Llm Data Automation

• Outcome: Review
• Latest audit: Sep 10, 2026 · 11:05 AM UTC
• Version: 2.1.0

Overview

The skill is mostly a construction data-automation guide, but it includes unsafe setup instructions that can execute mutable remote code on a user's machine.

Review this skill before installing. The packaged files are documentation and instructions, not hidden malware, but do not run the `curl ... | sh` installer as written; use official platform-specific Ollama installation steps and verify downloads. Use a virtual environment for Python packages, pin dependencies where possible, and avoid putting confidential construction, customer, cost, contract, or schedule data into online LLMs unless your organization allows it.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:225
• Finding: Remote Ollama Installer Downloaded and Executed Without Verification## Vulnerability Details **File Location**: `SKILL.md`, line 225 **Vulnerability Type**: Remote payload retrieval and immediate shell execution **Risk Level**: High **Vulnerable Code**: ```bash curl -fsSL https://ollama.com/install.sh | sh ``` ### Technical Analysis The command retrieves a mutable installation script from an external URL and pipes it directly into a shell. The remote content is executed without local inspection, version pinning, checksum validation, or cryptographic signature verification. Although Ollama is relevant to the documented local-LLM workflow and the URL uses the official public domain, this installation method makes the effective executable payload dependent on content hosted outside the reviewed Skill package. A compromise of the distribution server, associated delivery infrastructure, or upstream installer could therefore turn this documented command into arbitrary code execution after the Skill has already passed review. Remote installation is optional and is not necessary for the Skill's core construction-data processing functionality. Direct shell execution consequently exceeds the minimum behavior required to provide Pandas examples or generate data-processing scripts. It also conflicts with the `win32` platform declared in the Skill metadata because the documented command assumes a Unix-like shell. ### Attack Path 1. A user or agent follows the local LLM setup instructions in `SKILL.md`. 2. `curl` retrieves the current contents of `https://ollama.com/install.sh`. 3. The downloaded bytes are passed directly to `sh` without being saved, reviewed, pinned, or verified. 4. If the remote installer or its delivery path has been compromised, attacker-controlled shell commands execute immediately. 5. Those commands can access resources available to the invoking account, install additional software, modify files, or establish further execution mechanisms. ### Impact Assessment The remote s ...[truncated 673 chars]
• Remediation: ## Remediation Suggestions 1. Remove the `curl | sh` pipeline and direct users to Ollama's official, platform-specific installation documentation. 2. Require explicit user approval before downloading or executing any installer. 3. Prefer a trusted operating-system package manager or a versioned installer obtained from an official release page. 4. If an installer must be downloaded, save it without executing it, pin an exact release version, and verify its published cryptographic checksum or signature. 5. Allow the user to inspect the downloaded artifact before execution. 6. Run installation with standard user privileges wherever possible and request elevation only for a specific, documented operation. 7. Provide Windows-specific instructions consistent with the Skill's declared `win32` platform.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:256
• Finding: Unpinned Python Dependencies Installed From a Mutable Package Index## Vulnerability Details **File Location**: `SKILL.md`, line 256 **Vulnerability Type**: Unpinned third-party dependency installation **Risk Level**: Medium **Vulnerable Code**: ```bash pip install jupyter pandas openpyxl pdfplumber ``` ### Technical Analysis The command installs four packages without exact version constraints, a lockfile, or package hashes. It also permits the package resolver to select mutable transitive dependency versions from the user's configured Python package index. As a result, executing the same reviewed command at different times can install different code. If a package release, transitive dependency, maintainer account, or configured package index is compromised, malicious or vulnerable code could be introduced during installation or later imported at runtime. The named packages are consistent with the Skill's examples, and no evidence of typosquatting or an intentionally malicious package was found. The vulnerability is the unsafe, non-reproducible dependency acquisition method rather than proof that the listed packages are currently malicious. ### Attack Path 1. A user follows the Jupyter setup instructions in `SKILL.md`. 2. `pip` queries the active package index and resolves the latest compatible versions of the named packages and their transitive dependencies. 3. A compromised package release, dependency, index, or maintainer account supplies attacker-controlled distribution content. 4. The malicious content is installed into the active Python environment and may execute through package installation behavior, command entry points, notebook startup, or subsequent imports. 5. The code then operates with the privileges and filesystem access of the user running Python or Jupyter. ### Impact Assessment A compromised dependency could execute code as the installing or runtime user, modify the active Python environment, access user-readable construction documents, alter generated analysis r ...[truncated 426 chars]
• Remediation: ## Remediation Suggestions 1. Replace the unconstrained installation command with a reviewed dependency file containing exact package and transitive dependency versions. 2. Generate and enforce cryptographic hashes, such as by using a hash-locked requirements file and `python -m pip install --require-hashes -r requirements.txt`. 3. Install dependencies inside a dedicated virtual environment rather than the system Python environment. 4. Document the expected package index and avoid untrusted or implicitly configured extra indexes. 5. Review and update pinned versions through a controlled dependency-update process with vulnerability scanning. 6. Make these packages explicitly optional because they are required only for particular examples, not for loading the Skill itself. 7. Use `python -m pip` to ensure packages are installed into the intended interpreter.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

External Script Fetching

High

• Category: Supply Chain

Content

### Using Ollama
```bash
# Install
curl -fsSL https://ollama.com/install.sh | sh

# Download models
ollama pull mistral      # General purpose, 7B params

• Confidence: 98% confidence
• Finding: The command downloads a remote script and immediately executes it via the shell, giving the remote server full code-execution capability on the user's machine at install time. If the source is compromised, intercepted, or changed unexpectedly, this becomes a direct arbitrary code execution path.

Chaining Abuse

High

• Category: Tool Misuse

Content

### Using Ollama
```bash
# Install
curl -fsSL https://ollama.com/install.sh | sh

# Download models
ollama pull mistral      # General purpose, 7B params

• Confidence: 97% confidence
• Finding: Piping network output directly into `sh` is a classic command-chaining anti-pattern because it removes any opportunity for review and executes whatever bytes are returned. In a skill aimed at non-expert automation users, this increases the likelihood of unsafe copy-paste execution and system compromise.

Ae4

Medium

• Category: analysis-evasion
• Confidence: 80% confidence
• Finding: Suspicious Unicode normalization or mixed-script content

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill encourages users to send natural-language data-processing requests to online LLM services like ChatGPT/Claude without an explicit privacy or data-handling warning. In a construction/business context, prompts may include company schedules, costs, materials, or project details, creating a realistic risk of sensitive data disclosure to third-party services.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The examples show bulk extraction from PDFs and ingestion/export of company documents without warning about sensitive document contents, metadata leakage, or downstream storage risks. While the code itself is not exfiltrating data, the skill normalizes processing potentially confidential files in ways that could later be combined with external tools or insecure storage.

Static analysis

No suspicious patterns detected.