Ollama — Herd Your LLMs Into One Smart Endpoint

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 4:09 AM UTC
• Version: 1.0.0

Overview

This skill is a coherent Ollama fleet-routing helper, with expected but important privacy and supply-chain considerations.

Install only in an isolated Python environment or with a pinned reviewed package version. Treat prompts, files, audio, images, metadata, and outputs as visible to any trusted fleet node that may handle the request, and confirm before allowing model downloads because they can consume substantial bandwidth and disk space.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:16

Finding

Unpinned Third-Party Package Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 16
Vulnerability Type: Unpinned third-party dependency installation
Risk Level: Medium

Vulnerable Code Snippet:

bash

pip install ollama-herd

Technical Analysis

The setup instructions install ollama-herd directly from the default Python Package Index without specifying an exact version or validating package hashes. Because the executable package source is not included in the audited project, its installation behavior and runtime implementation cannot be verified from this artifact.

An unpinned installation resolves to whichever release the package index serves at installation time. If the publisher account, package distribution process, package index, or a future release is compromised, users following these instructions could install attacker-controlled code. Python package installation may execute package-controlled build logic, and the installed commands (herd and herd-node) subsequently execute with the privileges of the invoking user.

This finding does not establish that the current ollama-herd package is malicious. It identifies a supply-chain weakness caused by mutable dependency resolution and the absence of integrity verification.

Attack Path

1. An attacker compromises the package publisher account, release pipeline, or another component of the package distribution channel.
2. The attacker publishes a malicious release under the expected ollama-herd package name.
3. A user or agent follows the setup instruction and runs pip install ollama-herd.
4. Pip resolves and downloads the attacker-controlled release because no version or hash is constrained.
5. Malicious build or installation logic executes, or malicious behavior runs when the user starts herd or herd-node.
6. The payload operates with the privileges and accessible resources of the user who performed the installation or launched the installed commands.

...[truncated 541 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the dependency to a reviewed, exact version rather than installing the latest mutable release.

• Publish a locked requirements file containing approved cryptographic hashes, and install it with pip's --require-hashes option.

• Example hardened workflow:

  bash

  python3 -m venv .venv
  . .venv/bin/activate
  python3 -m pip install --require-hashes -r requirements.txt
  

• Review the selected source release and its build configuration before approving its hashes.

• Run the router and node agents under a dedicated, non-privileged account with access limited to required files and network destinations.

• Avoid installing the package with root privileges or into the system Python environment.

• Use an internally controlled package mirror or vendored, reviewed artifact where stronger supply-chain assurance is required.

• Add an upgrade process that requires explicit review, integrity verification, and testing before changing the pinned version.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (4)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill markets a single local endpoint but does not clearly warn users that prompts and inputs may be routed to multiple machines and that operational data may be written to local fleet-manager files. In a multi-node LLM setup, this changes the trust boundary and can expose sensitive prompts, metadata, or outputs to additional hosts and logs without informed user consent.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 46)May include surrounding context.

bash

# Chat
curl http://localhost:11435/api/chat -d '{
  "model": "qwen3:235b",
  "messages": [{"role": "user", "content": "Hello"}],
  "stream": false

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documented auto-pull behavior means the system may download models automatically, causing unannounced network activity and local storage changes. Without a clear warning and opt-in, users may trigger large downloads, consume bandwidth, alter disk state, and fetch artifacts from external sources unexpectedly.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 112)May include surrounding context.

Image generation

bash

curl -o image.png http://localhost:11435/api/generate-image \
  -H "Content-Type: application/json" \
  -d '{"model":"z-image-turbo","prompt":"a sunset","width":1024,"height":1024,"steps":4}'