ClawHub
Back to skill

Security audit

Self Hosted Ai

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent self-hosted AI setup guide, with expected local API and package-install steps but no evidence of hidden exfiltration or destructive behavior.

Before installing, verify the PyPI/tool packages and consider using an isolated virtual environment or tool environment. Be aware that herd-node performs local-network discovery and that prompts, audio, and documents will be processed by the local service you run.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:34
Finding

Unpinned Third-Party Packages Are Installed and Executed

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:34-36 and SKILL.md:67-68
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

The Skill instructs users to retrieve mutable third-party packages from external registries without version pins, hashes, lockfiles, or provenance verification. It then directs users to execute binaries installed by one of those packages.

bash
pip install ollama-herd    # Self-hosted AI router from PyPI
herd                       # start the self-hosted router
herd-node                  # run on each self-hosted machine — auto-discovers the router

Additional unpinned packages are installed for image-generation functionality:

bash
uv tool install mflux           # Self-hosted Flux models (~7s)
uv tool install diffusionkit    # Self-hosted Stable Diffusion 3/3.5

Technical Analysis

Package names without exact versions resolve to whatever release the external registry serves at installation time. Consequently, the code users execute can change after the Skill has been reviewed. Package installation may also execute package build hooks or install transitive dependencies, while the subsequent herd and herd-node commands directly execute newly downloaded code.

This creates a software supply-chain risk. Compromise of a package publisher account, registry entry, release process, or transitive dependency could replace an expected package with attacker-controlled code. The documentation provides no hash verification, signed-release validation, dependency lockfile, or reviewed version constraint to detect such a substitution.

Installing dependencies is relevant to the declared self-hosted AI functionality, so the behavior is not inherently malicious. However, immediately installing and executing mutable remote packages exceeds what is necessary for merely documenting or querying the local API and lacks reasonable integrity controls.

The commands at `SK ...[truncated 2166 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin every directly installed package to a reviewed, exact version, for example ollama-herd==X.Y.Z, and document a controlled update process.
  2. Provide cryptographic hashes through a hash-locked requirements file or an equivalent package-manager lockfile, and require hash verification during installation.
  3. Pin and review transitive dependencies rather than relying only on top-level version constraints.
  4. Link to the official registry records and signed source releases so users can verify package provenance and publisher identity.
  5. Recommend installation in an isolated virtual environment or dedicated tool environment under an unprivileged account.
  6. Separate installation from execution and instruct users to inspect package metadata, signatures, hashes, and release notes before launching newly installed binaries.
  7. Pin mflux and diffusionkit versions and apply the same integrity verification used for ollama-herd.
  8. Document the ports, local-network discovery behavior, filesystem paths, and network permissions required by herd and herd-node, allowing users to restrict execution to the minimum necessary access.
  9. Avoid administrator or root installation and execution unless a specifically documented feature strictly requires it.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (4)

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 126)May include surrounding context.

bash
# Self-hosted fleet overview
curl -s http://localhost:11435/fleet/status | python3 -m json.tool

# Self-hosted health checks
curl -s http://localhost:11435/dashboard/api/health | python3 -m json.tool

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 129)May include surrounding context.

md
curl -s http://localhost:11435/fleet/status | python3 -m json.tool

# Self-hosted health checks
curl -s http://localhost:11435/dashboard/api/health | python3 -m json.tool

# Self-hosted model recommendations for your hardware
curl -s http://localhost:11435/dashboard/api/recommendations | python3 -m json.tool

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 132)May include surrounding context.

curl -s http://localhost:11435/dashboard/api/health | python3 -m json.tool

Self-hosted model recommendations for your hardware

curl -s http://localhost:11435/dashboard/api/recommendations | python3 -m json.tool

text

Self-hosted dashboard at `http://localhost:11435/dashboard` for visual monitoring of your entire self-hosted fleet.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 56)May include surrounding context.

Self-hosted Ollama API

bash
curl http://localhost:11435/api/chat -d '{
  "model": "deepseek-r1:70b",
  "messages": [{"role": "user", "content": "Explain self-hosted AI advantages over cloud APIs"}],
  "stream": false

Static analysis

No suspicious patterns detected.