ClawHub
Back to skill

Security audit

Ollama Herd

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent Ollama fleet management helper, with normal local service commands and some install/supply-chain cautions but no artifact-backed malicious behavior.

Install in a virtual environment where practical, consider pinning ollama-herd to the reviewed version 1.5.3, and only let the agent pull/delete models or send prompts through the router when you intended that action. Treat the local router and fleet nodes as trusted because request traces and prompts may be visible through the documented APIs.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:16
Finding

Unpinned Third-Party Package Installation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 16
Vulnerability Type: Unpinned dependency installation from a mutable package registry
Risk Level: Medium

Vulnerable Code:

bash
pip install ollama-herd          # install Ollama Herd from PyPI
herd                             # start the Ollama router
herd-node                        # start an Ollama node agent (run on each device)

Technical Analysis

The installation instructions retrieve ollama-herd from PyPI without specifying an audited version or verifying package integrity. Because the package reference is mutable, a future release or compromised registry account could introduce behavior that was not present when this Skill was reviewed.

Python package installation can invoke package-controlled build backend logic. The instructions also immediately run the installed herd and herd-node entry points. Consequently, malicious package code could execute with the privileges of the user performing the installation.

The flagged pipelines at lines 34, 47, and 65 are not remote script execution. Commands such as:

bash
curl -s http://localhost:11435/fleet/status | python3 -m json.tool

pass a localhost HTTP response to Python's standard JSON formatter rather than to a shell. These read-only requests are consistent with the Skill's fleet-monitoring purpose and do not independently constitute remote payload retrieval and execution.

Attack Path

  1. An attacker compromises the PyPI publisher account, package release process, or another relevant supply-chain component.
  2. The attacker publishes a malicious version of ollama-herd under the existing package name.
  3. A user follows the documented pip install ollama-herd instruction.
  4. Pip retrieves the current attacker-controlled release because no version or cryptographic hash is required.
  5. Malicious code may execute during package build or installation, or when th ...[truncated 687 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin the dependency to a specifically reviewed release, for example:
    bash
    python3 -m pip install "ollama-herd==1.5.3"
  2. Publish a lock file containing cryptographic hashes and install with hash enforcement:
    bash
    python3 -m pip install --require-hashes -r requirements.lock
  3. Verify that the pinned PyPI artifact corresponds to the reviewed source revision and document the expected artifact hashes.
  4. Prefer installation inside an isolated virtual environment rather than a system-wide or privileged Python environment.
  5. Avoid administrator or root installation unless it is demonstrably required.
  6. Document a controlled update process in which new package releases are reviewed and their hashes updated before users install them.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (16)

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 29)May include surrounding context.

Ollama API endpoints

Use curl to interact with the Ollama fleet:

Ollama fleet status — overview of all Ollama nodes and queues

bash

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 47)May include surrounding context.

List all Ollama models available across the fleet

bash
# ollama_model_list — all Ollama models on all nodes
curl -s http://localhost:11435/api/tags | python3 -m json.tool

Pull an Ollama model onto the fleet

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 53)May include surrounding context.

Pull an Ollama model onto the fleet

bash
# ollama_pull_model — pull a model (auto-selects best node, streams progress)
curl -N http://localhost:11435/api/pull -d '{"name": "codestral"}'

# pull to a specific node
curl -N http://localhost:11435/api/pull -d '{"name": "llama3.3:70b", "node_id": "mac-studio"}'

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 70)May include surrounding context.

OpenAI-compatible Ollama model list

bash
curl -s http://localhost:11435/v1/models | python3 -m json.tool

Ollama usage statistics (per-node, per-model daily aggregates)

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 75)May include surrounding context.

Ollama usage statistics (per-node, per-model daily aggregates)

bash
curl -s http://localhost:11435/dashboard/api/usage | python3 -m json.tool

Recent Ollama request traces

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 81)May include surrounding context.

Recent Ollama request traces

bash
# ollama_traces — recent Ollama routing decisions
curl -s "http://localhost:11435/dashboard/api/traces?limit=20" | python3 -m json.tool

Returns the last N Ollama routing decisions with: model requested, node selected, score, latency, tokens, retry/fallback status, tags.

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 88)May include surrounding context.

Ollama fleet health analysis

bash
curl -s http://localhost:11435/dashboard/api/health | python3 -m json.tool

Returns 15 automated Ollama health checks: offline/degraded nodes, memory pressure, underutilized nodes, VRAM fallbacks, KV cache bloat (OLLAMA_NUM_PARALLEL too high), version mismatch, context protection, zombie reaper, Ollama model thrashing, request timeouts, error rates, retry rates, client disconnects, and incomplete streams.

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 95)May include surrounding context.

Ollama model recommendations

bash
curl -s http://localhost:11435/dashboard/api/recommendations | python3 -m json.tool

Returns AI-powered Ollama model mix recommendations per node based on hardware capabilities, Ollama usage patterns, and curated benchmark data.

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 103)May include surrounding context.

Ollama settings

bash
# View current Ollama config and node versions
curl -s http://localhost:11435/dashboard/api/settings | python3 -m json.tool

# Toggle Ollama runtime settings (auto_pull, vram_fallback)
curl -s -X POST http://localhost:11435/dashboard/api/settings \

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 106)May include surrounding context.

curl -s http://localhost:11435/dashboard/api/settings | python3 -m json.tool

Toggle Ollama runtime settings (auto_pull, vram_fallback)

curl -s -X POST http://localhost:11435/dashboard/api/settings
-H "Content-Type: application/json"
-d '{"auto_pull": false}'

text

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 117)May include surrounding context.

md
curl -s http://localhost:11435/dashboard/api/model-management | python3 -m json.tool

# Pull an Ollama model onto a specific node
curl -s -X POST http://localhost:11435/dashboard/api/pull \
  -H "Content-Type: application/json" \
  -d '{"model": "llama3.3:70b", "node_id": "mac-studio"}'

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 134)May include surrounding context.

Per-app Ollama analytics (requires request tagging)

bash
curl -s http://localhost:11435/dashboard/api/apps | python3 -m json.tool

Ollama Dashboard

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 53)May include surrounding context.

Pull an Ollama model onto the fleet

bash
# ollama_pull_model — pull a model (auto-selects best node, streams progress)
curl -N http://localhost:11435/api/pull -d '{"name": "codestral"}'

# pull to a specific node
curl -N http://localhost:11435/api/pull -d '{"name": "llama3.3:70b", "node_id": "mac-studio"}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 106)May include surrounding context.

curl -s http://localhost:11435/dashboard/api/settings | python3 -m json.tool

Toggle Ollama runtime settings (auto_pull, vram_fallback)

curl -s -X POST http://localhost:11435/dashboard/api/settings
-H "Content-Type: application/json"
-d '{"auto_pull": false}'

text

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 117)May include surrounding context.

md
curl -s http://localhost:11435/dashboard/api/model-management | python3 -m json.tool

# Pull an Ollama model onto a specific node
curl -s -X POST http://localhost:11435/dashboard/api/pull \
  -H "Content-Type: application/json" \
  -d '{"model": "llama3.3:70b", "node_id": "mac-studio"}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 197)May include surrounding context.

Test Ollama inference through the fleet

bash
# Ollama via OpenAI format
curl -s http://localhost:11435/v1/chat/completions \
  -H "Content-Type: application/json" \
  -d '{"model":"llama3.3:70b","messages":[{"role":"user","content":"Hello from Ollama"}],"stream":false}'