Security audit

veeam-aiops

Security checks across malware telemetry and agentic risk

Overview

The skill is coherent for Veeam backup administration, but it gives agents high-impact write and restore authority without an enforced read-only mode or approval gate.

Install only for a Veeam account whose server-side permissions are limited to the actions you actually want the agent to perform. Prefer read-only or restricted Veeam roles for diagnostics, avoid legacy .env password storage, use the encrypted secret store, and do not expose write-capable MCP tools to untrusted prompts or unattended workflows.

SkillSpector

By NVIDIA

Vulnerability Patterns

Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The workflow instructs users to fix ~/.veeam-aiops/.env when a password env var is missing, which contradicts the stated design that credentials are stored in an encrypted secrets store. This can normalize or encourage plaintext secret handling, increasing the risk that Veeam credentials are stored in a recoverable local file and later exposed via filesystem access, backups, or misconfiguration.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The document explicitly says the tool does not gate write operations and has no read-only switch or approval prompt, which materially weakens the claimed governance model. In an agentic context, relying only on external account permissions or prompt discipline is unsafe because prompt constraints are bypassable and over-privileged service accounts are common, enabling unintended job starts/stops, disables, retries, or restores.

Intent-Code Divergence

Medium

Confidence: 90% confidence
Finding: The documentation presents destructive actions as requiring preview and double confirmation, but then states MCP write tools merely accept a dry_run flag. That inconsistency can mislead operators into believing high-risk actions are guarded when, through MCP, an agent may be able to proceed after a preview without an actual independent confirmation barrier.

Autonomous Decision Making

Medium

Category: Excessive Agency
Content: ## Authorization is not this tool's job — decide it where it belongs Whether a write should happen is your decision, or the account's. The tool does not gate it — there is no read-only switch and no approval prompt to configure. The two right places to control read vs write: - **The account you connect with.** Give the Veeam account you connect with a
Confidence: 96% confidence
Finding: The statement that there is 'no approval prompt to configure' confirms the system permits autonomous execution of write operations without human-in-the-loop approval. In this skill's context, that is dangerous because the tool can start/stop/retry jobs, enable/disable jobs, and initiate VM restores, so an LLM mistake, prompt injection, or compromised workflow could directly alter backup operations and recovery state.

Credential Access

High

Category: Privilege Escalation
Content: veeam-aiops infra proxies veeam-aiops secret set <target> # store password encrypted veeam-aiops secret list # names only veeam-aiops secret migrate # import legacy plaintext .env veeam-aiops secret rotate-password veeam-aiops doctor veeam-aiops mcp # start MCP server (stdio)
Confidence: 92% confidence
Finding: The documented 'secret migrate' flow explicitly supports importing legacy plaintext .env credentials, meaning the skill has credential-access and credential-processing behavior beyond just using an encrypted store. In a high-value backup-admin context, support for plaintext secret sources materially raises exposure risk because environment files are often copied, backed up, or read by other local processes and users.

Session Persistence

Medium

Category: Rogue Agent
Content: 1. `veeam-aiops restore list-points` → identify the correct restore point id 2. `veeam-aiops restore start --restore-point-id <id> --dry-run` → preview the exact API call **and the VM name + creation time** the id resolves to — never approve a restore from a GUID 3. `veeam-aiops restore start --restore-point-id <id>` → double confirmation required; this is IRREVERSIBLE (overwrites/creates a VM) and records no undo token. Refused outright if the VM name matches the configured VBR host (an in-place overwrite of the backup server itself) — a name-based safety net, not a proof, so confirm the target yourself 4. **Failure branch**: if `doctor` shows the VBR server unreachable or the password env var is missing, fix `~/.veeam-aiops/.env` (chmod 600) before retrying — the restore is never issued against an unauthenticated session. ## Usage Mode
Confidence: 86% confidence
Finding: This section again references a password environment variable and a ~/.veeam-aiops/.env file in the operational restore workflow, encouraging persistent local storage of secrets outside the encrypted store. In the context of a backup-administration skill with destructive restore capability, mishandled credentials could grant an attacker broad control over backup jobs, repositories, and restore operations.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.prompt_injection_instructions

Prompt-injection style instruction pattern detected.

Warn

Code: suspicious.prompt_injection_instructions
Location: references/agent-guardrails.md:43