ClawHub
Back to skill

Security audit

Ollama

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent Ollama helper, but it defaults to sending user prompts to a specific non-local HTTP endpoint and uses unpinned install commands.

Install only if you trust and intend to use the configured Ollama server. Override OLLAMA_HOST to a localhost or trusted HTTPS endpoint before sending sensitive prompts, and prefer pinned package versions or a reviewed lockfile for installation.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/ollama_query.py:19
Finding

Prompts and model responses are transmitted to a non-loopback host over plaintext HTTP

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
SKILL.md:30
Finding

Installation instructions execute and install unpinned third-party dependencies

Content
View full analysis
Remediation
View remediation
``` 5. Add cryptographic hashes, for example by generating a hash-locked requirements file and installing with: ```bash pip install --require-hashes -r requirements.txt ``` 6. Document the expected package registry and reject unexpected or additional package indexes. 7. Use automated dependency scanning and a controlled process for reviewing and updating pinned versions. 8. Perform installation with the least-privileged account required and never recommend running these commands with administrative privileges. ]]>

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (9)

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/ollama_query.py (reported line 11)May include surrounding context.

python
from requests.adapters import HTTPAdapter
from urllib3.util.retry import Retry

# 尝试加载 .env 文件 (符合项目已有的 python-dotenv 依赖)
try:
    from dotenv import load_dotenv

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/ollama_query.py (reported line 19)May include surrounding context.

python
from requests.adapters import HTTPAdapter
from urllib3.util.retry import Retry

# 尝试加载 .env 文件 (符合项目已有的 python-dotenv 依赖)
try:
    from dotenv import load_dotenv

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding

The skill documents and enables network access, environment-variable use, and external tooling behavior, but it does not declare any explicit tool scope such as permissions or allowed-tools. This creates a capability/metadata mismatch that can lead to overbroad execution in host environments, making it harder to enforce least privilege or review what the skill is allowed to do.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
88% confidence
Finding

The installation instruction uses npx skills without pinning a specific version, which can cause consumers to execute an unexpected or compromised package version at install time. Because npx fetches code dynamically, this expands the supply-chain attack surface and reduces reproducibility.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The script sends the full user-supplied prompt to the configured Ollama host over the network, and the default host is a non-local IP address rather than localhost. In a skill meant for LLM interaction, prompts may contain sensitive user data, so transmitting them to a remote service without explicit disclosure or consent creates a real privacy and data-exposure risk, especially since the default uses plain HTTP.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The skill’s descriptive and instructional text is primarily written in Chinese, with no indication that users can choose another language or locale. Under the policy rule, forcing a specific language without opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

The command-line interface presents usage text only in Chinese, and other user-visible strings in the file are also Chinese-only. This imposes a specific language on users without offering a language choice or documenting a justified locale restriction.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
89% confidence
Finding

This code file contains natural-language comments and test descriptions in Chinese, such as the comment on L08 and subsequent Chinese docstrings, with no indication that the skill supports language choice or that the locale restriction is intentional and justified. Under the stated policy, forcing a specific language without user opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.