The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill consistently uses curl -k (or --insecure) for all API communications. This disables SSL/TLS certificate verification, which protects against Man-in-the-Middle (MitM) attacks. In environments where self-signed certificates are common (like Proxmox home labs), this allows an attacker on the network to intercept or modify traffic, including sensitive API tokens.
[COMMAND_EXECUTION]: The helper script scripts/pve.sh performs direct string interpolation of user-provided arguments such as $vmid, $node, and $snapname into shell commands and jq filters. For example, node=$(api GET "..." | jq -r ".data[] | select(.vmid==$vmid) | .node") does not sanitize the $vmid variable, creating a potential command injection or script logic bypass surface if the agent provides malformed input.
[CREDENTIALS_UNSAFE]: The skill instructs the agent to read sensitive API credentials from ~/.proxmox-credentials. While the instructions suggest setting restricted file permissions (chmod 600), the presence of plaintext secrets on the filesystem and the agent's ability to access them increases the risk of credential exposure if the environment is compromised.
[PROMPT_INJECTION]: The skill is vulnerable to Indirect Prompt Injection (Category 8). It ingests untrusted data from the Proxmox API (such as VM names, snapshot descriptions, and task logs) and processes it without boundary markers or sanitization. An attacker with control over the Proxmox environment could embed malicious instructions in these fields to influence the agent's subsequent actions.
Ingestion points: API responses for VM lists, snapshot lists, and task logs in SKILL.md and scripts/pve.sh.
Boundary markers: Absent; there are no instructions to the agent to ignore or delimit embedded content within the API data.
Capability inventory: The skill has the capability to execute shell commands (curl, bash), perform network operations, and write to the local filesystem.
Sanitization: Absent; the skill passes API-derived strings directly to display or into further command arguments.

proxmox