T09 · Insecure Skill Coding Practices
Error
- Location
scripts/pve.sh:15- Finding
TLS Certificate Verification Disabled for Authenticated Proxmox API Requests
- Content
View full analysis
- Remediation
View remediation
Security audit
Proxmox
Security checks for vulnerabilities and agentic risk
Overview
This Proxmox skill is coherent, but it needs review because it can immediately change VM state and handles admin API tokens in unsafe ways.
Install only if you are comfortable giving the agent operational control over Proxmox. Use a least-privilege, easily rotated API token; avoid curl -k except in a controlled test network; prefer environment or a real secret manager over sourcing ~/.proxmox-credentials; and require manual confirmation before stop, reboot, rollback, delete, snapshot, or backup actions.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/pve.sh:5- Finding
Credential File Is Executed as Arbitrary Shell Code
- Content
View full analysis
/dev/null ``` ### Technical Analysis The Bash `source` command does not parse the file as passive configuration data. It executes every command in the file within the current shell process. Although the documented file is expected to contain only these assignments: ```bash PROXMOX_HOST=https://192.168.1.100:8006 PROXMOX_TOKEN_ID=user@pam!monitoring PROXMOX_TOKEN_SECRET=your-token-secret ``` the implementation does not enforce that format. Shell commands, command substitutions, function definitions, redirections, and environment modifications placed in the file will execute before any Proxmox operation. The documented `chmod 600` recommendation reduces access by other local users but does not make sourcing safe. The script does not validate file ownership, reject symbolic links, verify permissions, or allowlist expected keys. Exploitation requires an attacker or compromised process to be able to create or modify the invoking user's `~/.proxmox-credentials` file or redirect it to attacker-controlled content. ### Attack Path 1. An attacker gains the ability to create, replace, or modify the victim's `~/.proxmox-credentials` file. This could occur through another compromised process, an unsafe provisioning workflow, a shared or improperly protected home directory, or a malicious downloaded credential file. 2. The attacker adds shell commands to the file, for example: ```bash PROXMOX_HOST=https://proxmox.example:8006 PROXMOX_TOKEN_ID=user@pam!token PROXMOX_TOKEN_SECRET=secret malicious_command ``` 3. The victim or an automation agent ...[truncated 956 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Rogue AgentSelf-Modification, Session Persistence
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (10)
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
The backup command interpolates user-supplied placeholders such as node, vmid, and storage into a shell/API invocation without any documented validation or allowlisting. In a privileged infrastructure-management skill, unchecked parameters can trigger unintended operations against the wrong workloads or storage targets and amplify damage from prompt or input manipulation.
- Content
curl -ks -H "$AUTH" "$PROXMOX_HOST/api2/json/nodes/{node}/storage/{storage}/content?content=backup" | jq
Start backup
curl -ks -X POST -H "$AUTH" "$PROXMOX_HOST/api2/json/nodes/{node}/vzdump"
-d "vmid={vmid}" -d "storage={storage}" -d "mode=snapshot"text
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 86% confidence
- Finding
The skill exposes shell-based operational capability but does not declare an explicit tool scope or permission boundary. That increases the chance an agent can invoke shell commands more broadly than intended when handling infrastructure-management requests, especially in a high-impact admin context like Proxmox.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 74% confidence
- Finding
The skill encourages persistent storage and reuse of long-lived Proxmox credentials via environment variables or a local credentials file. In an agent setting, session-persistent secrets raise the chance of unintended reuse, leakage into logs/history, or misuse across tasks beyond the original user intent.
- Content
md --- name: proxmox description: Manage Proxmox VE clusters via REST API. Use when user asks to list, start, stop, restart VMs or LXC containers, check node status, create snapshots, view tasks, or manage Proxmox infrastructure. Requires API token or credentials configured. --- # Proxmox VE Management
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
PROXMOX_TOKEN_ID=user@pam!monitoring PROXMOX_TOKEN_SECRET=your-token-secret EOF chmod 600 ~/.proxmox-credentials
text Create API token in Proxmox: Datacenter → Permissions → API Tokens → Add
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill documents stop, shutdown, reboot, rollback, delete snapshot, and backup-triggering operations without prominent warnings that they can disrupt running services or cause irreversible state changes. In infrastructure automation, omission of such guardrails materially increases the risk of accidental destructive actions by an agent or operator.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md curl -ks -H "$AUTH" "$PROXMOX_HOST/api2/json/nodes/{node}/qemu/{vmid}/snapshot" | jq # Create snapshot curl -ks -X POST -H "$AUTH" "$PROXMOX_HOST/api2/json/nodes/{node}/qemu/{vmid}/snapshot" \ -d "snapname=snap1" -d "description=Before update" # Rollback
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
curl -ks -H "$AUTH" "$PROXMOX_HOST/api2/json/nodes/{node}/storage/{storage}/content?content=backup" | jq
Start backup
curl -ks -X POST -H "$AUTH" "$PROXMOX_HOST/api2/json/nodes/{node}/vzdump"
-d "vmid={vmid}" -d "storage={storage}" -d "mode=snapshot"text
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The script exposes start, stop, shutdown, and reboot commands that directly change VM or container state via API POST requests. Although it prints a message after issuing each request, there is no confirmation prompt or advance warning before potentially disruptive operations such as stop, shutdown, or reboot.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
sh stop <vmid> Force stop VM/LXC shutdown <vmid> Graceful shutdown VM/LXC reboot <vmid> Reboot VM/LXC snap <vmid> [name] Create snapshot snapshots <vmid> List snapshots tasks <node> Show recent tasks storage <node> Show storage status
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
The snapshot command sends a POST request that creates a new snapshot, which alters VM/LXC state and can affect storage usage. The script reports success afterward, but it does not provide any warning or confirmation before performing the operation.
- Content
Static analysis
No suspicious patterns detected.