Back to skill
Skillv1.0.1
ClawScan security
DeepSeek — DeepSeek-V3, DeepSeek-R1, DeepSeek-Coder on Your Local Devices · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignMar 30, 2026, 10:33 PM
- Verdict
- benign
- Confidence
- medium
- Model
- gpt-5-mini
- Summary
- The skill's requirements and instructions are coherent with its stated purpose of running DeepSeek models on a local fleet, but installing the third‑party package and pulling large models carries the usual supply‑chain and disk/network risks you should review first.
- Guidance
- This skill appears to be what it claims: a guide to running DeepSeek models locally via an Ollama Herd router. Before installing, verify the ollama-herd PyPI package and its GitHub repository (review code, recent activity, and maintainers). Be prepared for large downloads and big disk/RAM usage when pulling models. Run installations on a trusted machine or isolated environment, check network access (model pulls will download large artifacts), and inspect the ~/.fleet-manager directory and any created services before granting broader network access. If you need higher assurance, review the package source or run it in a VM/container first.
Review Dimensions
- Purpose & Capability
- okName/description (running DeepSeek via an Ollama Herd router) align with the runtime instructions: installing ollama-herd, running herd/herd-node, and using ollama pull to fetch models. Declared binaries (curl/wget, optional python/pip) make sense for interacting with local HTTP endpoints and installing the Python package.
- Instruction Scope
- okSKILL.md contains only setup and usage steps for a local fleet router and examples showing how to call localhost endpoints. It does not instruct reading or exfiltrating unrelated system files or environment variables; it even warns not to delete/edit ~/.fleet-manager. Sample code points at localhost (http://localhost:11435).
- Install Mechanism
- noteInstallation is via pip install ollama-herd (PyPI) and running local binaries (herd, herd-node). Using PyPI is a common approach but carries moderate supply‑chain risk — the package and its GitHub repo should be reviewed before installation.
- Credentials
- okThe skill declares no required environment variables or unrelated credentials. Metadata lists config paths under ~/.fleet-manager, which are consistent with a fleet manager and are not excessive for the stated purpose.
- Persistence & Privilege
- okNo 'always' privilege requested; the skill is user‑invocable only. It does not request writing to other skills' configs or system‑wide settings in the instructions.