ClawHub
Back to skill

Security audit

Ai Devops Toolkit

Security checks for vulnerabilities and agentic risk

Overview

This skill is a local Ollama Herd observability guide with expected local API, SQLite, and log access, but users should treat its telemetry and unpinned package install carefully.

Install in a virtual environment or dedicated low-privilege account, pin and verify ollama-herd where possible, and review local telemetry before sharing it because traces, logs, and dashboards can expose infrastructure and usage details. Require explicit operator approval before running any POST or other configuration-changing command.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:13
Finding

Unpinned Third-Party Package Installation

Content
View full analysis
Remediation
View remediation
" ``` 2. Publish and verify cryptographic hashes through a requirements file: ```text ollama-herd== --hash=sha256: ``` Install it using: ```bash python3 -m pip install --require-hashes -r requirements.txt ``` 3. Lock and review all transitive dependencies rather than pinning only the top-level package. 4. Recommend installation in a dedicated virtual environment or isolated service account with no administrative privileges and access limited to the fleet resources required for operation. 5. Document the expected package index and advise against using untrusted additional indexes, reducing dependency-confusion risk. 6. Add a controlled update process requiring review, integrity verification, and testing before changing the pinned version. ]]>

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (12)

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 42)May include surrounding context.

Automated DevOps fleet health analysis

bash
devops_health=$(curl -s http://localhost:11435/dashboard/api/health)
echo "$devops_health" | python3 -m json.tool

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 64)May include surrounding context.

DevOps node-level status

bash
devops_fleet_status=$(curl -s http://localhost:11435/fleet/status)
echo "$devops_fleet_status" | python3 -c "
import sys, json
d = json.load(sys.stdin)

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 82)May include surrounding context.

Recent DevOps traces

bash
devops_traces=$(curl -s "http://localhost:11435/dashboard/api/traces?limit=20")
echo "$devops_traces" | python3 -m json.tool

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 131)May include surrounding context.

DevOps request tagging

bash
# DevOps tag via request body
curl -s http://localhost:11435/v1/chat/completions \
  -H "Content-Type: application/json" \
  -d '{"model":"llama3.3:70b","messages":[{"role":"user","content":"Hello"}],"metadata":{"tags":["devops-prod","devops-code-review"]}}'

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 144)May include surrounding context.

DevOps per-tag dashboards

bash
curl -s http://localhost:11435/dashboard/api/apps | python3 -m json.tool
curl -s http://localhost:11435/dashboard/api/apps/daily | python3 -m json.tool

DevOps token consumption by tag

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 165)May include surrounding context.

DevOps model recommendations per node

bash
devops_recommendations=$(curl -s http://localhost:11435/dashboard/api/recommendations)
echo "$devops_recommendations" | python3 -m json.tool

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 173)May include surrounding context.

DevOps usage statistics

bash
curl -s http://localhost:11435/dashboard/api/usage | python3 -m json.tool

DevOps Configuration

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 179)May include surrounding context.

DevOps Configuration

bash
# View all DevOps settings
curl -s http://localhost:11435/dashboard/api/settings | python3 -m json.tool

# Toggle DevOps runtime settings
curl -s -X POST http://localhost:11435/dashboard/api/settings \

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

The skill encourages querying local observability endpoints that can expose fleet health, node inventory, request activity, and other operational metadata, but it gives no warning that these responses may contain sensitive infrastructure and usage information. While the traffic is to localhost rather than a third-party host, an agent following these instructions could disclose private telemetry back to a user or downstream system without informed consent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The SQLite and log-inspection examples directly query request traces, failures, retries, and logs that can contain prompts, tags, error messages, timestamps, and node identifiers. Without a sensitivity warning or redaction guidance, an agent may surface stored request metadata that includes confidential application, user, or infrastructure details.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 131)May include surrounding context.

DevOps request tagging

bash
# DevOps tag via request body
curl -s http://localhost:11435/v1/chat/completions \
  -H "Content-Type: application/json" \
  -d '{"model":"llama3.3:70b","messages":[{"role":"user","content":"Hello"}],"metadata":{"tags":["devops-prod","devops-code-review"]}}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
68% confidence
Finding

This POST request changes runtime settings on the local router, which is a state-changing operation that can affect system behavior. Even though it targets localhost, instructing an agent to modify configuration via API without emphasizing confirmation and authorization increases the risk of unauthorized or accidental operational changes.

Content

Scanner excerpt · SKILL.md (reported line 182)May include surrounding context.

curl -s http://localhost:11435/dashboard/api/settings | python3 -m json.tool

Toggle DevOps runtime settings

curl -s -X POST http://localhost:11435/dashboard/api/settings
-H "Content-Type: application/json"
-d '{"auto_pull": false}'

text