ClawHub
Back to skill

Security audit

DeepSeek — DeepSeek-V3, DeepSeek-R1, DeepSeek-Coder on Your Local Devices

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward guide for running DeepSeek models through a local Ollama Herd fleet, with no hidden code or deceptive behavior found.

Install in a virtual environment when possible, avoid sudo, and consider pinning or verifying the ollama-herd package before use. Treat prompts, audio, and generated outputs as visible to machines participating in your local fleet.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:27
Finding

Unpinned Third-Party Package Installation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 27
Vulnerability Type: Unpinned third-party dependency
Risk Level: Medium

Vulnerable Code

bash
pip install ollama-herd

Technical Analysis

The setup instructions install ollama-herd from the default Python Package Index without specifying a reviewed version or verifying an integrity hash. Consequently, the command resolves whichever release the package index currently considers appropriate.

Python package installation may execute package-controlled build or installation logic. A compromised publisher account, malicious future release, or package-index compromise could therefore turn this documented setup step into a code-execution vector. The audit did not find evidence that the package is currently malicious; the finding concerns the absence of dependency pinning and integrity verification.

Attack Path

  1. An attacker compromises the package publisher account, distribution channel, or a future package release.
  2. The attacker publishes a malicious version under the expected ollama-herd package name.
  3. A user follows the Skill's setup instructions and runs pip install ollama-herd.
  4. pip retrieves the attacker-controlled release because no version or hash is constrained.
  5. Malicious installation or runtime logic executes with the privileges of the user running the command.

Impact Assessment

Successful exploitation could permit arbitrary code execution under the invoking user's account. This may expose files, environment variables, credentials, model inputs, and network resources accessible to that account. The impact could be greater if the installation command is run from a privileged account or environment.

No evidence was found in the audited Skill itself of instruction hijacking, persistence, credential theft, destructive behavior, obfuscated payloads, or embedded malicious scripts.

Remediation
View remediation

Remediation Suggestions

  1. Pin the package to a specifically reviewed version, for example:

    bash
    python3 -m pip install "ollama-herd==REVIEWED_VERSION"

  2. Publish a lock file or requirements file containing cryptographic hashes, and install with hash enforcement:

    bash
    python3 -m pip install --require-hashes -r requirements.txt

  3. Prefer an isolated virtual environment rather than installing into a system or privileged Python environment.

  4. Document the expected package publisher, repository, version, and artifact hashes so users can verify provenance.

  5. Establish a controlled update process in which new releases are reviewed and tested before the pinned version and hashes are changed.

  6. Explicitly warn users not to run the installation command with elevated privileges.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 70)May include surrounding context.

bash
# DeepSeek-V3 general chat
curl http://localhost:11435/api/chat -d '{
  "model": "deepseek-v3",
  "messages": [{"role": "user", "content": "Explain quantum computing"}],
  "stream": false

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
80% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 98)May include surrounding context.

md
| `deepseek-coder-v2:16b` | 12GB | Mac Mini M4 (24GB) |
| `deepseek-v3` | 256GB+ | Mac Studio M3 Ultra (512GB) |

The fleet router automatically sends requests to the machine where the model is loaded — no manual routing needed.

## Why run DeepSeek locally

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 125)May include surrounding context.

Image generation

bash
curl -o image.png http://localhost:11435/api/generate-image \
  -H "Content-Type: application/json" \
  -d '{"model":"z-image-turbo","prompt":"a sunset","width":1024,"height":1024,"steps":4}'

Static analysis

No suspicious patterns detected.