ClawHub
Back to skill

Security audit

Ubuntu Ai

Security checks for vulnerabilities and agentic risk

Overview

The skill matches its local AI platform purpose, but it asks users to run unverified installers and create persistent, potentially root-level network services without enough scoping or hardening.

Review and harden the installation before using this skill. Prefer verified or packaged Ollama installation, pin and verify ollama-herd, use a virtual environment, run router/node services as an unprivileged user or foreground process where possible, and avoid opening port 11435 except to specific trusted hosts or a private network.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Findings (4)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:30
Finding

Unverified Remote Script Is Downloaded and Executed Directly

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:30
Vulnerability Type: Remote payload retrieval and immediate shell execution
Risk Level: High

Vulnerable Code:

bash
curl -fsSL https://ollama.ai/install.sh | sh

Technical Analysis

The installation command pipes a mutable script retrieved from an external URL directly into a shell. The script is neither pinned to a reviewed version nor verified using a cryptographic signature or checksum. The user also has no opportunity to inspect the downloaded content before execution.

Consequently, the effective payload may change after this Skill has been audited. HTTPS reduces passive network interception risk but does not protect against compromise of the hosting account, web server, release process, DNS/TLS trust chain, or installation endpoint.

Attack Path

  1. An attacker compromises the remote installation endpoint, its publishing process, or an associated trust component.
  2. The attacker replaces or modifies install.sh with malicious shell commands.
  3. A user follows the quick-start instructions.
  4. curl retrieves the attacker-controlled response and passes it directly to sh.
  5. The payload executes with the privileges of the invoking user and may request or obtain further elevation through commands embedded in the script.

Impact Assessment

Successful exploitation provides arbitrary command execution under the invoking account. Depending on the remote script's behavior and available elevation paths, this could lead to software installation, credential or data theft, configuration modification, additional payload deployment, or system-wide compromise. The impact applies to every machine on which the installation instruction is followed.

Remediation
View remediation

Remediation Suggestions

  • Prefer an official, signed package repository or a versioned release artifact.
  • Pin the installer or package to a specific reviewed version.
  • Download the artifact to disk rather than piping it directly into a shell.
  • Verify a publisher signature and a checksum obtained through an independent trusted channel.
  • Allow the user to inspect the script before execution.
  • Run installation with the lowest privileges possible and clearly document any operation that requires elevation.

T06 · System Persistence

Error
Location
SKILL.md:61
Finding

Root-Managed Boot-Persistent Services Execute Unhardened Third-Party Binaries

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:61-99
Vulnerability Type: System persistence and excessive service privileges
Risk Level: High

Vulnerable Code:

bash
# Ubuntu AI router service
sudo tee /etc/systemd/system/herd-router.service << 'EOF'
[Unit]
Description=Ubuntu AI Router
After=network.target ollama.service

[Service]
Type=simple
ExecStart=/usr/local/bin/herd
Restart=always
RestartSec=5

[Install]
WantedBy=multi-user.target
EOF

sudo systemctl enable --now herd-router
bash
# Ubuntu AI node service
sudo tee /etc/systemd/system/herd-node.service << 'EOF'
[Unit]
Description=Ubuntu AI Node
After=network.target ollama.service

[Service]
Type=simple
ExecStart=/usr/local/bin/herd-node
Restart=always
RestartSec=5

[Install]
WantedBy=multi-user.target
EOF

sudo systemctl enable --now herd-node

Technical Analysis

These instructions use sudo to write system-wide unit files and enable two services at boot. Because neither unit specifies a User or Group, systemd system services run as root by default. The services execute /usr/local/bin/herd and /usr/local/bin/herd-node, which are supplied by a separately installed third-party package.

The units also use Restart=always, causing systemd to relaunch the processes after normal exits or failures. Although persistence is consistent with the advertised optional goal of an always-on AI cluster, it is not necessary for basic local inference or temporary use. It therefore exceeds minimum privilege when presented without a lower-privilege alternative or an explicit security warning.

No systemd sandboxing directives, capability restrictions, dedicated service account, resource limits, or executable-integrity controls are included.

Attack Path

  1. A malicious or compromised package installs or replaces herd or herd-node under /usr/local/bin.
  2. The user creates ...[truncated 948 chars]
Remediation
View remediation

Remediation Suggestions

  • Make system service installation explicitly optional and provide foreground or user-service operation as the default.
  • Create a dedicated unprivileged account and set User= and Group= in each unit.
  • Ensure root owns the executable and its parent directories and that unprivileged users cannot modify them.
  • Pin and verify the installed package before registering its executables as services.
  • Add systemd hardening directives appropriate to required functionality, including:
    • NoNewPrivileges=true
    • ProtectSystem=strict
    • ProtectHome=true
    • PrivateTmp=true
    • ProtectKernelTunables=true
    • ProtectControlGroups=true
    • RestrictSUIDSGID=true
    • CapabilityBoundingSet= with only strictly required capabilities
  • Restrict writable paths with ReadWritePaths= rather than granting broad filesystem access.
  • Use bounded restart policies and rate limits instead of unconditional, indefinite restart behavior.
  • Document commands to disable and remove both services.

T08 · Insecure Dependencies

Error
Location
SKILL.md:33
Finding

Unpinned Third-Party Package Is Installed Without Integrity Verification

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:33, 41
Vulnerability Type: Insecure dependency installation
Risk Level: High

Vulnerable Code:

bash
# Install Ubuntu AI router
pip install ollama-herd
bash
pip install ollama-herd
herd-node     # auto-discovers the Ubuntu AI router

Technical Analysis

The instructions install ollama-herd by package name without pinning a version, verifying hashes, using a lock file, or identifying a trusted package index. The installed result can therefore change over time and may include newly introduced or compromised transitive dependencies.

The audited project contains only SKILL.md; it does not contain the package implementation. The behavior of the installed herd and herd-node executables therefore cannot be validated from this artifact. The risk is amplified because subsequent instructions register those executables as persistent system services.

The commands also do not create an isolated virtual environment. Depending on the host's Python and pip configuration, this can alter user-level or system-level Python environments and create dependency conflicts.

Attack Path

  1. An attacker compromises the ollama-herd publishing account, release pipeline, package index entry, or a transitive dependency.
  2. A malicious package version becomes the version selected by unpinned pip install.
  3. The user executes the documented installation command.
  4. Malicious installation or runtime code is placed on the machine.
  5. The documented systemd steps may then start the affected executables as root and preserve their execution across reboots.

Impact Assessment

Exploitation could initially execute code with the privileges used for package installation or invocation. When combined with the supplied systemd configuration, compromised package executables could receive persistent root-level execution. Other potential consequences inclu ...[truncated 175 chars]

Remediation
View remediation

Remediation Suggestions

  • Pin ollama-herd and all transitive dependencies to reviewed versions.
  • Supply a lock file or requirements file containing cryptographic hashes and install with hash enforcement.
  • Explicitly configure a trusted package index and validate publisher provenance.
  • Install into a dedicated virtual environment rather than the global Python environment.
  • Review the package's source and release artifacts before enabling its executables as services.
  • Use reproducible build and dependency-scanning processes.
  • Establish a controlled update procedure instead of implicitly installing the latest available release.

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:158
Finding

Firewall Instructions Broadly Expose an Apparently Unauthenticated AI Service

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:158-162
Vulnerability Type: Unrestricted network service exposure
Risk Level: Medium

Vulnerable Code:

bash
# Ubuntu UFW
sudo ufw allow 11435/tcp
sudo ufw reload

Related authentication example at SKILL.md:108-110:

python
# Your Ubuntu AI endpoint
client = OpenAI(base_url="http://localhost:11435/v1", api_key="not-needed")

Technical Analysis

ufw allow 11435/tcp permits inbound connections to port 11435 without restricting the source address or trusted network. If the router binds to a non-loopback interface, the inference, fleet-status, health, dashboard, image-generation, and embedding endpoints may become reachable by other hosts.

The documented SDK example states that an API key is not needed, and the documented URLs use plaintext HTTP. The artifact provides no compensating authentication, authorization, or TLS configuration. Opening this port globally is unnecessary for localhost-only use and is broader than required even for a cluster, where access can be restricted to known node addresses or a private subnet.

Attack Path

  1. A user installs the router and applies the unrestricted UFW rule.
  2. The router listens on an externally reachable interface.
  3. An attacker scans or otherwise discovers TCP port 11435.
  4. The attacker submits requests to exposed unauthenticated endpoints.
  5. The attacker consumes compute resources or accesses prompts, responses, monitoring information, or operational metadata exposed by the installed service.

The exact set of remotely accessible operations depends on the separately installed ollama-herd implementation, which is not included in the audited artifact.

Impact Assessment

Potential effects include unauthorized inference workloads, GPU or CPU resource exhaustion, denial of service, disclosure of model interactions and fleet metadata, and access to dashboard or health i ...[truncated 250 chars]

Remediation
View remediation

Remediation Suggestions

  • Bind the service to 127.0.0.1 by default and omit the firewall rule for local-only use.
  • For cluster operation, restrict UFW access to explicit trusted node addresses or a dedicated private subnet.
  • Require authenticated API access with securely generated, rotatable credentials.
  • Protect remote connections with TLS, a VPN, or a hardened authenticated reverse proxy.
  • Apply authorization separately to inference, monitoring, dashboard, and administrative endpoints.
  • Document the service's bind address and verify it before opening the firewall.
  • Add rate limits, request-size limits, audit logging, and compute quotas to reduce denial-of-service risk.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Rogue AgentSelf-Modification, Session Persistence
Findings (22)

External Script Fetching

High
Category
Supply Chain
Confidence
99% confidence
Finding

The skill instructs users to fetch a remote script over the network and pipe it directly into sh, which executes unreviewed code immediately. If the remote host, TLS trust chain, or delivery path is compromised, an attacker can achieve arbitrary code execution on the user's machine, likely with elevated impact because this is part of installation guidance.

Content

Scanner excerpt · SKILL.md (reported line 27)May include surrounding context.

bash
# Ubuntu prerequisites
sudo apt update
sudo apt install python3-pip curl

# Install Ollama on Ubuntu
curl -fsSL https://ollama.ai/install.sh | sh

Chaining Abuse

High
Category
Tool Misuse
Confidence
99% confidence
Finding

The explicit '| sh' chaining pattern turns downloaded network content directly into shell execution, removing any opportunity for user review or integrity validation. In installation documentation, this is especially dangerous because users are conditioned to copy-paste it, making supply-chain compromise or malicious content substitution immediately exploitable.

Content

Scanner excerpt · SKILL.md (reported line 30)May include surrounding context.

md
sudo apt install python3-pip curl

# Install Ollama on Ubuntu
curl -fsSL https://ollama.ai/install.sh | sh

# Install Ubuntu AI router
pip install ollama-herd

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 168)May include surrounding context.

bash
# Ubuntu AI fleet status
curl -s http://localhost:11435/fleet/status | python3 -m json.tool

# Ubuntu AI health — 15 automated checks
curl -s http://localhost:11435/dashboard/api/health | python3 -m json.tool

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 171)May include surrounding context.

md
curl -s http://localhost:11435/fleet/status | python3 -m json.tool

# Ubuntu AI health — 15 automated checks
curl -s http://localhost:11435/dashboard/api/health | python3 -m json.tool

# Ubuntu AI logs
journalctl -u herd-router -f

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 26)May include surrounding context.

bash
# Ubuntu prerequisites
sudo apt update
sudo apt install python3-pip curl

# Install Ollama on Ubuntu

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 27)May include surrounding context.

bash
# Ubuntu prerequisites
sudo apt update
sudo apt install python3-pip curl

# Install Ollama on Ubuntu

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 50)May include surrounding context.

bash
# Ubuntu prerequisites
sudo apt update
sudo apt install python3-pip curl

# Install Ollama on Ubuntu

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 51)May include surrounding context.

bash
# Ubuntu prerequisites
sudo apt update
sudo apt install python3-pip curl

# Install Ollama on Ubuntu

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 64)May include surrounding context.

bash
# Ubuntu prerequisites
sudo apt update
sudo apt install python3-pip curl

# Install Ollama on Ubuntu

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 79)May include surrounding context.

bash
# Ubuntu prerequisites
sudo apt update
sudo apt install python3-pip curl

# Install Ollama on Ubuntu

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 84)May include surrounding context.

bash
# Ubuntu prerequisites
sudo apt update
sudo apt install python3-pip curl

# Install Ollama on Ubuntu

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 99)May include surrounding context.

bash
# Ubuntu prerequisites
sudo apt update
sudo apt install python3-pip curl

# Install Ollama on Ubuntu

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 149)May include surrounding context.

bash
# Ubuntu prerequisites
sudo apt update
sudo apt install python3-pip curl

# Install Ollama on Ubuntu

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 153)May include surrounding context.

bash
# Ubuntu prerequisites
sudo apt update
sudo apt install python3-pip curl

# Install Ollama on Ubuntu

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 160)May include surrounding context.

bash
# Ubuntu prerequisites
sudo apt update
sudo apt install python3-pip curl

# Install Ollama on Ubuntu

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 161)May include surrounding context.

bash
# Ubuntu prerequisites
sudo apt update
sudo apt install python3-pip curl

# Install Ollama on Ubuntu

Session Persistence

Medium
Category
Rogue Agent
Confidence
90% confidence
Finding

The skill enables the herd-router service to start immediately and persist across reboots. Persistence is expected for a server component, but without a prominent explanation of network binding, authentication, and rollback steps, this can leave a continuously running local API/dashboard available longer than users realize.

Content

Scanner excerpt · SKILL.md (reported line 79)May include surrounding context.

WantedBy=multi-user.target EOF

sudo systemctl enable --now herd-router

text

```bash

Session Persistence

Medium
Category
Rogue Agent
Confidence
90% confidence
Finding

The herd-node service is configured to auto-start and persist on boot, which creates ongoing participation in the cluster without additional confirmation after setup. In a heterogeneous cluster context, this increases the chance that a node remains connected, reachable, or consuming resources after the user assumes setup was one-time only.

Content

Scanner excerpt · SKILL.md (reported line 99)May include surrounding context.

WantedBy=multi-user.target EOF

sudo systemctl enable --now herd-node

text

## Use Ubuntu AI

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 121)May include surrounding context.

print(chunk.choices[0].delta.content or "", end="")

text

### curl

```bash
# Ubuntu AI inference

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill instructs users to open TCP port 11435 with UFW but does not warn that this may expose the AI service to other hosts on the network or, depending on broader firewall/NAT configuration, beyond the local machine. Because the service appears to provide inference, status, and dashboard endpoints, unnecessary exposure can increase attack surface and enable unauthorized access or information disclosure.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 183)May include surrounding context.

Image generation

bash
curl http://localhost:11435/api/generate-image \
  -d '{"model": "z-image-turbo", "prompt": "Ubuntu penguin mascot", "width": 1024, "height": 1024}'

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
78% confidence
Finding

The description mixes English, Chinese, and Spanish in a fixed skill description but does not explain language selection or offer a user opt-in. This can conflict with language/locale policy expectations when a skill presents a specific language mix by default.

Content

No source excerpt is available for this finding.