proxmox-ops
Ops-focused Proxmox VE management via REST API — monitor, control, provision, and troubleshoot VMs and LXC containers with battle-tested operational patterns. Use when asked to: - List, start, stop, restart VMs or LXC containers - Check node status, cluster health, or resource usage - Create, cl...
Install this skill
Security score
The proxmox-ops skill was audited on May 31, 2026 and we found 12 security issues across 2 threat categories. Review the findings below before installing.
Categories Tested
Security Issues
Access to hidden dotfiles in home directory
| 18 | Credentials: PROXMOX_HOST, PROXMOX_TOKEN_ID, PROXMOX_TOKEN_SECRET — set as env vars or stored in ~/.proxmox-credentials (sourced at runtime, user-created, mode 600). |
Access to hidden dotfiles in home directory
| 19 | Writes: ~/.proxmox-credentials (user-created, API token, mode 600). |
Access to hidden dotfiles in home directory
| 23 | Configuration: ~/.proxmox-credentials |
Access to hidden dotfiles in home directory
| 31 | Create a credential file at `~/.proxmox-credentials`: |
Access to hidden dotfiles in home directory
| 34 | cat > ~/.proxmox-credentials <<'EOF' |
Access to hidden dotfiles in home directory
| 39 | chmod 600 ~/.proxmox-credentials |
Access to hidden dotfiles in home directory
| 42 | **Alternative:** Set `PROXMOX_HOST`, `PROXMOX_TOKEN_ID`, and `PROXMOX_TOKEN_SECRET` as environment variables directly (useful for CI/agent contexts). The helper script checks env vars first, then fall |
Access to hidden dotfiles in home directory
| 49 | source ~/.proxmox-credentials |
Access to hidden dotfiles in home directory
| 74 | 1. **Load credentials** from `~/.proxmox-credentials` |
Access to hidden dotfiles in home directory
| 200 | - **Credential file** (`~/.proxmox-credentials`) is user-created, not auto-generated by this skill. Must be mode 600 (`chmod 600 ~/.proxmox-credentials`). Rotate tokens immediately if exposed |
External URL reference
| 35 | PROXMOX_HOST=https://<your-proxmox-ip>:8006 |
External URL reference
| 201 | - **TLS verification disabled** (`-k` / `--insecure`) — Proxmox VE uses self-signed certificates by default ([Proxmox docs](https://pve.proxmox.com/wiki/Certificate_Management)). If you deploy a trust |