Security audit

Proxmox Create Vm

Security checks across malware telemetry and agentic risk

Overview

This Proxmox automation is mostly transparent, but it gives an agent powerful infrastructure control with unguarded permanent deletion commands and avoidable password exposure.

Install only if you intentionally want an agent to administer a Proxmox host. Use it on explicitly approved hosts, review every generated command before execution, avoid passing real passwords as command-line arguments, prefer SSH keys or throwaway credentials, and do not run the destroy helper unless you have independently verified the host, resource ID, resource name, and backups.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Description-Behavior Mismatch

Low

Confidence: 88% confidence
Finding: Including stop-and-destroy teardown commands in a creation-focused skill creates a real risk of accidental data loss or misuse, especially if an agent treats all documented actions as acceptable follow-on steps. In infrastructure contexts, permanent deletion commands are sensitive because they can remove running services and attached state irreversibly.

Intent-Code Divergence

Medium

Confidence: 84% confidence
Finding: The workflow computes NEXT_CTID but uses $CTID in the create command, creating a discrepancy that can cause ID collisions or unintended reuse if CTID is unset or provided incorrectly. In a Proxmox environment, this can lead to failed deployments or accidental operations on the wrong resource identifier, especially in automated runs.

Description-Behavior Mismatch

High

Confidence: 95% confidence
Finding: The skill advertises creation of Proxmox containers/VMs, but this file provides irreversible destruction capability as well. In an agent-executed context, hidden or out-of-scope destructive operations materially increase the risk of accidental or unauthorized deletion of infrastructure, especially because the target host and ID are passed directly at runtime and the command purges resources.

Vague Triggers

Medium

Confidence: 76% confidence
Finding: The invocation conditions are broad enough that the skill could be selected in unintended contexts, increasing the chance that infrastructure-affecting shell commands are run when the user did not intend provisioning. Because this skill manages Proxmox resources and installs software, accidental activation has meaningful operational and security consequences.

Missing User Warnings

High

Confidence: 94% confidence
Finding: The teardown section contains permanent deletion commands with --purge but does not prominently warn about irreversible data loss or require confirmation. This is dangerous in an infrastructure skill because an operator or agent may execute the commands as routine cleanup, destroying active workloads and their storage.

Missing User Warnings

Medium

Confidence: 99% confidence
Finding: The script accepts a password as a positional argument, embeds it in an SSH command, and prints it back to stdout at the end. This can leak credentials through shell history, process listings, terminal logs, CI job output, and remote command auditing on the Proxmox host, making VM credentials recoverable by other users or logging systems.

Missing User Warnings

High

Confidence: 98% confidence
Finding: The script performs immediate destructive actions over SSH with no interactive confirmation, dry-run mode, safeguard prompt, or secondary validation that the selected ID is the intended target. Because it issues stop and destroy commands with --purge, a mistaken invocation or coerced agent action can permanently remove a VM/container and associated state.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.