ClawHub
Back to skill

Security audit

Ollama Load Balancer

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent Ollama load-balancer operations guide with disclosed local service commands, but users should treat package installation and model-management actions carefully.

Install in a virtual environment, pin and review the ollama-herd package version before running it, avoid elevated privileges, and require explicit approval before changing settings or pulling/deleting models because those actions can affect fleet behavior, storage, and network usage.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:27
Finding

Unpinned Third-Party Package Installation Creates a Supply-Chain Execution Risk

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 27-29
Vulnerability Type: Unpinned dependency installation from a mutable external package registry
Risk Level: Medium

Complete Code Snippet:

bash
pip install ollama-herd
herd              # start the load balancer on port 11435
herd-node         # start load balancer backend node on each machine

Technical Analysis

The deployment instructions install ollama-herd from PyPI without specifying an exact version or verifying an artifact hash. Consequently, the code installed by this command can change independently of the reviewed Skill document.

Installing the load-balancer package is necessary for the declared functionality, but accepting an unconstrained current release is not necessary. If the package, its maintainer account, release process, or dependency chain is compromised, a subsequent installation could retrieve attacker-controlled content. Python package installation may invoke build-system behavior, while the subsequent herd and herd-node commands directly execute console entry points supplied by the installed package.

This is not a curl | bash vulnerability. The flagged curl commands elsewhere in the document retrieve JSON from localhost and pass it to Python JSON parsers; no remote shell script is piped into a shell. The confirmed concern is instead the mutable and unverified PyPI dependency.

Attack Path

  1. An attacker compromises the ollama-herd PyPI project, a maintainer account, its build or release pipeline, or a dependency selected during installation.
  2. The attacker publishes a malicious release that remains compatible with the unrestricted package name.
  3. A user follows the Skill instructions and runs pip install ollama-herd.
  4. pip resolves and installs the attacker-controlled release because no trusted version or hash is specified.
  5. Malicious behavior may run during package build or installat ...[truncated 1011 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin the package to a reviewed, exact version, for example:

    bash
    python3 -m pip install "ollama-herd==1.0.4"

  2. Prefer a locked requirements file containing cryptographic hashes, and install with hash enforcement:

    bash
    python3 -m pip install --require-hashes -r requirements.lock

  3. Publish and document the expected SHA-256 hashes for all permitted wheels, including platform-specific artifacts where applicable.

  4. Install the package inside a dedicated virtual environment rather than the system Python environment:

    bash
    python3 -m venv .venv
. .venv/bin/activate
python3 -m pip install --require-hashes -r requirements.lock

  5. Avoid sudo pip install and explicitly state that the service should run as a dedicated, non-privileged account with only the filesystem and network access required for load balancing.

  6. Review release provenance, package ownership, build metadata, and transitive dependencies before updating the pinned version. Where available, verify signed provenance or trusted-publisher metadata.

  7. Separate installation from execution in the instructions and advise users to inspect the resolved package and dependency set before running herd or herd-node.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (15)

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 47)May include surrounding context.

Fleet-wide load balancer health check (15 automated checks)

bash
curl -s http://localhost:11435/dashboard/api/health | python3 -m json.tool

The load balancer checks: offline nodes, degraded nodes, memory pressure, underutilized nodes, model thrashing, request timeouts, error rates. Each load balancer check returns severity (info/warning/critical) and recommendations.

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 54)May include surrounding context.

Load balancer node status and metrics

bash
curl -s http://localhost:11435/fleet/status | python3 -m json.tool

Returns per-node: status (online/degraded/offline), CPU utilization, memory usage, loaded models with context lengths, and load balancer queue depths (pending/in-flight/done/failed).

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 61)May include surrounding context.

Load balancer node status and metrics

bash
curl -s http://localhost:11435/fleet/status | python3 -m json.tool

Returns per-node: status (online/degraded/offline), CPU utilization, memory usage, loaded models with context lengths, and load balancer queue depths (pending/in-flight/done/failed).

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 84)May include surrounding context.

Models available through the load balancer

bash
# All models across the load-balanced fleet
curl -s http://localhost:11435/api/tags | python3 -m json.tool

# Models currently loaded in load balancer backend memory
curl -s http://localhost:11435/api/ps | python3 -m json.tool

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 87)May include surrounding context.

md
curl -s http://localhost:11435/api/tags | python3 -m json.tool

# Models currently loaded in load balancer backend memory
curl -s http://localhost:11435/api/ps | python3 -m json.tool

# OpenAI-compatible model list via load balancer
curl -s http://localhost:11435/v1/models | python3 -m json.tool

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 90)May include surrounding context.

curl -s http://localhost:11435/api/ps | python3 -m json.tool

OpenAI-compatible model list via load balancer

curl -s http://localhost:11435/v1/models | python3 -m json.tool

text

### Load balancer request traces

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 95)May include surrounding context.

Load balancer request traces

bash
curl -s "http://localhost:11435/dashboard/api/traces?limit=20" | python3 -m json.tool

Load balancer usage statistics

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 100)May include surrounding context.

Load balancer usage statistics

bash
curl -s http://localhost:11435/dashboard/api/usage | python3 -m json.tool

Load balancer model recommendations

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 105)May include surrounding context.

Load balancer model recommendations

bash
curl -s http://localhost:11435/dashboard/api/recommendations | python3 -m json.tool

Load balancer settings (runtime toggles)

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 111)May include surrounding context.

Load balancer settings (runtime toggles)

bash
# View load balancer config
curl -s http://localhost:11435/dashboard/api/settings | python3 -m json.tool

# Toggle load balancer features
curl -s -X POST http://localhost:11435/dashboard/api/settings \

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 114)May include surrounding context.

curl -s http://localhost:11435/dashboard/api/settings | python3 -m json.tool

Toggle load balancer features

curl -s -X POST http://localhost:11435/dashboard/api/settings
-H "Content-Type: application/json"
-d '{"auto_pull": false}'

text

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 125)May include surrounding context.

md
curl -s http://localhost:11435/dashboard/api/model-management | python3 -m json.tool

# Pull a model to a load balancer backend node
curl -s -X POST http://localhost:11435/dashboard/api/pull \
  -H "Content-Type: application/json" \
  -d '{"model": "llama3.3:70b", "node_id": "load-balancer-node-1"}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 114)May include surrounding context.

curl -s http://localhost:11435/dashboard/api/settings | python3 -m json.tool

Toggle load balancer features

curl -s -X POST http://localhost:11435/dashboard/api/settings
-H "Content-Type: application/json"
-d '{"auto_pull": false}'

text

External Transmission

Medium
Category
Data Exfiltration
Confidence
89% confidence
Finding

This command sends a state-changing POST request to a model-management endpoint that can trigger model downloads on backend nodes. In skill context, this is more dangerous because the skill presents operational commands an agent could execute, causing unexpected resource consumption, storage use, and network activity across the fleet.

Content

Scanner excerpt · SKILL.md (reported line 125)May include surrounding context.

md
curl -s http://localhost:11435/dashboard/api/model-management | python3 -m json.tool

# Pull a model to a load balancer backend node
curl -s -X POST http://localhost:11435/dashboard/api/pull \
  -H "Content-Type: application/json" \
  -d '{"model": "llama3.3:70b", "node_id": "load-balancer-node-1"}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 163)May include surrounding context.

Test load balancer inference

bash
curl -s http://localhost:11435/v1/chat/completions \
  -H "Content-Type: application/json" \
  -d '{"model":"llama3.3:70b","messages":[{"role":"user","content":"Test load balancing across nodes"}],"stream":false}'

Static analysis

No suspicious patterns detected.