ClawHub
Back to skill

Security audit

Homelab Ai

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent guide for running a local home-lab AI router, with ordinary but real supply-chain caution around unpinned package installs.

Install this only if you are comfortable running a local AI router on your home network. Prefer a virtual environment or non-admin account, verify the referenced packages and versions yourself, and avoid sending sensitive files or audio to the local endpoints until you trust the installed services and their network exposure.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:38
Finding

Unpinned Third-Party Package Installation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 38-53
Vulnerability Type: Unverified and unpinned third-party dependencies
Risk Level: Medium

Vulnerable Code

bash
pip install ollama-herd    # Home lab AI router
bash
uv tool install mflux           # Flux models (fastest for home labs)
uv tool install diffusionkit    # Stable Diffusion 3/3.5

Technical Analysis

The Skill instructs users to install and subsequently execute third-party packages without specifying reviewed versions, cryptographic hashes, signatures, or an explicitly trusted package source. These commands resolve mutable package versions from the configured package registries at installation time.

Consequently, the code installed by users may differ from the code available when the Skill was audited. Package installation can also execute package-controlled build or installation hooks. This creates a supply-chain exposure if a package release, maintainer account, registry, or dependency is compromised. The project contains no bundled dependency source through which the installed behavior can be independently verified.

No evidence establishes that the named packages are currently malicious. The finding concerns the unsafe, unpinned dependency installation mechanism.

Attack Path

  1. An attacker compromises a referenced package, one of its transitive dependencies, its publisher account, or the package registry distribution channel.
  2. The attacker publishes a malicious release under a package name used by the documented commands.
  3. A user follows the Skill instructions and runs pip install or uv tool install without a version or hash constraint.
  4. The package manager resolves and downloads the attacker-controlled release.
  5. Malicious code executes during installation or when the user starts herd, herd-node, or an installed image-generation tool.
  6. The payload operates with the privileges and res ...[truncated 589 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin every direct dependency to a specific version that has undergone security review.
  2. Publish and require cryptographic hashes for all downloaded distributions, using hash-enforced installation where supported.
  3. Pin and audit transitive dependencies through a lock file or reproducible constraints file.
  4. Identify the expected package registry explicitly and prohibit fallback to untrusted indexes.
  5. Prefer signed release artifacts and document signature verification before installation.
  6. Recommend installation in an isolated virtual environment under a non-privileged account; explicitly discourage administrator or root installation.
  7. Add a documented dependency-update process requiring source review, integrity verification, and security testing before changing pinned versions.
  8. Where feasible, vendor or include the reviewed implementation in the audited project so its effective behavior does not change independently after review.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 80)May include surrounding context.

Home lab image generation

bash
curl -o homelab_output.png http://localhost:11435/api/generate-image \
  -H "Content-Type: application/json" \
  -d '{"model": "z-image-turbo", "prompt": "a cozy home lab with servers and RGB lighting", "width": 1024, "height": 1024}'

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

The description includes English, Chinese, and Spanish text in a single user-facing summary, but does not indicate that language selection is optional or user-configurable. This can violate language/locale policy expectations by imposing multilingual output without explicit opt-in.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.