Security audit

Proxmox

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed Proxmox management connector, but it deserves review because it can change or delete VMs with an API token while its registry/OpenClaw metadata understates those privileges.

Install only if you intentionally want an agent to manage Proxmox. Start with a read-only, least-privilege API token, keep destructive operations and insecure TLS disabled unless specifically needed, pin the package version, and manually review any write or delete action.

VirusTotal

VirusTotal engine telemetry is currently stale for this artifact.

View on VirusTotal

Static analysis

Detected: suspicious.env_credential_access, suspicious.insecure_tls_verification

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: dist/index.js:412
Evidence: function assertEnvFlag(envKey, toolName, env = process.env) {

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: dist/mcp-server.js:414
Evidence: function assertEnvFlag(envKey, toolName, env = process.env) {

HTTPS certificate verification is disabled.

Warn

Code: suspicious.insecure_tls_verification
Location: dist/index.js:54
Evidence: this.dispatcher = new UndiciAgent({ connect: { rejectUnauthorized: false } });

HTTPS certificate verification is disabled.

Warn

Code: suspicious.insecure_tls_verification
Location: dist/mcp-server.js:56
Evidence: this.dispatcher = new UndiciAgent({ connect: { rejectUnauthorized: false } });