Proxy Aiops

• Outcome: Review
• Latest audit: Jul 20, 2026 · 4:37 AM UTC
• Version: 0.3.1

Overview

This skill is a clearly disclosed reverse-proxy operations tool with sensitive write abilities, but its authority is purpose-aligned and includes guardrails.

Install only if you intend to let an agent inspect and potentially change Traefik, Caddy, or HAProxy state. Start with PROXY_READ_ONLY=1, use dry-run for writes, protect PROXY_AIOPS_MASTER_PASSWORD as a secret, and review approver/rules settings before enabling production writes.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: This markdown file includes a concrete example setting `PROXY_AIOPS_MASTER_PASSWORD` inline in client configuration, which could lead users to store a sensitive secret in plaintext. While the guide explains when to set the variable, it does not warn users about the security implications of placing a master password in config files or client settings.

Session Persistence

Medium

• Category: Rogue Agent

Content

- Bash
metadata: {"openclaw":{"requires":{"env":["PROXY_AIOPS_CONFIG"],"bins":["proxy-aiops"],"config":["~/.proxy-aiops/config.yaml"]},"optional":{"env":["PROXY_AIOPS_MASTER_PASSWORD"],"config":["~/.proxy-aiops/secrets.enc"]},"primaryEnv":"PROXY_AIOPS_CONFIG","homepage":"https://github.com/AIops-tools/Proxy-AIops","emoji":"🔀","os":["macos","linux"]}}
compatibility: >
  Standalone, self-governed reverse-proxy operations across Traefik (API /api/..., metrics-text counters via /metrics), Caddy (admin API, default localhost:2019 — carries the write surface) and HAProxy (Data Plane API v2 /v2/..., HTTP Basic auth). Each target in the config names its own platform, and a name-keyed platform registry selects the API shape; an explicit support matrix raises teaching errors for ops a platform cannot do (traefik writes → its providers; caddy error counters → access logs; haproxy certs → the .pem pipeline), never a silent no-op. The governance harness (audit, policy, token/runaway budget, undo, risk-tiers) is bundled in the package — no external skill-family dependency.
  All write operations are audited to a local SQLite DB under ~/.proxy-aiops/ (relocatable via PROXY_AIOPS_HOME).
  Credentials: the HAProxy Data Plane API password (required) or an optional Basic-auth credential for Traefik/Caddy is stored ENCRYPTED in ~/.proxy-aiops/secrets.enc (Fernet/AES-128 + scrypt-derived key) — never plaintext on disk. Traefik and Caddy usually run unauthenticated on localhost, so their secret is optional (no store entry = no auth header). Run 'proxy-aiops init' to onboard (it asks for the platform), or 'proxy-aiops secret set <target>'. The store is unlocked by a master password from PROXY_AIOPS_MASTER_PASSWORD (non-interactive/MCP/CI) or an interactive prompt (CLI on a TTY). A legacy plaintext env var PROXY_<TARGET_NAME_UPPER>_SECRET is still honoured as a fallback with a deprecation warning (migrate with 'proxy-aiops secret migrate'). Secrets are never logged or echoed.
  State-chan
...[truncated 25 chars]

• Confidence: 60% confidence
• Finding: write surface) and HAProxy (Data Plane API v2 /v2/..., HTTP Basic auth). Each target in the config names its own platform, and a name-keyed platform registry selects the API shape; an explicit support

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.prompt_injection_instructions

Prompt-injection style instruction pattern detected.

Warn

• Code: suspicious.prompt_injection_instructions
• Location: references/agent-guardrails.md:26