endpoint = getattr(p.nodes(node), kind)
Static analysis
No suspicious patterns detected.