proxmox-aiops

• Outcome: Review
• Latest audit: Oct 15, 2026 · 9:38 AM UTC
• Version: 0.15.0

Overview

The skill is openly Proxmox-focused, but it exposes write-capable MCP tools that can change or delete infrastructure without its own approval gate.

Review carefully before installing in production. Use a dedicated least-privilege Proxmox API token, prefer read-only permissions unless writes are required, protect `~/.proxmox-aiops/`, avoid broad `root@pam` credentials, and require an external approval workflow before allowing MCP write tools against important workloads.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:207

Finding

Destructive MCP operations lack an enforced approval gate

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 207–219
Vulnerability Type: Missing authorization enforcement for destructive MCP operations
Risk Level: High

Evidence:

text

The skill delivers reads and writes and records them; it does **not** decide whether a write is
permitted. That is your agent's judgement, or the permission of the account you connect it with —
use a Proxmox VE user or API token granted only read privileges (no VM.*/Datastore.* write roles),
and writes then fail at the server. There is no read-only switch, policy file, or approval gate.

- **Audit is the guarantee, and it is not bypassable.** Every operation — MCP and CLI alike — is logged to `~/.proxmox-aiops/audit.db` (relocatable via `PROXMOX_AIOPS_HOME`): params, result, status, duration, and the risk tier. The CLI writes the same row the MCP path does.
- `PROXMOX_AUDIT_APPROVED_BY` / `PROXMOX_AUDIT_RATIONALE` are optional annotations recorded on the audit row (who/why); they are never required and never block.
- **Runaway guard** — a safety backstop, not authorization: the same call looped in a tight window trips a circuit breaker. Disable with `PROXMOX_RUNAWAY_MAX=0`; optional hard ceilings via `PROXMOX_MAX_TOOL_CALLS` / `PROXMOX_MAX_TOOL_SECONDS`.
- Undo store records inverse descriptors for reversible writes (start/stop/shutdown/reconfigure/clone/migrate/snapshot-create, container start/stop).
- Writes support `--dry-run` / `dry_run=True` and double confirmation at the CLI.

Technical Analysis

The Skill exposes MCP write operations capable of changing or destroying Proxmox resources, while explicitly stating that it has no read-only mode, policy file, or approval gate. Double confirmation is limited to the CLI layer; the documented MCP path has no equivalent mandatory approval control.

Consequently, a model-generated MCP call can cross from an agent session into privileged Proxmox infrastructure without an in ...[truncated 2115 chars]

Remediation

View remediation

Remediation Suggestions

1. Default the MCP interface to read-only and require an explicit configuration option to enable writes.
2. Require a short-lived, operation-bound approval token for high-risk MCP operations. Bind it to the exact target, action, and parameters.
3. Enforce a two-stage workflow for destructive actions: mandatory dry-run preview followed by explicit approval of the previewed operation.
4. Add configurable operation, target, node, storage, pool, and VM allowlists.
5. Require stronger confirmation for irreversible operations such as VM deletion, snapshot rollback, and forced restore.
6. Keep audit logging and risk labels, but treat them as supplementary controls rather than authorization mechanisms.
7. Reject high-risk MCP writes when approval metadata is absent instead of treating approval fields as optional annotations.
8. Continue recommending dedicated least-privilege Proxmox tokens so compromise or erroneous invocation is limited to the minimum required resource scope.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (16)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 87% confidence

Finding

The skill explicitly relies on local secret material stored in ~/.proxmox-aiops/.env and exposes secret-management commands. In the context of a skill that can perform powerful Proxmox administrative actions, any weakness in handling, logging, or local file protections around those credentials can lead to full infrastructure compromise through credential theft or reuse.

Content

Scanner excerpt · SKILL.md (reported line 25)May include surrounding context.

md

compatibility: >
  Standalone, self-governed Proxmox VE operations. The governance harness (audit, token/runaway budget, undo, risk-tier labels) is bundled in the package — no external skill-family dependency.
  All write operations are audited to a local SQLite DB under ~/.proxmox-aiops/ (relocatable via PROXMOX_AIOPS_HOME).
  Credentials: Each Proxmox target requires a per-target secret env var in ~/.proxmox-aiops/.env following the pattern PROXMOX_<TARGET_NAME_UPPER>_SECRET (API token UUID for token auth, or login password). Secrets are never logged or echoed; .env should be chmod 600.
  Destructive operations (vm stop/delete/snapshot-delete/snapshot-rollback, ct stop) require double confirmation at the CLI layer and support --dry-run. All write tools pass through the @governed_tool decorator (budget guard + audit + risk-tier tagging). Reversible writes record an inverse undo descriptor to the undo store.
  Webhooks: none — no outbound network calls beyond the configured Proxmox API endpoint.
  SSL: verify_ssl defaults to true; disable only for self-signed lab certificates.

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documentation states that secrets are never logged or echoed, while elsewhere claiming every operation logs parameters and results to the audit database. If secret-management commands or auth-bearing parameters are not explicitly redacted, credentials may be written to local audit logs, creating a durable source of credential exposure.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 82% confidence

Finding

The setup guide directs users to store a highly privileged Proxmox API token or password in a plaintext .env file. Although file permissions are restricted, plaintext secrets on disk remain recoverable by the local user, malware running as that user, backups, shell tooling, or accidental exfiltration; in this skill's context those credentials can enable powerful VM and cluster operations.

Content

Scanner excerpt · references/setup-guide.md (reported line 37)May include surrounding context.

The secret variable is PROXMOX_<TARGET_NAME_UPPER>_SECRET (hyphens → underscores).

bash

chmod 600 ~/.proxmox-aiops/.env
proxmox-aiops doctor          # verifies connectivity + credentials

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 84% confidence

Finding

Persistent local audit logging under ~/.proxmox-aiops/ creates a durable record of sensitive operational activity. In a Proxmox administration skill, those records may include hostnames, VM identifiers, task IDs, topology, and possibly action parameters that aid lateral movement or disclose sensitive infrastructure state if the local machine is compromised.

Content

Scanner excerpt · SKILL.md (reported line 24)May include surrounding context.

md

metadata: {"openclaw":{"requires":{"anyBins":["proxmox-aiops","uvx"]},"optional":{"env":["PROXMOX_AIOPS_CONFIG","PROXMOX_TARGET_SECRET"]},"homepage":"https://github.com/AIops-tools/Proxmox-AIops","emoji":"🧱","os":["macos","linux"]}}
compatibility: >
  Standalone, self-governed Proxmox VE operations. The governance harness (audit, token/runaway budget, undo, risk-tier labels) is bundled in the package — no external skill-family dependency.
  All write operations are audited to a local SQLite DB under ~/.proxmox-aiops/ (relocatable via PROXMOX_AIOPS_HOME).
  Credentials: Each Proxmox target requires a per-target secret env var in ~/.proxmox-aiops/.env following the pattern PROXMOX_<TARGET_NAME_UPPER>_SECRET (API token UUID for token auth, or login password). Secrets are never logged or echoed; .env should be chmod 600.
  Destructive operations (vm stop/delete/snapshot-delete/snapshot-rollback, ct stop) require double confirmation at the CLI layer and support --dry-run. All write tools pass through the @governed_tool decorator (budget guard + audit + risk-tier tagging). Reversible writes record an inverse undo descriptor to the undo store.
  Webhooks: none — no outbound network calls beyond the configured Proxmox API endpoint.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 25)May include surrounding context.

md

compatibility: >
  Standalone, self-governed Proxmox VE operations. The governance harness (audit, token/runaway budget, undo, risk-tier labels) is bundled in the package — no external skill-family dependency.
  All write operations are audited to a local SQLite DB under ~/.proxmox-aiops/ (relocatable via PROXMOX_AIOPS_HOME).
  Credentials: Each Proxmox target requires a per-target secret env var in ~/.proxmox-aiops/.env following the pattern PROXMOX_<TARGET_NAME_UPPER>_SECRET (API token UUID for token auth, or login password). Secrets are never logged or echoed; .env should be chmod 600.
  Destructive operations (vm stop/delete/snapshot-delete/snapshot-rollback, ct stop) require double confirmation at the CLI layer and support --dry-run. All write tools pass through the @governed_tool decorator (budget guard + audit + risk-tier tagging). Reversible writes record an inverse undo descriptor to the undo store.
  Webhooks: none — no outbound network calls beyond the configured Proxmox API endpoint.
  SSL: verify_ssl defaults to true; disable only for self-signed lab certificates.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 194)May include surrounding context.

md

compatibility: >
  Standalone, self-governed Proxmox VE operations. The governance harness (audit, token/runaway budget, undo, risk-tier labels) is bundled in the package — no external skill-family dependency.
  All write operations are audited to a local SQLite DB under ~/.proxmox-aiops/ (relocatable via PROXMOX_AIOPS_HOME).
  Credentials: Each Proxmox target requires a per-target secret env var in ~/.proxmox-aiops/.env following the pattern PROXMOX_<TARGET_NAME_UPPER>_SECRET (API token UUID for token auth, or login password). Secrets are never logged or echoed; .env should be chmod 600.
  Destructive operations (vm stop/delete/snapshot-delete/snapshot-rollback, ct stop) require double confirmation at the CLI layer and support --dry-run. All write tools pass through the @governed_tool decorator (budget guard + audit + risk-tier tagging). Reversible writes record an inverse undo descriptor to the undo store.
  Webhooks: none — no outbound network calls beyond the configured Proxmox API endpoint.
  SSL: verify_ssl defaults to true; disable only for self-signed lab certificates.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/setup-guide.md (reported line 60)May include surrounding context.

md

compatibility: >
  Standalone, self-governed Proxmox VE operations. The governance harness (audit, token/runaway budget, undo, risk-tier labels) is bundled in the package — no external skill-family dependency.
  All write operations are audited to a local SQLite DB under ~/.proxmox-aiops/ (relocatable via PROXMOX_AIOPS_HOME).
  Credentials: Each Proxmox target requires a per-target secret env var in ~/.proxmox-aiops/.env following the pattern PROXMOX_<TARGET_NAME_UPPER>_SECRET (API token UUID for token auth, or login password). Secrets are never logged or echoed; .env should be chmod 600.
  Destructive operations (vm stop/delete/snapshot-delete/snapshot-rollback, ct stop) require double confirmation at the CLI layer and support --dry-run. All write tools pass through the @governed_tool decorator (budget guard + audit + risk-tier tagging). Reversible writes record an inverse undo descriptor to the undo store.
  Webhooks: none — no outbound network calls beyond the configured Proxmox API endpoint.
  SSL: verify_ssl defaults to true; disable only for self-signed lab certificates.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 88% confidence

Finding

The undo store records inverse descriptors for prior administrative actions, which necessarily preserves historical state and operational context. Those persisted descriptors can reveal previous VM configuration, source storage, node placement, or other sensitive recovery metadata that would be useful to an attacker and may also enable unintended replays if access controls are weak.

Content

Scanner excerpt · SKILL.md (reported line 152)May include surrounding context.

md

| Undo | `undo_list` | Read |
| | `undo_apply` | Write |

**Harness features that light up**: write tools with a clean inverse (`vm_start`/`vm_stop`/`vm_shutdown`/`vm_reconfigure`/`vm_clone`/`vm_migrate`/`vm_snapshot_create`/`vm_move_disk`/`ct_start`/`ct_stop`) pass an `undo=` lambda so the harness records an inverse descriptor (with `_undo_id`) to the undo store — `vm_reconfigure` captures the prior cores/memory, `vm_clone`'s inverse is `vm_delete(newid)`, `vm_migrate`'s is migrate-back, `vm_move_disk`'s is move-back to the captured source storage. `backup_restore` records a `vm_delete` inverse **only** when it restored into a free VMID (a forced overwrite is destructive and declares none). Irreversible writes (`vm_delete`, `vm_snapshot_rollback`, `backup_restore` with `force`) declare no undo and are tagged `risk_level=high`; `vm_resize_disk` is grow-only and refuses shrink before any API call. All 43 tools are audit-logged under `~/.proxmox-aiops/` and pass through the budget/runaway guard + risk-tier tagging. Proxmox writes are async (return a task UPID) — poll with `task_status` (and read lines with `task_log`) instead of re-issuing (the runaway breaker backs this up).

## CLI Quick Reference

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 180)May include surrounding context.

md

proxmox-aiops storage list [--node <n>]
proxmox-aiops diagnose node-pressure                  # rank nodes by CPU/mem/disk pressure (read-only RCA)
proxmox-aiops diagnose guest-health                   # stopped guests, mem saturation, disks near full
proxmox-aiops undo apply <id>                         # reverse a recorded governed write
proxmox-aiops init                                    # onboarding wizard (encrypted creds)
proxmox-aiops secret set <target>                     # manage encrypted secret store
proxmox-aiops doctor

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The skill manifest and high-level description emphasize Proxmox VM/container operations, but the documented CLI also exposes onboarding and secret-management commands. That mismatch can cause downstream policy engines or users to underestimate the skill's ability to manipulate credentials and local configuration, which expands the trust boundary beyond infrastructure operations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The capabilities document advertises multiple destructive and partially irreversible actions such as VM delete, snapshot rollback, disk moves, and restore overwrite, but does not present a clear caution/safety section describing operator confirmation requirements, preconditions, or failure consequences. In a Proxmox administration skill, this increases the chance that an agent or user treats high-risk operations as routine, leading to accidental outages, data loss, or rollback of newer state.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The CLI reference exposes a materially narrower set of capabilities than the skill manifest advertises, creating a documentation-to-behavior mismatch. In an infrastructure-management skill for Proxmox, this can cause operators or downstream agents to assume unsupported actions exist, improvise unsafe alternatives, or make governance decisions without visibility into real write-capable operations and safeguards.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/setup-guide.md (reported line 13)May include surrounding context.

Configure

bash

mkdir -p ~/.proxmox-aiops && chmod 700 ~/.proxmox-aiops

~/.proxmox-aiops/config.yaml (no secrets here):

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/setup-guide.md (reported line 13)May include surrounding context.

Configure

bash

mkdir -p ~/.proxmox-aiops && chmod 700 ~/.proxmox-aiops

~/.proxmox-aiops/config.yaml (no secrets here):

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/setup-guide.md (reported line 28)May include surrounding context.

verify_ssl: false # self-signed lab certs only; true in prod

text

`~/.proxmox-aiops/.env` (chmod 600 — secrets only):

```bash
PROXMOX_PVE_LAB_SECRET=<api-token-uuid-or-password>

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/setup-guide.md (reported line 37)May include surrounding context.

verify_ssl: false # self-signed lab certs only; true in prod

text

`~/.proxmox-aiops/.env` (chmod 600 — secrets only):

```bash
PROXMOX_PVE_LAB_SECRET=<api-token-uuid-or-password>

Static analysis

No suspicious patterns detected.