ClawHub
Back to skill

Security audit

Proxmox MCP for OpenClaw

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed Proxmox MCP installer that handles sensitive Proxmox credentials for its stated registration purpose, with no evidence of hidden exfiltration or destructive behavior.

Install only if you trust this Proxmox MCP release and are comfortable giving OpenClaw a Proxmox API token for ongoing MCP use. Prefer a least-privilege Proxmox token, review where your OpenClaw installation stores MCP environment variables, and remove the MCP registration if you no longer need it.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Description-Behavior Mismatch

Medium
Confidence
94% confidence
Finding
The installer passes PROXMOX_BASE_URL, PROXMOX_TOKEN_ID, and PROXMOX_TOKEN_SECRET to `openclaw mcp add --env`, which persists sensitive credentials into the MCP registration state rather than using them only transiently for installation. That expands the secret exposure surface to OpenClaw config, process history/logging, backups, and any user or process able to inspect MCP registrations, making compromise of the Proxmox API token more likely.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The code sends sensitive credentials to an external CLI without any user-facing warning, consent, or explanation of storage semantics. Even if OpenClaw is local, the CLI may store, echo, log, or later expose these values through configuration files or status commands, so silently forwarding an API token is a meaningful secret-handling flaw.

Static analysis

No suspicious patterns detected.