ClawHub
Back to skill

Security audit

Qwen Qwen3 5

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward local Qwen/Ollama Herd setup guide, with the main caution being that it tells users to install and run an unpinned PyPI package.

Install only if you trust the ollama-herd PyPI package and repository. Prefer a virtual environment, pin a reviewed version if possible, and run the router or node only on trusted devices and networks because prompts, audio files, generated outputs, logs, and model activity may pass through the local fleet service.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:28
Finding

Unpinned Third-Party Package Installation and Immediate Execution

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 28–30
Vulnerability Type: Unpinned third-party dependency installation
Risk Level: Medium

bash
pip install ollama-herd    # PyPI: https://pypi.org/project/ollama-herd/
herd                       # start the router (port 11435)
herd-node                  # run on each device — finds the router automatically

Technical Analysis

The Quick Start instructions install the latest available ollama-herd package from PyPI without pinning a reviewed version or verifying package integrity with cryptographic hashes. They then instruct the user to execute the package-provided herd and herd-node entry points.

Consequently, the code that runs may differ from the code reviewed when the Skill was published. Although the package name and linked repository are consistent with the Skill's declared functionality, an attacker who compromises the publisher account, package release process, dependency chain, or package index delivery path could substitute malicious code.

This is not direct evidence that the current package is malicious. It is a supply-chain hardening deficiency that creates mutable, externally controlled code execution.

Attack Path

  1. An attacker compromises the ollama-herd PyPI publisher account, release pipeline, package artifact, or a transitive dependency.
  2. The attacker publishes or causes delivery of a malicious package version.
  3. A user follows the documented pip install ollama-herd instruction.
  4. Because no version or hashes are specified, pip installs the currently selected mutable release and its dependencies.
  5. The user runs herd or herd-node, activating attacker-controlled code.
  6. The malicious code operates with the permissions and accessible resources of the user who launched it.

Impact Assessment

Successful exploitation could allow arbitrary code execution with the installing user's privileges. Depending on that user's environment, the co ...[truncated 504 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin ollama-herd to a specifically reviewed version, for example:
    bash
    python3 -m pip install "ollama-herd==<reviewed-version>"
  2. Publish SHA-256 hashes for the reviewed wheel and use hash-enforced installation:
    bash
    python3 -m pip install --require-hashes -r requirements.txt
  3. Lock and review all transitive dependencies rather than allowing unconstrained resolution.
  4. Recommend installation in a dedicated virtual environment with ordinary user privileges:
    bash
    python3 -m venv .venv
. .venv/bin/activate
python3 -m pip install --require-hashes -r requirements.txt
  5. Document the expected package publisher, source repository, release tag, and artifact hashes so users can verify provenance.
  6. Separate installation from execution and advise users to inspect or verify the installed artifact before invoking its entry points.
  7. Use signed releases or package provenance attestations where available, and establish a documented process for updating the pinned version after security review.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 110)May include surrounding context.

Image generation

bash
curl -o image.png http://localhost:11435/api/generate-image \
  -d '{"model": "z-image-turbo", "prompt": "an AI assistant helping with code", "width": 1024, "height": 1024}'

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 124)May include surrounding context.

bash
curl -s http://localhost:11435/fleet/status | python3 -m json.tool
curl -s http://localhost:11435/dashboard/api/health | python3 -m json.tool

Dashboard at http://localhost:11435/dashboard.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 68)May include surrounding context.

bash
# Qwen 3.5 chat
curl http://localhost:11435/api/chat -d '{
  "model": "qwen3.5",
  "messages": [{"role": "user", "content": "Explain attention mechanisms"}],
  "stream": false

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The manifest description scopes the skill to running Qwen 3.5 models, including coder and ASR variants, on a local fleet. The file later promotes additional capabilities for other models and modalities, including image generation and text embeddings, which go beyond that stated Qwen-specific purpose.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 110)May include surrounding context.

Image generation

bash
curl -o image.png http://localhost:11435/api/generate-image \
  -d '{"model": "z-image-turbo", "prompt": "an AI assistant helping with code", "width": 1024, "height": 1024}'