Skills/Glama/pvewarden

pvewarden@0.1.7

CAUTION· not started

Publisher claims: "Enables AI agents to inspect pending updates and service health for Proxmox VE VMs and containers, then take snapshots, apply official updates, reboot, and roll back under tag-based permissions and human-confirmed risky actions." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry GlamaPublisher matousfiser · publishing for 3 daysInstalls 0Last detonated 3d ago
What would fix thisWatchDispute verdict

Coverage

Not started: dependency install failed; the server itself was not observed.
Tested
the dependency install step · every file read, file written and host contacted by what ran
Not tested
server startup · the tool list · tool behavior

What this means for the label: Caution here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.

Before you give it your token

It will ask for
TOKEN_SECRET_ENVConfiguration, not credentials: PUBKEY, PVEWARDEN_CONFIG
Where it talks to
no vendor host named in the code
What the honeypot saw
no credential files read · no network
What we could not test
server startup · the tool list · tool behavior

Connect it with a scoped credential, under the guard. It asks for TOKEN_SECRET_ENV and talks to its vendor. Give the credential to the guard, not the server: the value never enters the server's environment and only travels to the host you bind. What the tools do with a real credential was not observed.

$vet-skills run --net declared -- <the server's command>

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; not started: dependency install failed; the server itself was not observed) on 2026-11-11 and scored it 71/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Access to sensitive file paths; Destructive file system command detected; Auto-update or dynamic fetch configuration. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 2 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.1sprocessdependency install exit 1 ·
0.1sclaimednot started: dependency install failed (exit 1); the server itself was not observed
0.1sprocessscript backend runs setup only
0.1sprocessno install scripts to re-run

Static findings

HIGH
Access to sensitive file pathsguest/install.sh:19 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesSUDOERS=/etc/sudoers.d/pvewardenFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Destructive file system command detectedguest/install.sh:61 · Destructive file system command detectedrm -rf /var/lib/pvewardenFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Privileged sudo commandtests/integration/test_guest_docker.py:102 · Privileged sudo command — agent may execute with elevated privileges@pytest.mark.parametrize("command", ["id", "check; id", "bash -i", "cat /etc/shadow", "sudo -l"])Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Auto-update or dynamic fetch configurationguest/install.sh:3 · Auto-update or dynamic fetch configuration — agent may load new code at runtime# install.sh [--dry-run] [--auto-updates=keep|off|on] "<server public key>" <server address>Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Python subprocess execution detectedtests/integration/test_guest_docker.py:24 · Python subprocess execution detectedreturn subprocess.run(args, capture_output=True, text=True, check=check, **kwargs)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
File permission modification commandtests/integration/test_server_install.py:30 · File permission modification command — agent changes file ownership/permissions"chmod +x /usr/local/bin/systemctl") # fmt: skipFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
File permission modification commanddeploy/install-server.sh:60 · File permission modification command — agent changes file ownership/permissionschown root:"$SVC_USER" "$ETC/config.toml"Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
Python subprocess execution detectedtests/test_setup.py:119 · Python subprocess execution detectedsubprocess.run([*ossl, "-new", "-subj", "/CN=pvewarden", "-keyout", d / "tls.key", "-out", d / "tls.csr"],Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedtests/test_setup.py:254 · Python subprocess execution detectedassert subprocess.run(["openssl", "verify", "-CAfile", pve_ca, cert], capture_output=True).returncode == 0Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Access to sensitive file pathstests/integration/test_guest_docker.py:260 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"id pvewarden; ls -d /usr/local/sbin/pvewarden-* /etc/sudoers.d/pvewarden /etc/apt/apt.conf.d/52pvewarden* /var/lib/pvewarden",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Privileged sudo commandtests/integration/Dockerfile:1 · Privileged sudo command — agent may execute with elevated privileges# A minimal "guest": the distribution image plus sshd, without sudo (like the Debian LXC templates).Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Auto-update or dynamic fetch configurationguest/install.sh:175 · Auto-update or dynamic fetch configuration — agent may load new code at runtimeecho " WARNING: still on although --auto-updates=off: another apt.conf.d file overrides $AUTO_CONF"Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Auto-update or dynamic fetch configurationsrc/pvewarden/tools.py:169 · Auto-update or dynamic fetch configuration — agent may load new code at runtime"auto_updates=true means the guest also installs updates by itself every day (unattended-upgrades) "Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Python subprocess execution detectedsrc/pvewarden/keys.py:52 · Python subprocess execution detectedsubprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
MCP server using network transport (SSE/HTTP)src/pvewarden/http.py:83 · MCP server using network transport (SSE/HTTP) — data sent over networkdef build_app(server: MCPServer, cfg: HTTPConfig, audit: AuditLog):Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
MEDIUM
Python subprocess execution detectedtests/integration/test_server_install.py:18 · Python subprocess execution detectedreturn subprocess.run(args, capture_output=True, text=True, check=check, **kwargs)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedtests/test_setup.py:107 · Python subprocess execution detectedsubprocess.run(["ssh-keygen", "-q", "-t", "ed25519", "-N", "", "-C", name, "-f", d / name], check=True)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
HIGH
Auto-update or dynamic fetch configurationguest/install.sh:31 · Auto-update or dynamic fetch configuration — agent may load new code at runtime--auto-updates=keep | --auto-updates=off | --auto-updates=on) AUTO=${a#*=} ;;Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Auto-update or dynamic fetch configurationtests/test_parsers.py:81 · Auto-update or dynamic fetch configuration — agent may load new code at runtimeassert parse_status("auto_updates=yes\n")["auto_updates"] is TrueFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Python subprocess execution detectedtests/test_setup.py:175 · Python subprocess execution detectedreturn subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
File permission modification commandsrc/pvewarden/doctor.py:90 · File permission modification command — agent changes file ownership/permissionsout.append(fail("Shared SSH key", f"{key} is readable or writable by everyone", f"chmod 0640 {key}"))Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
HIGH
Auto-update or dynamic fetch configurationguest/install.sh:21 · Auto-update or dynamic fetch configuration — agent may load new code at runtimeUSAGE='usage: install.sh [--dry-run] [--auto-updates=keep|off|on] [--keep-keys|--keys-only] "<server public key>" <server address>Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
File permission modification commandguest/install.sh:97 · File permission modification command — agent changes file ownership/permissionschown "$USER_NAME:$USER_NAME" "$tmp"Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
Python subprocess execution detectedtests/test_scripts.py:35 · Python subprocess execution detectedreturn subprocess.run(["bash", ROOT / "guest/pvewarden-gate"], env=env, capture_output=True, text=True)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedtests/test_keys.py:175 · Python subprocess execution detectedr = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
File permission modification commanddeploy/install-server.sh:44 · File permission modification command — agent changes file ownership/permissionschmod 0755 "$APP/venv/bin/pvewarden"Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
File permission modification commanddeploy/install-server.sh:61 · File permission modification command — agent changes file ownership/permissionschmod 0640 "$ETC/config.toml"Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
HTTP URL with a raw public IP addresstests/test_setup.py:236 · HTTP URL with a raw public IP address — a hard-coded destination that domain-based monitoring cannot nameassert "claude mcp add --scope user --transport http pvewarden https://192.0.2.50:8765/mcp" in r.stdoutFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
Destructive file system command detectedtests/integration/Dockerfile:7 · Destructive file system command detected&& rm -rf /var/lib/apt/lists/* \Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Access to sensitive file pathstests/integration/test_guest_docker.py:102 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files@pytest.mark.parametrize("command", ["id", "check; id", "bash -i", "cat /etc/shadow", "sudo -l"])Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
File permission modification commandguest/install.sh:98 · File permission modification command — agent changes file ownership/permissionschmod 0600 "$tmp"Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
URL using a raw public IP addresstests/test_setup.py:244 · URL using a raw public IP address — may bypass domain-based filteringassert "curl.exe -sk https://192.0.2.50:8765/ca.pem" in r.stdoutFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
URL using a raw public IP addresstests/test_setup.py:236 · URL using a raw public IP address — may bypass domain-based filteringassert "claude mcp add --scope user --transport http pvewarden https://192.0.2.50:8765/mcp" in r.stdoutFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
Auto-update or dynamic fetch configurationtests/test_app.py:69 · Auto-update or dynamic fetch configuration — agent may load new code at runtimeassert r["auto_updates"] is TrueFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Python subprocess execution detectedtests/test_setup.py:117 · Python subprocess execution detectedsubprocess.run([*ossl, "-x509", "-days", "30", "-subj", "/CN=Proxmox Virtual Environment",Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedtests/test_scripts.py:191 · Python subprocess execution detectedr = subprocess.run([proj / "proxmox/pvewarden-enroll", *args], env=env, capture_output=True, text=True)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Auto-update or dynamic fetch configurationtests/test_scripts.py:270 · Auto-update or dynamic fetch configuration — agent may load new code at runtimedef test_enroll_passes_auto_updates_only_when_changing_it(enroll):Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Auto-update or dynamic fetch configurationguest/install.sh:162 · Auto-update or dynamic fetch configuration — agent may load new code at runtimeprintf '// written by pvewarden (install.sh --auto-updates=%s); delete this file to undo\n' "$AUTO" > "$AUTO_CONF"Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
URL using a raw public IP addresstests/test_setup.py:242 · URL using a raw public IP address — may bypass domain-based filteringassert "MCP server https://192.0.2.50:8765/mcp" in r.stdoutFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
Process kill commandtests/test_limits.py:25 · Process kill command — agent can terminate processesr = runner_running("exec yes pvewarden", max_output=2**20) # exec: kill hits it, like sshFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Auto-update or dynamic fetch configurationtests/integration/test_guest_docker.py:85 · Auto-update or dynamic fetch configuration — agent may load new code at runtimeassert parse_status(out)["auto_updates"] in (True, False), outFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Python subprocess execution detectedtests/test_scripts.py:81 · Python subprocess execution detectedreturn subprocess.run(["bash", ROOT / "guest/install.sh", *args], capture_output=True, text=True)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedtests/test_proxmox.py:159 · Python subprocess execution detectedsubprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
LOW
URL to a private-network addresstests/test_setup.py:594 · URL to a private-network address — a LAN or development targetassert "http://10.200.0.200:8765/mcp" in r.stdoutFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
LOW
URL to a private-network addresstests/test_setup.py:318 · URL to a private-network address — a LAN or development targetassert "http://10.8.0.5:8765/mcp" in r.stdoutFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
HTTP URL with a raw public IP addresstests/test_setup.py:242 · HTTP URL with a raw public IP address — a hard-coded destination that domain-based monitoring cannot nameassert "MCP server https://192.0.2.50:8765/mcp" in r.stdoutFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
HTTP URL with a raw public IP addresstests/test_setup.py:244 · HTTP URL with a raw public IP address — a hard-coded destination that domain-based monitoring cannot nameassert "curl.exe -sk https://192.0.2.50:8765/ca.pem" in r.stdoutFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07

Cost to the agent

Instructions loaded
≈35 tok
1 file · 56 in bundle
Tool list per prompt
≈0 tok
0 tools · 0 per tool
Handshake
no reply
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 0

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.

What would make this Verified

9 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Unclaimed publisher≈ +8 on the totalClaim matousfiser: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  2. Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  3. Destructive file system command detected≈ +4 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
  4. Auto-update or dynamic fetch configuration≈ +4 on the totalPin versions and sources; vendor anything fetched at install time.
  5. Privileged sudo command≈ +2 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
  6. Python subprocess execution detected≈ +2 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
Publish a new version to Glama, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim matousfiserPropose a patch to the maintainer