Offline Llama

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:30 PM UTC
• Version: 1.0.0

Overview

The skill is mostly a local Ollama management guide, but it allows automatic service changes, cleanup, model reinstallations, and remote model fallback without clear consent or privacy boundaries.

Review this before installing. Use it only if remote fallback is disabled or explicitly approved per request, and only if cleanup, restarts, and model reinstallations are limited to known Ollama paths and require confirmation or clear policy controls.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

other

Warning

• Location: SKILL.md:21
• Finding: Unspecified Remote Model Fallback May Disclose Sensitive Task Data## Vulnerability Details **File Location**: `SKILL.md:21-22`, `SKILL.md:45-47`, and `SKILL.md:88-91` **Vulnerability Type**: Unspecified remote data disclosure risk **Risk Level**: Medium **Relevant Skill Text**: ```markdown ### Connectivity Awareness - **Internet Detection**: Monitor internet connectivity status - **Smart Fallback**: Switch to remote models when local models unavailable and internet is present - **Offline Mode**: Maintain full functionality without internet ``` ```markdown ### When Internet is Available - Use local models primarily - Fallback to remote models if local models unavailable - Maintain optimal performance ``` ```markdown ## Security Considerations - All operations performed locally - No external dependencies required - Secure model management - Privacy-preserving by default ``` ### Technical Analysis The Skill authorizes automatic fallback to an unspecified remote model when local models are unavailable. Remote inference normally requires transmitting at least the user prompt and associated task context to an external service. The document does not identify the provider, endpoint, authentication mechanism, transmitted fields, retention policy, transport-security requirements, or a required user-consent step. This behavior conflicts with the assertions that all operations are local and privacy-preserving by default. The issue is contained in the Skill instructions; the audited project contains no executable implementation with which to verify whether consent, redaction, endpoint allowlisting, or other safeguards exist. ### Attack Path 1. The primary and alternative local Ollama models become unavailable, whether because of an ordinary failure, resource exhaustion, or deliberate disruption. 2. The Skill detects that internet connectivity is available. 3. Its fallback instructions select an unspecified remote model. 4. The current prompt and potentially related con ...[truncated 676 chars]
• Remediation: ## Remediation Suggestions 1. Disable remote fallback by default and require explicit, informed user approval before transmitting task data externally. 2. Identify and allowlist approved providers, HTTPS endpoints, model identifiers, and authentication mechanisms. 3. Clearly document which request fields and context are transmitted, along with provider retention and privacy policies. 4. Minimize submitted context and redact credentials, tokens, personal information, proprietary code, and other secrets before transmission. 5. Provide a strict local-only configuration that cannot silently activate a remote provider. 6. Log fallback decisions and display the selected provider without recording sensitive prompt content. 7. Replace the claim that all operations are local, or constrain the design so that the claim is accurate.

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:15
• Finding: Autonomous Destructive and Privileged Self-Healing Actions Lack Safety Boundaries## Vulnerability Details **File Location**: `SKILL.md:15-18` and `SKILL.md:72-76` **Vulnerability Type**: Unauthorized access and privilege escalation **Risk Level**: Medium **Relevant Skill Text**: ```markdown ### Self-Healing - **Service Restart**: Automatically restart Ollama when models become unavailable - **Resource Management**: Clear cache and temporary files to free resources - **Model Reinstallation**: Reinstall problematic models automatically ``` ```markdown ### Automatic Actions - **Service Restart**: Triggered when model becomes unavailable - **Resource Cleanup**: Triggered when high memory usage detected - **Model Reinstallation**: Triggered when persistent failures occur ``` ### Technical Analysis The Skill directs the agent to restart a service, delete cached or temporary resources, and reinstall models automatically. These operations may require elevated service-management or filesystem permissions and can be destructive. The instructions do not define authorized directories, service identities, privilege boundaries, approved artifact sources, integrity verification, confirmation requirements, rollback procedures, or rate limits. Broadly interpreted cleanup instructions can remove files outside an intended cache boundary. Automatic reinstallation can introduce unverified artifacts if model sources and hashes are not pinned. Automatic restart behavior can also be repeatedly triggered to disrupt availability. The audited project contains only this documentation and no implementation. Consequently, the audit confirms that the instructions authorize overbroad actions without documented controls, but it cannot confirm a concrete operating-system privilege-escalation exploit or a specific unsafe deletion command. ### Attack Path 1. A model-unavailable, high-memory, or persistent-failure condition occurs or is deliberately induced. 2. The Skill invokes its automatic self-healing workflow without r ...[truncated 982 chars]
• Remediation: ## Remediation Suggestions 1. Separate passive monitoring from remediation and require explicit approval for deletion, reinstallation, and privileged service operations. 2. Run the Skill under a dedicated least-privilege account with access only to the required Ollama service and model directories. 3. Replace generic cleanup instructions with canonical, allowlisted directories and reject symlinks, path traversal, mount-point changes, and paths outside those directories. 4. Prefer Ollama's supported cache-management interfaces over recursive filesystem deletion. 5. Pin model registries, model identifiers, versions, and cryptographic hashes; require signature or digest verification before installation. 6. Add restart rate limits, bounded retries, cooldown periods, health thresholds, and circuit breakers to prevent restart loops. 7. Record remediation actions in an audit log and provide rollback or recovery procedures. 8. Document exactly which operations require elevated permissions and prohibit unrestricted administrative or root execution.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The overview and feature description normalize self-healing behavior but do not prominently warn that the skill may autonomously restart services, clear caches or temporary files, and reinstall models. These actions can disrupt running workloads, destroy useful state, or alter the host environment without informed user approval.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill advertises automatic fallback to remote models when local models are unavailable but does not clearly warn that prompts, context, or other data may be transmitted over the network to third-party services. In a tool positioned as offline/local-first, this omission materially increases privacy risk because users may reasonably assume their data remains local.

Intent-Code Divergence

Medium

• Confidence: 96% confidence
• Finding: The security section makes materially misleading claims that all operations are local and have no external dependencies, while the skill explicitly documents internet detection and fallback to remote models. This can cause users to trust the skill with sensitive prompts or data under a false assumption of offline-only operation, creating privacy and data exposure risk.

Static analysis

No suspicious patterns detected.