ClawHub
Back to skill

Security audit

Mac Studio Ai

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent local Mac Studio AI setup guide, with visible LAN HTTP and package-install risks users should understand before using it.

Install the packages in an isolated environment where practical, review or pin package versions for production use, and expose the Mac Studio API only on a trusted LAN or VPN. Avoid sending sensitive prompts, recordings, or documents over plaintext HTTP unless you have added network controls, authentication, or TLS.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:27
Finding

Unpinned Third-Party Packages Are Installed and Executed

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 27 and 37-38
Vulnerability Type: Unpinned dependency installation and supply-chain exposure
Risk Level: Medium

Vulnerable Code

bash
pip install ollama-herd    # install on your Mac Studio
bash
uv tool install mflux           # Flux models (~5s at 512px on Mac Studio M4 Ultra)
uv tool install diffusionkit    # Stable Diffusion 3/3.5 on Mac Studio

Technical Analysis

The setup instructions install three third-party packages without specifying reviewed versions or integrity hashes. Package installation can execute package-controlled build or installation logic with the privileges of the user running pip or uv.

The audit found no evidence that the named packages are currently malicious, typo-squatted, or obtained from a deliberately unsafe package repository. Nevertheless, resolving an unrestricted latest release means that the effective code users install can change after the Skill has been reviewed. This creates exposure to package-registry compromise, maintainer-account compromise, malicious future releases, and unexpected dependency changes.

These commands do not request administrator privileges. The relevant privilege boundary is therefore the invoking user's account and any files, credentials, network services, or configuration accessible to that account.

Attack Path

  1. An attacker compromises a package maintainer account, package registry entry, or transitive dependency.
  2. The attacker publishes a malicious release under one of the unrestricted package names.
  3. A user follows the Skill's installation instructions after that release becomes the version selected by the installer.
  4. pip or uv downloads the changed package and executes package-controlled installation or runtime code.
  5. The malicious code operates with the invoking user's permissions and can access resources available to that user.

Imp

...[truncated 565 chars]

Remediation
View remediation

Remediation Suggestions

  • Pin every package to a specific, reviewed version rather than implicitly installing the latest release.
  • Provide a lockfile containing exact direct and transitive dependency versions.
  • Use cryptographic hashes where the selected installer supports hash verification.
  • State the expected package registry explicitly and prohibit untrusted extra indexes.
  • Recommend installation inside an isolated virtual environment or tool-managed environment.
  • Avoid invoking package installers with sudo or from an administrator shell.
  • Establish a documented dependency-review and update process before changing pinned versions.

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:47
Finding

AI Inputs and Operational Data Are Transmitted Over Unauthenticated Plaintext HTTP

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 47-48, 62-77, 84-94, 103, 114, and 118-121
Vulnerability Type: Plaintext transmission and absent API authentication
Risk Level: Medium

Vulnerable Code

python
# Connect to Mac Studio running Ollama Herd
mac_studio = OpenAI(base_url="http://mac-studio:11435/v1", api_key="not-needed")
bash
# Flux via mflux — ~5s on Mac Studio M4 Ultra
curl -o mac_studio_art.png http://mac-studio:11435/api/generate-image \
  -H "Content-Type: application/json" \
  -d '{"model": "z-image-turbo", "prompt": "a Mac Studio on a minimalist desk with holographic AI display", "width": 1024, "height": 1024}'

# Stable Diffusion 3 on Mac Studio — ~9s
curl -o mac_studio_sd3.png http://mac-studio:11435/api/generate-image \
  -H "Content-Type: application/json" \
  -d '{"model": "sd3-medium", "prompt": "Mac Studio M4 Ultra rendering AI art", "width": 1024, "height": 1024, "steps": 20}'
bash
# Transcribe on Mac Studio via Qwen3-ASR
curl http://mac-studio:11435/api/transcribe \
  -F "file=@mac_studio_meeting.wav" \
  -F "model=qwen3-asr"
bash
# Generate embeddings on Mac Studio
curl http://mac-studio:11435/api/embed \
  -d '{"model": "nomic-embed-text", "input": "Mac Studio M4 Ultra unified memory AI inference"}'
bash
# Mac Studio fleet status
curl -s http://mac-studio:11435/fleet/status | python3 -m json.tool

# Mac Studio health checks
curl -s http://mac-studio:11435/dashboard/api/health | python3 -m json.tool

Technical Analysis

The documented API connections use plaintext HTTP, and the OpenAI-compatible client explicitly supplies the placeholder credential api_key="not-needed". The examples transmit prompts, embedding inputs, image-generation parameters, meeting audio, model requests, and fleet status across the local network without transport encryption.

A local network does not inherently provide ...[truncated 2495 chars]

Remediation
View remediation

Remediation Suggestions

  • Serve the API over HTTPS and require clients to verify the server certificate.
  • Use a private certificate authority or securely provisioned certificates for LAN deployments.
  • Require a unique API token or mutually authenticated TLS instead of documenting api_key="not-needed".
  • Bind the service only to required interfaces and restrict port 11435 with host and network firewalls.
  • Segment the AI service onto a trusted network or VPN rather than relying on LAN membership alone.
  • Apply authorization separately to inference, transcription, dashboard, health, and fleet-status endpoints.
  • Warn users not to submit sensitive prompts, recordings, or documents over plaintext or untrusted networks.
  • Avoid silent curl -s examples for diagnostic requests, or use options that clearly report transport and HTTP failures.
  • Qualify the statement that requests “stay local” so it does not imply encryption, authentication, or confidentiality.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 118)May include surrounding context.

bash
# Mac Studio fleet status
curl -s http://mac-studio:11435/fleet/status | python3 -m json.tool

# Mac Studio health checks
curl -s http://mac-studio:11435/dashboard/api/health | python3 -m json.tool

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 121)May include surrounding context.

curl -s http://mac-studio:11435/fleet/status | python3 -m json.tool

Mac Studio health checks

curl -s http://mac-studio:11435/dashboard/api/health | python3 -m json.tool

text

Example Mac Studio fleet status response:

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 65)May include surrounding context.

bash
# Flux via mflux — ~5s on Mac Studio M4 Ultra
curl -o mac_studio_art.png http://mac-studio:11435/api/generate-image \
  -H "Content-Type: application/json" \
  -d '{"model": "z-image-turbo", "prompt": "a Mac Studio on a minimalist desk with holographic AI display", "width": 1024, "height": 1024}'