Pve Automation

Automate Proxmox VE (PVE) virtual machine and container management tasks including VM lifecycle operations (create, start, stop, delete), template management...

This skill appears to implement a real Proxmox API client and documentation, but there are important mismatches and risky defaults you should consider before installing: - Metadata vs reality: The package metadata declares no required credentials, but the code and README require PVE_HOST, PVE_TOKEN_ID and PVE_SECRET. Treat this as an omission — ask the publisher to update the metadata or avoid using until clarified. - Secrets and privilege: The client defaults to root@pam and expects API tokens; prefer creating a least-privilege API token for automation instead of root-level tokens. Do not paste high-privilege tokens into untrusted contexts. - SSL verification: The client and README use verify=False by default. That is unsafe for untrusted networks — enable certificate verification in production or only run in a trusted internal network. - Local file/command suggestions: SKILL.md suggests running commands that read local files (e.g., grep /etc/default/pveproxy). If you run the agent or the CLI on a shared host, those commands could expose local config. Only run in an environment you control. - Source provenance: The skill's source/homepage is unknown. Prefer code from a known/verified source. If you need this functionality but want to be cautious, review the included scripts locally, run them in an isolated environment, and update the script to enable SSL verification and explicitly document required env vars. If you plan to use this skill: (1) request or require correct metadata listing required env vars, (2) audit and run the code in a safe environment, (3) issue a least-privilege token for automation, and (4) enable SSL verification and/or use proper certificates.

Type: OpenClaw Skill Name: pve-automation Version: 0.1.0 The skill bundle provides extensive automation for Proxmox VE, encompassing highly privileged operations such as VM/LXC lifecycle management, storage, network, and user permissions. The `scripts/pve_client.py` contains a critical vulnerability by disabling SSL certificate verification (`verify=False`), which exposes the client to Man-in-the-Middle attacks. Although this vulnerability is acknowledged in `README.md` as suitable only for trusted internal environments, it represents a significant security flaw. The `SKILL.md` itself, while describing powerful capabilities, also outlines numerous safety practices and does not contain explicit prompt-injection instructions for malicious actions like data exfiltration or backdoor installation. The classification is 'suspicious' due to the severe SSL vulnerability, not due to malicious intent.