Proxmox

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:51 AM UTC
• Version: 1.0.0

Overview

This Proxmox management skill is mostly coherent, but it gives broad infrastructure control while weakening credential and TLS safety.

Review before installing. Use only with least-privileged Proxmox API tokens, avoid production tokens until TLS verification is fixed, prefer a secret manager or tightly controlled credential handling, and require explicit confirmation before any start, stop, reboot, rollback, delete, or backup action.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/pve.sh:16

Finding

TLS Certificate Verification Disabled for Authenticated Proxmox API Requests

Content

View full analysis

Vulnerability Details

File Location: scripts/pve.sh:16-20
Related Documentation: SKILL.md:42-133,148
Vulnerability Type: Improper TLS certificate validation
Risk Level: High

Vulnerable Code

bash

api() {
    local method="${1:-GET}"
    local endpoint="$2"
    shift 2
    curl -ks -X "$method" -H "$AUTH" "$PROXMOX_HOST/api2/json$endpoint" "$@"
}

The documentation also recommends this insecure configuration:

markdown

- Use `-k` to skip SSL verification for self-signed certs

Technical Analysis

The -k option instructs curl to accept a TLS certificate without verifying its authenticity. This option is applied to every API request, including requests carrying the reusable Proxmox API token in the Authorization header.

Encryption without certificate verification does not establish that the client is communicating with the intended Proxmox server. An attacker in a network interception position can present an arbitrary certificate, terminate the TLS connection, and read the authorization token and API traffic. The attacker can also return forged API responses.

Because the behavior is unconditional, users cannot obtain secure certificate validation without modifying the script.

Attack Path

1. A user configures a valid Proxmox host and API token and invokes pve.sh.
2. An attacker obtains a network interception position, such as through a compromised gateway, malicious access point, DNS manipulation, or local network spoofing.
3. The attacker redirects or intercepts the connection to the configured Proxmox endpoint.
4. The attacker presents an untrusted TLS certificate.
5. The script accepts the certificate because curl -k disables verification.
6. The script sends the Proxmox API token in the Authorization header to the attacker-controlled endpoint.
7. The attacker reuses the captured token against the real Proxmox API, subject to the permissio ...[truncated 692 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the -k option and require certificate validation by default:

   bash

   curl -sS -X "$method" \
       -H "$AUTH" \
       "$PROXMOX_HOST/api2/json$endpoint" \
       "$@"
   

2. For a private or self-signed Proxmox certificate, configure an explicit trusted CA certificate:

   bash

   curl -sS --cacert "$PROXMOX_CA_FILE" \
       -X "$method" \
       -H "$AUTH" \
       "$PROXMOX_HOST/api2/json$endpoint" \
       "$@"
   

3. Alternatively, install the internal CA in the operating system trust store so normal TLS verification succeeds.

4. Update SKILL.md to recommend trusting the Proxmox CA rather than disabling verification.

5. If an insecure compatibility mode is essential, make it an explicit opt-in setting, display a prominent warning, and prohibit its use in production.

6. Rotate any API tokens that may previously have been sent over connections where certificate verification was disabled.

7. Assign tokens only the minimum privileges needed for intended operations.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/pve.sh:7

Finding

Credential File Is Executed as Arbitrary Shell Code

Content

View full analysis

Vulnerability Details

File Location: scripts/pve.sh:7-9
Vulnerability Type: Unsafe execution of configuration data
Risk Level: Medium

Vulnerable Code

bash

# Load credentials
if [[ -f ~/.proxmox-credentials ]]; then
    source ~/.proxmox-credentials
fi

Technical Analysis

Bash source does not parse a credentials-only data format. It executes the complete contents of the specified file in the current shell process. Consequently, command substitutions, function definitions, redirections, shell commands, and other executable syntax placed in ~/.proxmox-credentials run automatically whenever the helper starts.

The documentation recommends chmod 600, but the script does not enforce the file's owner, permissions, type, or syntax. The -f test follows symbolic links and only verifies that the resolved path is a regular file. It does not establish that the file is trusted.

This creates a local code-execution boundary wherever another process or account can create, replace, or modify the credential file, its symlink target, or the user's home-directory state.

Attack Path

1. An attacker gains the ability to modify or replace ~/.proxmox-credentials. This may result from incorrect permissions, a compromised process running as the user, an unsafe provisioning workflow, or manipulation of the user's home-directory files.

2. The attacker inserts shell code into the file, for example:

   bash

   PROXMOX_HOST=https://proxmox.example:8006
   PROXMOX_TOKEN_ID=user@pam!token
   PROXMOX_TOKEN_SECRET=secret
   malicious_command
   

3. The user invokes any pve.sh command.

4. Bash evaluates the file through source before validating the expected environment variables.

5. The injected command executes with the identity and environment of the user running the helper.

Impact Assessment

Successful exploitation provides arbitrary command execution with the privileges o ...[truncated 628 chars]

Remediation

View remediation

Remediation Suggestions

1. Do not use source to load credential data.
2. Store credentials in a non-executable format such as JSON and parse only explicitly allowed fields with a data parser.
3. If a key-value format must be supported, implement a strict parser that:
   • Accepts only PROXMOX_HOST, PROXMOX_TOKEN_ID, and PROXMOX_TOKEN_SECRET.
   • Rejects unknown keys and malformed lines.
   • Does not evaluate variable expansion, command substitution, quoting syntax, or shell operators.
4. Before reading the file, use lstat or equivalent checks to reject symbolic links and non-regular files.
5. Verify that the credential file is owned by the invoking user and is not accessible by group or other users.
6. Prefer an operating-system secret store or dedicated secret-management service where available.
7. Keep Proxmox API tokens least-privileged and rotate them if the credential file may have been exposed or modified.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (8)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 87% confidence

Finding

The skill shows direct interpolation of user-controlled placeholders such as {node}, {vmid}, and {storage} into shell/API operations for infrastructure backup actions, without any validation guidance. In an agent context, unvalidated parameters can trigger unauthorized backups, target the wrong assets, or enable command/API misuse when combined with shell execution patterns.

Content

Scanner excerpt · SKILL.md (reported line 129)May include surrounding context.

curl -ks -H "$AUTH" "$PROXMOX_HOST/api2/json/nodes/{node}/storage/{storage}/content?content=backup" | jq

Start backup

curl -ks -X POST -H "$AUTH" "$PROXMOX_HOST/api2/json/nodes/{node}/vzdump"
-d "vmid={vmid}" -d "storage={storage}" -d "mode=snapshot"

text

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill exposes shell-based operational capability against Proxmox but does not declare any tool scope or execution constraints. That increases the risk that an agent can invoke powerful infrastructure-management commands without explicit permission boundaries or policy review.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 82% confidence

Finding

The skill instructs users to persist API credentials in environment variables or a file under the home directory, creating session persistence of sensitive management access. Persistent credentials for infrastructure APIs increase the blast radius of host compromise, shell history leakage, or accidental reuse by other processes.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: proxmox
description: Manage Proxmox VE clusters via REST API. Use when user asks to list, start, stop, restart VMs or LXC containers, check node status, create snapshots, view tasks, or manage Proxmox infrastructure. Requires API token or credentials configured.
---

# Proxmox VE Management

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 24)May include surrounding context.

PROXMOX_TOKEN_ID=user@pam!monitoring PROXMOX_TOKEN_SECRET=your-token-secret EOF chmod 600 ~/.proxmox-credentials

text

Create API token in Proxmox: Datacenter → Permissions → API Tokens → Add

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This section documents destructive actions such as stop, reboot, rollback, delete snapshot, and backup initiation without requiring user confirmation, impact warnings, or guardrails. In an agent setting, that can normalize unsafe execution and lead to outages or irreversible state changes from ambiguous prompts.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 92)May include surrounding context.

md

curl -ks -H "$AUTH" "$PROXMOX_HOST/api2/json/nodes/{node}/qemu/{vmid}/snapshot" | jq

# Create snapshot
curl -ks -X POST -H "$AUTH" "$PROXMOX_HOST/api2/json/nodes/{node}/qemu/{vmid}/snapshot" \
  -d "snapname=snap1" -d "description=Before update"

# Rollback

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 129)May include surrounding context.

curl -ks -H "$AUTH" "$PROXMOX_HOST/api2/json/nodes/{node}/storage/{storage}/content?content=backup" | jq

Start backup

curl -ks -X POST -H "$AUTH" "$PROXMOX_HOST/api2/json/nodes/{node}/vzdump"
-d "vmid={vmid}" -d "storage={storage}" -d "mode=snapshot"

text

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/pve.sh (reported line 137)May include surrounding context.

sh

stop <vmid>         Force stop VM/LXC
  shutdown <vmid>     Graceful shutdown VM/LXC
  reboot <vmid>       Reboot VM/LXC
  snap <vmid> [name]  Create snapshot
  snapshots <vmid>    List snapshots
  tasks <node>        Show recent tasks
  storage <node>      Show storage status

Static analysis

No suspicious patterns detected.