Open WebUI

• Outcome: Review
• Latest audit: Sep 10, 2026 · 3:22 PM UTC
• Version: 1.0.0

Overview

This is a mostly coherent Open WebUI API client, but it needs Review because a remote HTTP configuration can expose the user's API token and uploaded content.

Install only if you trust the configured Open WebUI server and can use localhost or HTTPS. Avoid remote http:// URLs, avoid passing tokens on the command line on shared systems, review files before uploading them for RAG, and treat model deletion and large model pulls as destructive or costly actions that should be explicitly requested.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/openwebui-cli.py:35

Finding

Bearer Token and Sensitive User Data Can Be Transmitted over Plaintext HTTP

Content

View full analysis

str: """Build full URL from endpoint.""" return urljoin(self.base_url + "/", endpoint.lstrip("/")) def _request(self, method: str, endpoint: str, **kwargs) -> dict: """Execute HTTP request with error handling.""" url = self._url(endpoint) verify = not (self.base_url.startswith("http://localhost") or self.base_url.startswith("http://127.0.0.1")) try: response = self.session.request(method, url, verify=verify, **kwargs) response.raise_for_status() return response.json() if response.content else {} ``` The file-upload path independently sends the same bearer credential and selected file contents: ```python def upload_file(self, file_path: str, process: bool = True) -> dict: """POST /api/v1/files/ - Upload file for RAG.""" path = Path(file_path) if not path.exists(): raise FileNotFoundError(f"File not found: {file_path}") ...[truncated 3542 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (8)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The code substantially matches much of the declared Open WebUI integration: it uses the stated environment variables or explicit arguments, interacts with Open WebUI REST endpoints, supports listing models, chatting, uploading files for RAG, managing knowledge collections, and executing Ollama proxy commands. However, the description explicitly claims support for image generation, audio processing, and pipelines, and no corresponding code paths or API methods exist for those functions. This is a description-behavior mismatch due to materially overclaiming capabilities, even though the implemented subset is otherwise aligned.

Content

No source excerpt is available for this finding.

Context Leakage

High

• Category: Data Exfiltration
• Confidence: 90% confidence

Finding

The skill is designed to send prompts, files, and possibly conversation content to an external Open WebUI instance, which creates a real context-leakage risk if sensitive user or system data is forwarded without strict gating. This is more dangerous here because the skill explicitly supports chat completions, RAG uploads, audio, and image operations, all of which can transmit private data off-box.

Content

Scanner excerpt · SKILL.md (reported line 15)May include surrounding context.

md

**Activate this skill when the user wants to:**
- List available models from their Open WebUI instance
- Send chat completions to models through Open WebUI
- Upload files for RAG (Retrieval Augmented Generation)
- Manage knowledge collections and add files to them
- Use Ollama proxy endpoints (generate, embed, pull models)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 88% confidence

Finding

The skill exposes destructive and high-impact API operations such as model deletion and knowledge-base modification, and the only guard described is a confirmation prompt. If confirmation is bypassed, spoofed, or poorly implemented, the agent could perform irreversible remote actions or incur large bandwidth and storage costs through model pulls.

Content

Scanner excerpt · SKILL.md (reported line 140)May include surrounding context.

md

### Confirmation Required

Always confirm before:
- **Deleting models** (`DELETE /ollama/api/delete`) - Irreversible
- **Pulling large models** - May take significant time/bandwidth
- **Deleting knowledge collections** - Data loss risk
- **Uploading sensitive files** - Privacy consideration

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/openwebui-cli.py (reported line 184)May include surrounding context.

python

return self._request("POST", "/ollama/api/pull", json=payload)

    def ollama_delete(self, model: str) -> dict:
        """DELETE /ollama/api/delete - Delete model."""
        payload = {"name": model}
        return self._request("DELETE", "/ollama/api/delete", json=payload)

External Model or Provider Selection

High

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · scripts/openwebui-cli.py (reported line 211)May include surrounding context.

python

Examples:
  %(prog)s models list
  %(prog)s chat --model llama3.2 --message "Hello"
  %(prog)s files upload --file doc.pdf
"""
    )

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill documents access to environment variables and outbound network use, but it does not declare an explicit tool scope such as permissions or allowed-tools. That creates an authorization gap where a runtime may permit broader access than reviewers or users expect, especially since the skill can use API credentials and interact with remote services.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The CLI prints that it is uploading a file, but it does not clearly warn the user that the file's contents will be transmitted to the configured Open WebUI instance for storage and processing. Because this code handles potentially sensitive local files and sends them over the network, a more explicit disclosure is warranted.

Content

No source excerpt is available for this finding.

Cloud Storage Exfiltration

Medium

• Category: Data Exfiltration
• Confidence: 55% confidence

Finding

Data is uploaded to cloud storage (S3 / GCS / Azure Blob). This may be a legitimate backup or exfiltration to an external bucket. Manual review is recommended.

Content

Scanner excerpt · scripts/openwebui-cli.py (reported line 322)May include surrounding context.

python

elif args.command == "files":
            if args.subcommand == "upload":
                print(f"Uploading {args.file}...")
                result = client.upload_file(args.file, process=not args.no_process)
                print_json(result)
                file_id = result.get("id")
                if args.wait and not args.no_process:

Static analysis

No suspicious patterns detected.