Proxmox Create Vm

• Outcome: Review
• Latest audit: Sep 14, 2026 · 9:38 PM UTC
• Version: 1.0.0

Overview

This skill appears intended for Proxmox automation, but it gives an agent high-impact root SSH provisioning and deletion workflows without enough guardrails.

Review carefully before installing. Use only against non-production Proxmox hosts or tightly controlled lab systems, and avoid letting an agent run the destroy script without explicit human confirmation. Prefer SSH keys or secret-manager input instead of password arguments, validate all IDs and names, pin and verify downloaded binaries, and use a restricted Proxmox account or API token where possible.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/create-lxc.sh:34

Finding

Root-Level Remote Command Injection Through Unvalidated Arguments

Content

View full analysis

/dev/null; pct destroy $ID --purge" elif [ "$TYPE" = "vm" ]; then ssh "$HOST" "qm stop $ID 2>/dev/null; qm destroy $ID --purge" ``` ```bash # scripts/find-ip.sh:11-14 if [ "$TYPE" = "lxc" ]; then IP=$(ssh "$HOST" "pct exec $ID -- hostname -I 2>/dev/null" | awk '{print $1}') elif [ "$TYPE" = "vm" ]; then IP=$(ssh "$HOST" "qm guest cmd $ID network-get-interfaces 2>/dev/null" | grep -oP '"ip-address"\s*:\s*"\K[0-9.]+' | head -1) ``` ```bash # scripts/post-boot-setup.sh:14-27 ssh "$HOST" "pct exec $CTID -- bash -c ' export DEBIAN_FRONTEND=noninteractive apt-get update -qq apt-get install -y -qq docker.io curl git htop $EXTRA '" ssh "$HOST" "pct exec $CTID -- bash -c ' systemctl enable docker systemctl start docker mkdir -p /usr/local/lib/docker/cli-plugins curl -SL https://github.com/docker/compose/releases/latest/download/docker-compose-linux-x86_64 -o /usr/local/lib/docker/cli-plugins/docker-compose chmod +x /usr/ ...[truncated 2597 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/create-vm.sh:3

Finding

VM Password Exposed Through Process Arguments and Console Output

Content

View full analysis

[cores] [ram-mb] [disk-gb] ``` ```bash # scripts/create-vm.sh:7-9 HOST="${1:?Usage: $0 [cores] [ram-mb] [disk-gb]}" NAME="${2:?Usage: $0 [cores] [ram-mb] [disk-gb]}" PASSWORD="${3:?Usage: $0 [cores] [ram-mb] [disk-gb]}" ``` ```bash # scripts/create-vm.sh:32-36 ssh "$HOST" "qm create $VMID --name $NAME --memory $RAM --cores $CORES \ --net0 virtio,bridge=vmbr0 --scsihw virtio-scsi-pci \ --scsi0 local-lvm:$DISK,format=raw --ide2 local-lvm:cloudinit \ --boot c --bootdisk scsi0 --serial0 socket --vga serial0 \ --ciuser deploy --cipassword '$PASSWORD' --ipconfig0 ip=dhcp" ``` ```bash # scripts/create-vm.sh:45-49 echo "" echo "=== VM Created ===" echo "Name: $NAME" echo "VMID: $VMID" echo "User: deploy / $PASSWORD" ``` ### Technical Analysis The VM password is accepted as the third command-line argument. Command-line arguments may be retained in shell history and can be exposed through process-inspection facilities while the script is running. The script then places the same plaintext credential into a remote command and explicitly prints it to standard output. Standard output may be captured by terminal scrollback, CI/CD logs, agent transcripts, centralized log collectors, or orchestration systems. Consequently, the password can remain exposed after provisioning has completed. The single quotes surrounding `$PASSWORD` in the remote command do not provide secure secret transport. A password containing a single quote can terminate the quoted value, cause provisioning failure, or contribute to the remote command-injection issue. ### Attack Path ...[truncated 1374 chars]

Remediation

View remediation

T03 · Remote Payload Retrieval and Execution

Warning

• Location: scripts/post-boot-setup.sh:20

Finding

Unpinned Docker Compose Binary Downloaded and Installed Without Integrity Verification

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (14)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence

Finding

The skill includes destructive teardown commands that stop and permanently destroy containers or VMs with --purge, but the high-level description focuses on creation and Docker readiness rather than destructive lifecycle management. Hidden or under-emphasized destructive capability is dangerous because an agent or operator may trigger the skill expecting safe provisioning behavior while actually being exposed to irreversible deletion commands.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill includes destructive teardown commands that stop and permanently destroy containers or VMs with --purge, but the high-level description focuses on creation and Docker readiness rather than destructive lifecycle management. Hidden or under-emphasized destructive capability is dangerous because an agent or operator may trigger the skill expecting safe provisioning behavior while actually being exposed to irreversible deletion commands.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill includes destructive teardown commands that stop and permanently destroy containers or VMs with --purge, but the high-level description focuses on creation and Docker readiness rather than destructive lifecycle management. Hidden or under-emphasized destructive capability is dangerous because an agent or operator may trigger the skill expecting safe provisioning behavior while actually being exposed to irreversible deletion commands.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The skill includes destructive teardown commands that stop and permanently destroy containers or VMs with --purge, but the high-level description focuses on creation and Docker readiness rather than destructive lifecycle management. Hidden or under-emphasized destructive capability is dangerous because an agent or operator may trigger the skill expecting safe provisioning behavior while actually being exposed to irreversible deletion commands.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

The skill includes destructive teardown commands that stop and permanently destroy containers or VMs with --purge, but the high-level description focuses on creation and Docker readiness rather than destructive lifecycle management. Hidden or under-emphasized destructive capability is dangerous because an agent or operator may trigger the skill expecting safe provisioning behavior while actually being exposed to irreversible deletion commands.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The script explicitly prints the provisioned VM username and password to stdout after creation. Standard output is frequently captured by terminals, shell scrollback, CI/CD logs, remote session recordings, and centralized logging, turning the VM's initial credential into broadly exposed plaintext. Because this skill creates network-accessible infrastructure, disclosure of that password can quickly lead to compromise of the new VM.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill is described as creation-focused, but this script enables irreversible destruction of Proxmox containers and VMs via SSH with purge flags. In an agentic context, exposing destructive infrastructure operations beyond the stated purpose increases the chance of accidental or unauthorized deletion, especially if the script is invoked with user-controlled host and ID values.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 97% confidence

Finding

The skill contains numerous shell commands that perform remote provisioning and teardown over SSH, but it declares no explicit tool scope such as allowed-tools or permissions. That omission weakens safety boundaries and can allow an agent to invoke powerful shell capabilities without a clear policy gate, which is especially risky for infrastructure automation that can create, modify, or destroy Proxmox resources.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The activation phrases are broad enough that a loosely matched request could trigger infrastructure provisioning actions on a Proxmox host. In this context, accidental invocation is materially dangerous because the skill performs privileged remote shell operations that create compute resources and could consume capacity or alter production-like infrastructure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The teardown section provides direct destructive commands for stopping and permanently destroying containers and VMs with purge, but offers no warning, safety checks, or confirmation guidance. In an automation setting, that creates a clear risk of irreversible resource deletion from operator error, prompt injection, or ambiguous tasking.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script requires a plaintext password as a positional command-line argument and then embeds it into a remote command for Proxmox cloud-init. Command-line arguments are commonly exposed through shell history, process listings, audit logs, and CI job logs, so this handling can leak credentials to local users or logging systems. In infrastructure automation that provisions reachable VMs, leaked initial credentials can directly enable unauthorized access.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 80% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 125)May include surrounding context.

md

echo "[2/3] Installing Docker Compose v2..."
ssh "$HOST" "pct exec $CTID -- bash -c '
  systemctl enable docker
  systemctl start docker
  mkdir -p /usr/local/lib/docker/cli-plugins
  curl -SL https://github.com/docker/compose/releases/latest/download/docker-compose-linux-x86_64 -o /usr/local/lib/docker/cli-plugins/docker-compose

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 80% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/post-boot-setup.sh (reported line 22)May include surrounding context.

sh

echo "[2/3] Installing Docker Compose v2..."
ssh "$HOST" "pct exec $CTID -- bash -c '
  systemctl enable docker
  systemctl start docker
  mkdir -p /usr/local/lib/docker/cli-plugins
  curl -SL https://github.com/docker/compose/releases/latest/download/docker-compose-linux-x86_64 -o /usr/local/lib/docker/cli-plugins/docker-compose

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The script downloads and installs an executable directly from a remote URL as root inside the container without any integrity verification, version pinning, or provenance checks. If the download source, DNS/TLS trust chain, or the 'latest' release reference is compromised, a malicious binary would be installed and later executed with elevated privileges in the target environment.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.