ClawHub
Back to skill

Security audit

proxmox-aiops

Security checks across malware telemetry and agentic risk

Overview

This Proxmox administration skill is openly for real VM and cluster operations, but it combines high-impact write access with inconsistent credential-storage guidance that users should review before installing.

Review this before installing on any production Proxmox environment. Use a dedicated least-privilege API token, avoid password auth when possible, protect ~/.proxmox-aiops/.env if you use it, and verify whether your installed proxmox-aiops version actually uses encrypted secrets or plaintext .env files. Treat MCP write access as capable of stopping, deleting, rolling back, restoring, or migrating VMs according to the permissions of the connected Proxmox account.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (7)

Intent-Code Divergence

Medium
Confidence
96% confidence
Finding
The documentation presents contradictory credential-handling models: it claims an encrypted secret store via `init`/`secret set`, while elsewhere it instructs users to place Proxmox secrets in `~/.proxmox-aiops/.env`. This inconsistency can cause operators to store high-value Proxmox API tokens or passwords in plaintext on disk under a false assumption that secrets are encrypted, increasing the chance of credential disclosure through local compromise, backups, or accidental file exposure.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The capabilities document advertises destructive write operations such as VM delete, stop, migrate, and rollback-adjacent lifecycle actions without a prominent caution section describing operator confirmation expectations, blast radius, or irreversible outcomes. In an agent skill for live Proxmox administration, this omission increases the chance that an upstream agent or user will invoke high-risk actions with insufficient friction, leading to outages or accidental data loss.

Missing User Warnings

High
Confidence
97% confidence
Finding
Snapshot rollback and backup restore are specifically dangerous because they can discard newer guest state or overwrite an existing VM, yet the document only notes risk in passing and does not present strong user-facing warnings or confirmation requirements. In the Proxmox context, these operations can cause permanent application/data inconsistency, service interruption, and unrecoverable loss if an agent executes them based on ambiguous intent.

Credential Access

High
Category
Privilege Escalation
Content
argument-hint: "[vmid or describe your Proxmox task]"
allowed-tools:
  - Bash
metadata: {"openclaw":{"requires":{"env":["PROXMOX_AIOPS_CONFIG"],"bins":["proxmox-aiops"],"config":["~/.proxmox-aiops/config.yaml","~/.proxmox-aiops/.env"]},"optional":{"env":["PROXMOX_TARGET_SECRET"]},"primaryEnv":"PROXMOX_AIOPS_CONFIG","homepage":"https://github.com/AIops-tools/Proxmox-AIops","emoji":"🧱","os":["macos","linux"]}}
compatibility: >
  Standalone, self-governed Proxmox VE operations. The governance harness (audit, token/runaway budget, undo, risk-tier labels) is bundled in the package — no external skill-family dependency.
  All write operations are audited to a local SQLite DB under ~/.proxmox-aiops/ (relocatable via PROXMOX_AIOPS_HOME).
Confidence
91% confidence
Finding
The skill explicitly depends on a local secrets file `~/.proxmox-aiops/.env`, indicating that Proxmox credentials are expected to be present and accessible to the tool. In a skill that can perform destructive VM, backup, snapshot, and cluster operations, access to these credentials materially increases the blast radius if the host, toolchain, or surrounding agent environment is compromised.

Credential Access

High
Category
Privilege Escalation
Content
compatibility: >
  Standalone, self-governed Proxmox VE operations. The governance harness (audit, token/runaway budget, undo, risk-tier labels) is bundled in the package — no external skill-family dependency.
  All write operations are audited to a local SQLite DB under ~/.proxmox-aiops/ (relocatable via PROXMOX_AIOPS_HOME).
  Credentials: Each Proxmox target requires a per-target secret env var in ~/.proxmox-aiops/.env following the pattern PROXMOX_<TARGET_NAME_UPPER>_SECRET (API token UUID for token auth, or login password). Secrets are never logged or echoed; .env should be chmod 600.
  Destructive operations (vm stop/delete/snapshot-delete/snapshot-rollback, ct stop) require double confirmation at the CLI layer and support --dry-run. All write tools pass through the @governed_tool decorator (budget guard + audit + risk-tier tagging). Reversible writes record an inverse undo descriptor to the undo store.
  Webhooks: none — no outbound network calls beyond the configured Proxmox API endpoint.
  SSL: verify_ssl defaults to true; disable only for self-signed lab certificates.
Confidence
95% confidence
Finding
This is substantively the same issue as the other line-25 PE3 finding: the skill documents local plaintext storage of Proxmox secrets in `.env`. Because the skill's purpose is direct management of Proxmox VMs and containers, exposed credentials could permit unauthorized power operations, reconfiguration, deletion, migration, restore, or broader cluster access depending on token scope.

Credential Access

High
Category
Privilege Escalation
Content
compatibility: >
  Standalone, self-governed Proxmox VE operations. The governance harness (audit, token/runaway budget, undo, risk-tier labels) is bundled in the package — no external skill-family dependency.
  All write operations are audited to a local SQLite DB under ~/.proxmox-aiops/ (relocatable via PROXMOX_AIOPS_HOME).
  Credentials: Each Proxmox target requires a per-target secret env var in ~/.proxmox-aiops/.env following the pattern PROXMOX_<TARGET_NAME_UPPER>_SECRET (API token UUID for token auth, or login password). Secrets are never logged or echoed; .env should be chmod 600.
  Destructive operations (vm stop/delete/snapshot-delete/snapshot-rollback, ct stop) require double confirmation at the CLI layer and support --dry-run. All write tools pass through the @governed_tool decorator (budget guard + audit + risk-tier tagging). Reversible writes record an inverse undo descriptor to the undo store.
  Webhooks: none — no outbound network calls beyond the configured Proxmox API endpoint.
  SSL: verify_ssl defaults to true; disable only for self-signed lab certificates.
Confidence
95% confidence
Finding
This is substantively the same issue as the other line-25 PE3 finding: the skill documents local plaintext storage of Proxmox secrets in `.env`. Because the skill's purpose is direct management of Proxmox VMs and containers, exposed credentials could permit unauthorized power operations, reconfiguration, deletion, migration, restore, or broader cluster access depending on token scope.

Session Persistence

Medium
Category
Rogue Agent
Content
proxmox-aiops storage list [--node <n>]
proxmox-aiops diagnose node-pressure                  # rank nodes by CPU/mem/disk pressure (read-only RCA)
proxmox-aiops diagnose guest-health                   # stopped guests, mem saturation, disks near full
proxmox-aiops undo apply <id>                         # reverse a recorded governed write
proxmox-aiops init                                    # onboarding wizard (encrypted creds)
proxmox-aiops secret set <target>                     # manage encrypted secret store
proxmox-aiops doctor
Confidence
84% confidence
Finding
The CLI advertises an onboarding wizard and secret-management commands for an 'encrypted secret store' immediately adjacent to other documentation that still relies on `.env` files for secrets. That inconsistency can lead to long-lived credential persistence in weaker storage than users expect, especially for a tool controlling critical virtualization infrastructure.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.prompt_injection_instructions

Prompt-injection style instruction pattern detected.

Warn
Code
suspicious.prompt_injection_instructions
Location
references/agent-guardrails.md:25