Model Migration

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:58 AM UTC
• Version: 1.0.5

Overview

The skill is mostly coherent model-migration guidance, but it includes an unsafe optional installer command that runs remote code directly on the user's machine.

Review the Ollama installation step before using this skill. Prefer installing Ollama from official package-manager or manually verified release instructions instead of running a `curl | sh` command, and avoid placing real API keys directly into shell commands if your shell history is retained.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:112

Finding

Unverified Remote Installer Executed Directly by a Shell

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:112
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

Vulnerable Code

bash

curl -fsSL https://ollama.com/install.sh | sh

Technical Analysis

The Ollama installation instructions stream a remotely hosted script directly into sh. Although the URL appears to use Ollama's official HTTPS domain, the command does not pin a script version, verify a cryptographic checksum or signature, or give the user an opportunity to inspect the downloaded content before execution.

The effective payload can change after the Skill has been reviewed. A compromise of the remote server, hosting infrastructure, domain, or TLS trust chain could therefore cause arbitrary attacker-controlled commands to execute on the user's machine. The -f and -s options also suppress some diagnostic output, reducing visibility when the command fails or behaves unexpectedly.

Installing Ollama is relevant only to the optional local-provider path. Executing a mutable and unverified remote script is not the minimum privilege or minimum-risk mechanism necessary to provide that functionality.

Attack Path

1. The user chooses the local Ollama migration option.
2. The agent presents or executes the documented installation command.
3. An attacker compromises or otherwise gains control over the content returned by https://ollama.com/install.sh.
4. curl retrieves the modified script without validating its version, checksum, or signature.
5. The pipe sends the response directly to sh.
6. The attacker's commands execute with the privileges of the invoking user and may obtain greater privileges if the installer invokes or prompts for sudo.

Impact Assessment

Successful exploitation permits arbitrary command execution with the invoking user's privileges. This can expose files and credentials accessible to that account, alter OpenClaw configuration, in ...[truncated 347 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the direct curl | sh pipeline.
2. Prefer a trusted operating-system package manager where an Ollama package is available.
3. Otherwise, direct the user to download a version-pinned release artifact from the verified vendor release page.
4. Verify the artifact using a vendor-published cryptographic signature or checksum obtained through an independently trusted channel.
5. Save the installer locally and allow the user to inspect it before execution.
6. Require explicit user confirmation before running the verified installer.
7. Run installation with ordinary user privileges where possible, and request elevation only for specific operations that require it.
8. Document the expected filesystem and service changes so users can evaluate the installer's scope.

A safer documented workflow should follow this pattern:

bash

# Download a version-pinned artifact from the verified release page.
curl -fL -o ollama-installer.sh "PINNED_VENDOR_RELEASE_URL"

# Compare against the independently published expected checksum.
printf '%s  %s\n' "EXPECTED_SHA256" "ollama-installer.sh" | sha256sum --check -

# Inspect before execution.
less ollama-installer.sh

# Execute only after successful verification and explicit approval.
sh ollama-installer.sh

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 99% confidence

Finding

curl -fsSL https://ollama.com/install.sh | sh causes immediate execution of code fetched from the network, which is a classic arbitrary code execution and supply-chain risk. In this skill context, the command is presented as a normal migration step for affected users, increasing the likelihood that a user will run it without scrutiny.

Content

Scanner excerpt · SKILL.md (reported line 112)May include surrounding context.

md

### Option C: Ollama (local or cloud free tier)

1. Install: `curl -fsSL https://ollama.com/install.sh | sh` (or use cloud: ollama.com)
2. Pull a model: `ollama pull llama3.2`
3. Run: `openclaw onboard --non-interactive --auth-choice ollama --accept-risk`
4. Set model: `openclaw models set ollama/llama3.2`

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill tells users to execute a remote installer by piping curl output directly into sh without any warning or integrity verification. This bypasses review of the downloaded script and creates a supply-chain/code-execution risk if the remote host, transport, or script content is compromised.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.