ClawHub
Back to skill

Security audit

Deepseek Deepseek Coder

Security checks for vulnerabilities and agentic risk

Overview

This skill is mostly a local DeepSeek/Ollama fleet guide, but it has a material consent gap around automatic large model downloads and broader capabilities than its DeepSeek-focused framing suggests.

Install only if you are comfortable running a third-party local model router and node service. Before using it, verify the ollama-herd package/version yourself, use a virtual environment, confirm whether auto_pull is enabled, and require explicit approval before any model download or deletion, especially for large DeepSeek variants.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:29
Finding

Unpinned Third-Party Python Package Installation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 29
Vulnerability Type: Unpinned and unverifiable third-party dependency
Risk Level: Medium

Vulnerable Code

bash
pip install ollama-herd

Technical Analysis

The setup instructions install ollama-herd directly from the default Python Package Index without pinning an audited version or verifying an integrity hash. Consequently, the installed artifact can change over time even though the reviewed Skill remains unchanged.

Python package installation may execute package-controlled build or installation logic. If the package publisher account, distribution infrastructure, or a future release is compromised, following this command could execute attacker-controlled code with the permissions of the user running pip.

No evidence establishes that the currently referenced package is malicious. The vulnerability is the absence of dependency version and integrity controls, which creates avoidable supply-chain and reproducibility risk.

Attack Path

  1. An attacker compromises the package publisher account, package distribution channel, or a future release process for ollama-herd.
  2. The attacker publishes a malicious release under the same package name.
  3. A user follows the Skill documentation and runs pip install ollama-herd.
  4. pip resolves the latest available release because no version is pinned.
  5. Malicious package installation or build logic executes under the installing user's account.
  6. The payload can access resources available to that account and may modify files, steal accessible data, or install additional components.

Impact Assessment

Successful exploitation can provide arbitrary code execution with the privileges of the user performing the installation. The accessible scope may include user-owned files, environment variables, application credentials, development repositories, and network resources available to that ...[truncated 275 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin the dependency to a specifically reviewed release:

    bash
    python3 -m pip install "ollama-herd==REVIEWED_VERSION"

  2. Distribute a requirements file containing trusted hashes and require hash validation:

    bash
    python3 -m pip install --require-hashes -r requirements.txt

  3. Record hashes for every transitive dependency or use a reviewed lock file generated from a trusted environment.

  4. Recommend installation inside a dedicated virtual environment with ordinary user privileges rather than using a privileged or system-wide Python environment.

  5. Review package provenance, maintainer identity, release history, and published artifacts before updating the pinned version.

  6. Consider using an organization-controlled package mirror that admits only approved and integrity-verified artifacts.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (8)

Intent-Code Divergence

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The guardrails require explicit user confirmation before model downloads, but earlier documentation says the router auto-pulls missing models when a request arrives. In this context, the contradiction is dangerous because DeepSeek models can be extremely large, so an agent following the earlier behavior could consume disk, bandwidth, and memory without meaningful user approval.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The document states that models are auto-pulled on request, while later claiming that no models are downloaded automatically unless user-initiated or opt-in. This contradiction can cause operators or agents to trigger unexpectedly large local downloads and resource consumption under false assumptions about consent and automation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

Describing on-demand automatic model pulls in setup/usage without an upfront warning hides a material operational and security-relevant consequence: large downloads and heavy local resource use. In a local-fleet skill, that can lead to denial-of-service-like effects on disk, RAM, or network capacity, especially if an agent invokes a large model name casually.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 69)May include surrounding context.

bash
# DeepSeek-V3 general chat
curl http://localhost:11435/api/chat -d '{
  "model": "deepseek-v3",
  "messages": [{"role": "user", "content": "Explain quantum computing"}],
  "stream": false

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
80% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 99)May include surrounding context.

md
| `deepseek-coder-v2:16b` | 12GB | Mac Mini M4 (24GB) |
| `deepseek-v3` | 256GB+ | Mac Studio M3 Ultra (512GB) |

The fleet router automatically sends requests to the machine where the model is loaded — no manual routing needed.

## Why run DeepSeek locally

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The manifest description and opening documentation frame the skill as specifically for running DeepSeek-V3, DeepSeek-R1, and DeepSeek-Coder locally with zero cloud costs. However, later sections expand the skill's described behavior to routing any Ollama model plus image generation, speech-to-text, embeddings, and a dashboard for all models, which materially exceeds the stated DeepSeek-focused purpose.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 126)May include surrounding context.

Image generation

bash
curl -o image.png http://localhost:11435/api/generate-image \
  -H "Content-Type: application/json" \
  -d '{"model":"z-image-turbo","prompt":"a sunset","width":1024,"height":1024,"steps":4}'

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 154)May include surrounding context.

md
## Guardrails

- **Model downloads require explicit user confirmation** — DeepSeek models range from 1GB (1.5B) to 400GB+ (671B). Always confirm before pulling.
- **Model deletion requires explicit user confirmation** — never remove models without asking.
- Never delete or modify files in `~/.fleet-manager/`.
- If a DeepSeek model is too large for available memory, suggest a smaller variant (e.g., `deepseek-r1:7b` instead of `:70b`).
- No models are downloaded automatically — all pulls are user-initiated or require opt-in via the `auto_pull` setting.

Static analysis

No suspicious patterns detected.