Veeam MCP

Query Veeam Backup & Replication and Veeam ONE via MCP server running in Docker. Provides intelligent backup monitoring, job analysis, capacity planning, and infrastructure health checks.

Before installing or running this skill: - Be aware the registry metadata is incomplete: the scripts require Docker and jq and a credentials file at ~/.veeam-mcp-creds.json (create from the provided template). The skill will not work until those are present. - The skill relies on a Veeam MCP Docker image you must obtain/build. Only use an image/package from Veeam or another trusted vendor; verify release sources and checksums before building/running the container. - The skill needs admin credentials for your Veeam servers. Prefer a least-privilege service account where possible; protect ~/.veeam-mcp-creds.json (chmod 600) and avoid storing long-lived full-admin credentials unless necessary. - Passing credentials into docker via -e exposes them to the container environment (and to docker inspect while the container runs). Consider running containers in a restricted network, inspect the image contents before use, and avoid running on hosts where untrusted users can inspect Docker state. - The SKILL.md asserts 'no credentials exposed in logs or command history' — that depends on how you run commands (avoid echoing sensitive files/commands into shells that are logged). - Because the skill's source/homepage are not provided in the registry metadata, verify the repository or package origin (GitHub repo, vendor page, or direct Veeam distribution) before trusting the MCP image. If you need, I can list the exact places the metadata and SKILL.md diverge and suggest minimal metadata updates (required binaries and config path) or produce a checklist to safely validate the MCP Docker image before use.

Type: OpenClaw Skill Name: Developer: Version: Description: OpenClaw Agent Skill Suspicious High-Entropy/Eval files: 4 The skill is classified as suspicious due to its handling of highly sensitive Veeam administrator credentials. These credentials (URL, username, password) are read from a local file (`~/.veeam-mcp-creds.json`) and then passed directly as environment variables to `docker run` commands for the `veeam-intelligence-mcp-server` container in `scripts/list-tools.sh`, `scripts/query-veeam.sh`, `scripts/start-mcp.sh`, and `scripts/test-connection.sh`. While this is a common Docker pattern, it exposes credentials to the container's environment and potentially to other processes on the host during execution. Additionally, the skill relies on a user-sourced, beta `veeam-intelligence-mcp-server` Docker image, whose internal behavior is outside the control of this skill bundle, introducing a supply chain risk. There is no evidence of prompt injection against the OpenClaw agent or other malicious intent within the provided files.