Proxmox Ops

Ops-focused Proxmox VE management via REST API — monitor, control, provision, and troubleshoot VMs and LXC containers with battle-tested operational patterns...

This skill appears to do what it says (Proxmox REST operations) and includes a usable helper script, but review before installing: - The registry metadata does NOT list the three required environment variables (PROXMOX_HOST, PROXMOX_TOKEN_ID, PROXMOX_TOKEN_SECRET) even though SKILL.md and the script require them. Treat that as a red flag: verify credential requirements yourself before trusting any automation. - The helper uses curl -k (disables TLS verification) to accommodate self-signed certs. This weakens transport security; prefer adding the CA or using properly signed certs rather than leaving -k in place for production use. - The provisioning examples include an obvious example password (changeme123). Never use example passwords; ensure provisioning uses secure secrets management and least-privilege API tokens. - The skill expects you to store an API token in ~/.proxmox-credentials (mode 600). That is reasonable, but confirm you create the file yourself and review its contents. Alternatively use ephemeral environment variables in CI/agents. - Because this is instruction-only with an included script, inspect scripts/pve.sh locally and consider running it in a controlled environment first. Verify the GitHub homepage, commit history, and author before integrating into automation. If you intend to deploy this in production automation, require an API token with minimized permissions, replace -k, remove example plaintext passwords, and confirm the registry metadata is corrected to declare required credentials.

Type: OpenClaw Skill Name: proxmox-ops Version: 1.2.0 The proxmox-ops skill is a legitimate toolkit for managing Proxmox VE via its REST API. It includes a helper script (scripts/pve.sh) and comprehensive documentation (SKILL.md, provisioning.md) for VM/LXC lifecycle management, snapshots, and resource monitoring. While it utilizes 'curl -k' to bypass TLS verification (documented as a workaround for Proxmox's default self-signed certificates) and manages sensitive API tokens in a local credential file, these actions are transparently disclosed and strictly aligned with the stated operational purpose without evidence of malicious intent or data exfiltration.