ClawHub
Back to skill

Security audit

Gpu Cluster Manager

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent local GPU-cluster helper with ordinary installation and resource-use cautions, but no evidence of hidden exfiltration or destructive behavior.

Install the package in a dedicated environment, avoid running it with elevated privileges, and review the PyPI/GitHub package before use. Keep the cluster endpoint restricted to trusted machines and require confirmation before pulling or deleting models because those actions can consume large storage, bandwidth, and GPU resources.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:22
Finding

Unpinned Third-Party Package Installation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 22
Vulnerability Type: Unpinned third-party dependency installation
Risk Level: Medium

Vulnerable Code

bash
pip install ollama-herd    # GPU cluster manager from PyPI

Technical Analysis

The installation instruction retrieves the latest available ollama-herd release from PyPI without pinning a reviewed version or verifying a cryptographic hash. The installed package supplies the subsequently invoked herd and herd-node executables, so its installation and execution permit third-party package code to run with the privileges of the current user.

This creates a supply-chain risk because the effective code may change after the Skill has been reviewed. A compromised maintainer account, malicious future release, or package-index compromise could cause users following this instruction to install attacker-controlled code. The audit did not find evidence that the currently published package is malicious; the vulnerability is the absence of dependency integrity and version controls.

Attack Path

  1. An attacker compromises the package publisher, distribution account, or another part of the package-release process.
  2. The attacker publishes a malicious release under the expected ollama-herd package name.
  3. A user follows the unpinned pip install ollama-herd instruction.
  4. Pip retrieves and installs the malicious latest release.
  5. The user runs herd or herd-node as instructed.
  6. Attacker-controlled package code executes with the user's privileges and can access resources available to that account.

Impact Assessment

Successful exploitation could provide arbitrary code execution under the account that installs or runs the package. Depending on that account's permissions, exposed resources may include local files, environment variables, user credentials, network services, GPU-cluster configuration and logs, and cluster nodes reachable from the host.

The instruc ...[truncated 460 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin the dependency to a specifically reviewed release:
    bash
    python3 -m pip install "ollama-herd==<reviewed-version>"
  2. Publish and verify SHA-256 hashes for the approved distribution artifacts, preferably through a requirements file using --require-hashes.
  3. Recommend installation in a dedicated virtual environment rather than the system Python environment.
  4. Document the trusted package index explicitly and advise users not to use unreviewed mirrors or additional package indexes.
  5. Review each dependency update before changing the pinned version, including transitive dependencies and package provenance.
  6. Where practical, use signed releases, attestations, or reproducible build information to strengthen artifact verification.
  7. Explicitly warn users not to install or run the package with elevated privileges unless a documented feature strictly requires them.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (13)

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 69)May include surrounding context.

GPU cluster status — all machines

bash
curl -s http://localhost:11435/fleet/status | python3 -m json.tool

What models are available on the GPU cluster?

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 74)May include surrounding context.

What models are available on the GPU cluster?

bash
curl -s http://localhost:11435/api/tags | python3 -m json.tool

What's loaded in GPU cluster memory right now?

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 79)May include surrounding context.

What's loaded in GPU cluster memory right now?

bash
curl -s http://localhost:11435/api/ps | python3 -m json.tool

How healthy is the GPU cluster?

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 84)May include surrounding context.

How healthy is the GPU cluster?

bash
curl -s http://localhost:11435/dashboard/api/health | python3 -m json.tool

GPU cluster model recommendations

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 89)May include surrounding context.

GPU cluster model recommendations

bash
curl -s http://localhost:11435/dashboard/api/recommendations | python3 -m json.tool

Returns GPU cluster recommendations based on your hardware — which models fit, which are too big, and the optimal GPU cluster mix.

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 96)May include surrounding context.

GPU cluster recent activity

bash
curl -s "http://localhost:11435/dashboard/api/traces?limit=10" | python3 -m json.tool

GPU cluster usage stats

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 101)May include surrounding context.

GPU cluster usage stats

bash
curl -s http://localhost:11435/dashboard/api/usage | python3 -m json.tool

GPU cluster settings

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 106)May include surrounding context.

GPU cluster settings

bash
curl -s http://localhost:11435/dashboard/api/settings | python3 -m json.tool

curl -s -X POST http://localhost:11435/dashboard/api/settings \
  -H "Content-Type: application/json" \

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 108)May include surrounding context.

bash
curl -s http://localhost:11435/dashboard/api/settings | python3 -m json.tool

curl -s -X POST http://localhost:11435/dashboard/api/settings \
  -H "Content-Type: application/json" \
  -d '{"auto_pull": false}'

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

This is not script execution, so SC2 as labeled is technically a false match; however, the documented command exercises a sensitive management endpoint that can trigger remote model downloads onto cluster nodes. In a zero-config auto-discovered cluster, such functionality becomes dangerous if the API lacks authentication or network scoping, enabling resource exhaustion or unauthorized software/model deployment.

Content

Scanner excerpt · SKILL.md (reported line 119)May include surrounding context.

md
curl -s http://localhost:11435/dashboard/api/model-management | python3 -m json.tool

# Download a model to a specific GPU cluster node
curl -s -X POST http://localhost:11435/dashboard/api/pull \
  -H "Content-Type: application/json" \
  -d '{"model": "llama3.3:70b", "node_id": "gpu-cluster-studio"}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 108)May include surrounding context.

bash
curl -s http://localhost:11435/dashboard/api/settings | python3 -m json.tool

curl -s -X POST http://localhost:11435/dashboard/api/settings \
  -H "Content-Type: application/json" \
  -d '{"auto_pull": false}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
80% confidence
Finding

This documented POST call instructs the local cluster to download a model onto a named node, which can trigger large unintended downloads and consume disk, bandwidth, and GPU resources. In context it is not malicious, but exposing unauthenticated model-management endpoints or encouraging direct invocation raises operational abuse risk, especially because the skill advertises zero-config local discovery and remote node control.

Content

Scanner excerpt · SKILL.md (reported line 119)May include surrounding context.

md
curl -s http://localhost:11435/dashboard/api/model-management | python3 -m json.tool

# Download a model to a specific GPU cluster node
curl -s -X POST http://localhost:11435/dashboard/api/pull \
  -H "Content-Type: application/json" \
  -d '{"model": "llama3.3:70b", "node_id": "gpu-cluster-studio"}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 136)May include surrounding context.

Tag your GPU cluster requests to see which apps use the most time:

bash
curl -s http://localhost:11435/v1/chat/completions \
  -H "Content-Type: application/json" \
  -d '{"model":"llama3.3:70b","messages":[{"role":"user","content":"Summarize GPU cluster utilization"}],"metadata":{"tags":["gpu-cluster-app"]}}'

Static analysis

No suspicious patterns detected.