Security audit

Local Llm Router

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent local LLM router guide with disclosed local setup and admin commands, but users should treat model-management actions and package installation carefully.

Install this only if you intend to run ollama-herd locally. Use a virtual environment, avoid running pip or the router as root/admin, review the package source or pin a trusted version where possible, and require explicit approval before changing settings or pulling/deleting models because downloads can be very large and deletions affect local model availability.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:31
Finding: Unpinned Third-Party Package Installation
Content: View full analysis
Vulnerability Details

File Location: SKILL.md, line 31
Vulnerability Type: Unpinned third-party dependency installation
Risk Level: Medium

Vulnerable Code

bash
pip install ollama-herd # install the local LLM router

Technical Analysis

The installation instruction retrieves and installs the latest available release of the ollama-herd package without a version constraint or integrity hash. Python package installation may execute package-controlled build or installation logic. Subsequent execution of the installed herd and herd-node commands also runs code supplied by the package and its dependencies.

Although the Skill identifies the intended PyPI project and source repository, it does not pin a reviewed version, verify an artifact hash, provide a lock file, or constrain transitive dependencies. Consequently, the code installed by users can differ from the code reviewed when this Skill was published. A compromised package-maintainer account, malicious future release, altered distribution artifact, or compromised transitive dependency could exploit this supply-chain boundary.

The audited Skill does not itself contain evidence that ollama-herd is malicious. This finding concerns the unsafe dependency acquisition practice and the resulting exposure to mutable third-party code.

Attack Path

An attacker compromises the package publisher, distribution channel, or a transitive dependency and publishes a malicious release.

A user follows the Skill instruction and runs pip install ollama-herd.

Because no version or hash is specified, pip resolves and downloads the attacker-controlled release or dependency.

Malicious package logic may execute during installation, depending on the selected distribution and build process.

The user subsequently runs herd or herd-node, executing the installed attacker-controlled runtime code.

Impact Assessment

Exploitat ...[truncated 675 chars]
Remediation: View remediation
Remediation Suggestions

Pin ollama-herd to a specific version that has undergone security review.

Publish cryptographic hashes for the approved distribution artifacts and require hash verification, such as through a locked requirements file used with pip install --require-hashes.

Pin and review transitive dependencies where feasible, using a reproducible lock file.

Recommend installation into a dedicated virtual environment rather than the system Python environment.

Advise users not to install or run the package with root or administrator privileges.

Document how users can verify package provenance and compare the distributed artifact against the referenced source repository.

Establish a controlled update process so new releases are reviewed before changing the pinned version and hashes.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (15)

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · SKILL.md (reported line 69)May include surrounding context.
Local LLM Fleet Status

bash
# local_llm_fleet_status — all local LLM nodes and queues curl -s http://localhost:11435/fleet/status | python3 -m json.tool

List all local LLM models across the fleet

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · SKILL.md (reported line 75)May include surrounding context.
List all local LLM models across the fleet

bash
# local_llm_model_list — every local LLM model on every node curl -s http://localhost:11435/api/tags | python3 -m json.tool

Local LLM models currently loaded in memory (hot)

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · SKILL.md (reported line 81)May include surrounding context.
Local LLM models currently loaded in memory (hot)

bash
# local_llm_hot_models — local LLM models in GPU memory curl -s http://localhost:11435/api/ps | python3 -m json.tool

OpenAI-compatible local LLM model list

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · SKILL.md (reported line 86)May include surrounding context.
OpenAI-compatible local LLM model list

bash
curl -s http://localhost:11435/v1/models | python3 -m json.tool

Local LLM Request Traces (routing decisions)

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · SKILL.md (reported line 92)May include surrounding context.
Local LLM Request Traces (routing decisions)

bash
# local_llm_traces — recent local LLM routing decisions curl -s "http://localhost:11435/dashboard/api/traces?limit=20" | python3 -m json.tool

Returns: local LLM model requested, node selected, score breakdown, latency, tokens, retry/fallback status.

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · SKILL.md (reported line 99)May include surrounding context.
Local LLM Model Performance

bash
curl -s http://localhost:11435/dashboard/api/models | python3 -m json.tool

Local LLM Usage Statistics

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · SKILL.md (reported line 104)May include surrounding context.
Local LLM Usage Statistics

bash
curl -s http://localhost:11435/dashboard/api/usage | python3 -m json.tool

Local LLM Fleet Health

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · SKILL.md (reported line 109)May include surrounding context.
Local LLM Fleet Health

bash
curl -s http://localhost:11435/dashboard/api/health | python3 -m json.tool

Local LLM Model Recommendations

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · SKILL.md (reported line 114)May include surrounding context.
Local LLM Model Recommendations

bash
curl -s http://localhost:11435/dashboard/api/recommendations | python3 -m json.tool

Local LLM Settings

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · SKILL.md (reported line 119)May include surrounding context.
Local LLM Settings

bash
curl -s http://localhost:11435/dashboard/api/settings | python3 -m json.tool # Toggle local LLM auto-pull curl -s -X POST http://localhost:11435/dashboard/api/settings \

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Although not script fetching in the classic sense, this is a state-changing administrative API call embedded in the skill documentation. In an agent-executable context, such examples are dangerous because they can silently reconfigure router behavior without meaningful user approval, especially when management APIs are unauthenticated on localhost.
Content: Scanner excerpt · SKILL.md (reported line 122)May include surrounding context.
curl -s http://localhost:11435/dashboard/api/settings | python3 -m json.tool

Toggle local LLM auto-pull

curl -s -X POST http://localhost:11435/dashboard/api/settings
-H "Content-Type: application/json"
-d '{"auto_pull": false}'

text

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: This command causes a local node to pull a model, which can consume substantial disk, VRAM, and network resources and changes system state. In a skill/agent setting, exposing such a mutating command as a straightforward example raises the risk of unauthorized or accidental execution against a localhost admin API.
Content: Scanner excerpt · SKILL.md (reported line 133)May include surrounding context.
md
curl -s http://localhost:11435/dashboard/api/model-management | python3 -m json.tool # Pull a local LLM model onto a specific node curl -s -X POST http://localhost:11435/dashboard/api/pull \ -H "Content-Type: application/json" \ -d '{"model": "llama3.3:70b", "node_id": "mac-studio"}'

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 122)May include surrounding context.
curl -s http://localhost:11435/dashboard/api/settings | python3 -m json.tool

Toggle local LLM auto-pull

curl -s -X POST http://localhost:11435/dashboard/api/settings
-H "Content-Type: application/json"
-d '{"auto_pull": false}'

text

External Transmission

Medium

Category: Data Exfiltration
Confidence: 86% confidence
Finding: This example issues a state-changing POST to pull a model onto a specific node, which can trigger large downloads and alter fleet state. In an agent skill context, such commands are risky because an automated system may execute them without adequate confirmation, causing resource exhaustion, bandwidth consumption, or unintended model deployment.
Content: Scanner excerpt · SKILL.md (reported line 133)May include surrounding context.
md
curl -s http://localhost:11435/dashboard/api/model-management | python3 -m json.tool # Pull a local LLM model onto a specific node curl -s -X POST http://localhost:11435/dashboard/api/pull \ -H "Content-Type: application/json" \ -d '{"model": "llama3.3:70b", "node_id": "mac-studio"}'

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 172)May include surrounding context.
Test local LLM inference

bash
# local LLM via OpenAI format curl -s http://localhost:11435/v1/chat/completions \ -H "Content-Type: application/json" \ -d '{"model":"llama3.3:70b","messages":[{"role":"user","content":"Hello from local LLM"}],"stream":false}'

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T08 · Insecure Dependencies

Vulnerability Details

Vulnerable Code

Technical Analysis

Attack Path

Impact Assessment

Remediation Suggestions

SkillSpector

External Script Fetching

Local LLM Fleet Status

List all local LLM models across the fleet

External Script Fetching

List all local LLM models across the fleet

Local LLM models currently loaded in memory (hot)

External Script Fetching

Local LLM models currently loaded in memory (hot)

OpenAI-compatible local LLM model list

External Script Fetching

OpenAI-compatible local LLM model list

Local LLM Request Traces (routing decisions)

External Script Fetching

Local LLM Request Traces (routing decisions)

External Script Fetching

Local LLM Model Performance

Local LLM Usage Statistics

External Script Fetching

Local LLM Usage Statistics

Local LLM Fleet Health

External Script Fetching

Local LLM Fleet Health

Local LLM Model Recommendations

External Script Fetching

Local LLM Model Recommendations

Local LLM Settings

External Script Fetching

Local LLM Settings

External Script Fetching

Toggle local LLM auto-pull

External Script Fetching

External Transmission

Toggle local LLM auto-pull

External Transmission

External Transmission

Test local LLM inference

Static analysis