OllamaDiffuser Image generation

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 8:06 AM UTC
• Version: 1.0.0

Overview

The skill is a straightforward setup and usage guide for local AI image generation, with ordinary but real dependency and token-handling cautions.

Install only in a dedicated virtual environment, avoid running pip as root or administrator, and pin package versions if you need reproducible reviewed installs. If using gated Hugging Face models, avoid storing HF_TOKEN permanently unless you understand the exposure risk.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:14

Finding

Unpinned Third-Party Package Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 14–18
Vulnerability Type: Uncontrolled third-party dependency installation
Risk Level: Medium

Vulnerable Code

text

- **Standard Installation**: `pip install ollamadiffuser`
- **Full Suite (Recommended)**: `pip install "ollamadiffuser[full]"`
- **Low-VRAM/GGUF Support**: `pip install "ollamadiffuser[gguf]"`
- **MCP/Agent Integration**: `pip install "ollamadiffuser[mcp]"`
- **Apple Silicon (Metal)**: `CMAKE_ARGS="-DSD_METAL=ON" pip install stable-diffusion-cpp-python`

Technical Analysis

The skill directs users or agents to install third-party PyPI packages without pinning reviewed versions, validating package hashes, using a lockfile, or documenting a verified package source. Consequently, the installed code and transitive dependency graph can change independently of the reviewed skill.

Python package installation may execute build-system hooks or other installation logic. The recommended full extra can also expand the number of transitive dependencies and therefore the supply-chain attack surface. If an upstream package, release process, or transitive dependency is compromised, following these instructions could execute attacker-controlled code under the privileges of the user running pip.

The audit found no evidence that the named packages are currently malicious. The vulnerability is the absence of controls ensuring that future installations reproduce a known and reviewed dependency set.

Attack Path

1. An attacker compromises a named package, one of its transitive dependencies, or the associated package publishing account.
2. The attacker publishes a malicious release that satisfies the unrestricted dependency request.
3. A user or agent follows the skill instructions and runs one of the documented pip install commands.
4. Pip retrieves the current uncontrolled release and resolves similarly uncontrolled transitive depen ...[truncated 864 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin every direct dependency to a reviewed, exact version rather than allowing the newest available release.
2. Generate a lockfile or fully pinned requirements file that includes all transitive dependencies.
3. Record trusted package hashes and install with pip's --require-hashes option.
4. Document the verified official package index and package ownership information; do not use untrusted indexes or dependency links.
5. Install dependencies inside a dedicated virtual environment or similarly isolated runtime using a non-privileged account.
6. Avoid recommending the broad full extra by default. Document the minimum extra required for each workflow.
7. Scan and review dependency updates before modifying pinned versions, including build dependencies declared through pyproject.toml.
8. Advise users not to run package installation commands with administrative or root privileges.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.