ClawHub
Back to skill

Security audit

Ollama Proxy

Security checks for vulnerabilities and agentic risk

Overview

This skill documents a local-network Ollama proxy, with its install, routing, and local storage behavior disclosed and aligned with that purpose.

Install it in a virtual environment or container when possible, review the `ollama-herd` package/source before production use, and only route prompts through a proxy host and local network you trust.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:23
Finding

Unpinned Third-Party Package Installation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 23
Vulnerability Type: Unpinned and unverified third-party dependency
Risk Level: Medium

bash
pip install ollama-herd    # PyPI: https://pypi.org/project/ollama-herd/

Technical Analysis

The installation instructions retrieve and install the latest available ollama-herd package from PyPI without pinning an audited version or verifying an integrity hash. This makes installations non-reproducible and exposes users to supply-chain threats, including compromise of the package publisher, malicious replacement of a future release, or compromise of a transitive dependency.

The installed package supplies the herd and herd-node executables that users are subsequently instructed to run. Consequently, malicious code introduced into the package or its dependency chain could execute with the privileges of the user performing the installation and operating the services.

Attack Path

  1. An attacker compromises the PyPI package, its publisher account, or a transitive dependency.
  2. The attacker publishes a malicious release that remains compatible with the unversioned package name.
  3. A user follows the documented pip install ollama-herd instruction.
  4. Pip resolves and installs the attacker-controlled release or dependency.
  5. The user runs herd or herd-node, causing the installed malicious code to execute.
  6. The malicious package can access resources available to that user, potentially including local files, model requests, Ollama services, and reachable fleet nodes.

Impact Assessment

Exploitation could result in arbitrary code execution under the installing or service user account. The accessible scope includes that user's files, environment variables, local Ollama traffic, and network resources reachable from the host. If installation or service execution is performed with elevated privileges, the impact would increase accordingly. T ...[truncated 271 chars]

Remediation
View remediation

Remediation Suggestions

  • Pin ollama-herd to a specific version that has undergone security review.
  • Require cryptographic hashes, such as through a locked requirements file used with pip install --require-hashes.
  • Pin and review transitive dependencies to make installations reproducible.
  • Document the expected package publisher, source repository, release tag, and package digest so users can verify provenance.
  • Recommend installation in a dedicated virtual environment or isolated container under a non-privileged service account.
  • Use a controlled internal package mirror or trusted artifact registry for production deployments.
  • Establish a dependency-update process that reviews release changes before updating the pinned version.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 127)May include surrounding context.

bash
# Ollama proxy fleet overview
curl -s http://ollama-proxy:11435/fleet/status | python3 -m json.tool

# Ollama proxy health checks
curl -s http://ollama-proxy:11435/dashboard/api/health | python3 -m json.tool

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 130)May include surrounding context.

curl -s http://ollama-proxy:11435/fleet/status | python3 -m json.tool

Ollama proxy health checks

curl -s http://ollama-proxy:11435/dashboard/api/health | python3 -m json.tool

text

## Full documentation

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 42)May include surrounding context.

bash
# Chat via Ollama proxy (same as direct Ollama)
curl http://ollama-proxy:11435/api/chat -d '{
  "model": "llama3.3:70b",
  "messages": [{"role": "user", "content": "Hello via Ollama proxy"}]
}'