Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Ollama — Herd Your LLMs Into One Smart Endpoint
v1.0.0Ollama fleet router — herd your Ollama LLMs into one smart endpoint. Route Llama, Qwen, DeepSeek, Phi, Mistral, and Gemma across multiple devices with 7-sign...
⭐ 2· 59·0 current·0 all-time
byTwin Geeks@twinsgeeks
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The name/description (Ollama fleet router) match the SKILL.md: it tells you to pip install a package, run a router and per-node agent, and route local Ollama instances. Minor mismatch: registry top-level requirements list only curl/wget while the runtime instructions rely on pip/python and the commands 'herd'/'herd-node' (the SKILL metadata lists python3/pip/sqlite3 as optional bins). Requiring a PyPI package and local agents is coherent with the stated purpose, but the dependency on Python/pip is not enforced in the manifest.
Instruction Scope
Instructions remain within the router’s scope (start router, call local endpoints, enable features via dashboard endpoints). They also describe auto-pull (automatic model downloads) and reference config paths (~/.fleet-manager/*). The guardrails state not to modify ~/.fleet-manager without user confirmation. Nothing in SKILL.md instructs reading unrelated system files or exfiltrating secrets, but auto-pull will download large model files and the router will access local model state and logs — which is expected but impactful.
Install Mechanism
No install spec in the manifest, but the runtime instructions require 'pip install ollama-herd' from PyPI. Installing a third‑party PyPI package can execute arbitrary code on the host. That is expected for a Python-based router, but it's a medium-risk install action and the skill does not declare an automated, vetted install; the agent or user would run pip at their discretion.
Credentials
The skill declares no credentials and only needs common networking tools (curl/wget) and optionally python/pip/sqlite3. The listed configPaths (~/.fleet-manager/latency.db and logs) are appropriate for a router that tracks latency and logs. No unrelated secrets or external service tokens are requested.
Persistence & Privilege
always:false and no special persistence or modification of other skills is requested. The guardrails explicitly say not to restart or modify the router/node agents or ~/.fleet-manager without confirmation. Autonomous invocation is allowed (default) but not combined with any elevated privileges in the manifest.
What to consider before installing
This skill appears to be a legitimate local Ollama fleet router, but it asks you to pip install a third‑party package and will automatically download models to nodes (auto-pull). Before installing or running: 1) verify the PyPI package and GitHub repo (check publisher, recent commits, issues). 2) Be prepared for large model downloads and disk/VRAM usage; confirm you want auto-pull enabled. 3) Ensure you trust the package source because pip install runs arbitrary code. 4) Note the small manifest mismatch: the runtime needs python/pip and the herd/herd-node binaries, which the registry metadata only lists as optional — make sure those are present. If you need higher assurance, inspect the package source code on the repo or install in an isolated environment first.Like a lobster shell, security has layers — review code before you run it.
apple-siliconvk97agtcj0qam4epb0jvcdne88n83x76kdeepseekvk97agtcj0qam4epb0jvcdne88n83x76kfleetvk97agtcj0qam4epb0jvcdne88n83x76kgemmavk97agtcj0qam4epb0jvcdne88n83x76kinferencevk97agtcj0qam4epb0jvcdne88n83x76klatestvk97agtcj0qam4epb0jvcdne88n83x76kllamavk97agtcj0qam4epb0jvcdne88n83x76kllmvk97agtcj0qam4epb0jvcdne88n83x76kload-balancervk97agtcj0qam4epb0jvcdne88n83x76kmistralvk97agtcj0qam4epb0jvcdne88n83x76kmultimodalvk97agtcj0qam4epb0jvcdne88n83x76kollamavk97agtcj0qam4epb0jvcdne88n83x76kphivk97agtcj0qam4epb0jvcdne88n83x76kqwenvk97agtcj0qam4epb0jvcdne88n83x76kroutingvk97agtcj0qam4epb0jvcdne88n83x76k
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
llama Clawdis
OSmacOS · Linux
Any bincurl, wget