Security audit
Security checks for vulnerabilities and agentic risk
This is a straightforward Ollama helper with disclosed local checks and optional saved setup notes, with minor privacy considerations around what users choose to store.
Install only if you want Codex-style help managing Ollama. Before enabling persistence, decide what may be written under ~/ollama/ and keep secrets, API keys, private documents, prompts, transcripts, and sensitive network details out of those notes. Do not approve remote Ollama exposure or optional cloud execution unless you understand what data leaves the machine.
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
## API Does Not Respond
Symptoms:
- `curl http://127.0.0.1:11434/api/tags` fails
- local apps report connection refused
Checks:
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
This skill NEVER:
- claim that every Ollama model supports the same tools, context, or JSON reliability
- recommend unauthenticated remote exposure as a default
- treat local RAG quality as solved without checking embeddings, chunking, and retrieval results
- modify its own skill files
## Related Skills
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Inspect a specific model before promising capabilities:
curl -s http://127.0.0.1:11434/api/show -d '{
"model": "MODEL:TAG"
}' | jq '{capabilities, details, model_info}'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Prefer non-streaming when the next step needs deterministic parsing:
curl -s http://127.0.0.1:11434/api/chat -d '{
"model": "MODEL:TAG",
"messages": [
{"role": "system", "content": "Return one short answer."},
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Prefer non-streaming when the next step needs deterministic parsing:
curl -s http://127.0.0.1:11434/api/chat -d '{
"model": "MODEL:TAG",
"messages": [
{"role": "system", "content": "Return one short answer."},
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -s http://127.0.0.1:11434/api/embed -d '{
"model": "embeddinggemma",
"input": "hello world"
}' | jq '.embeddings[0] | length'
The skill explicitly instructs creating a persistent ~/ollama/memory.md file and storing operational context such as environment details, model defaults, integration state, and durable notes, but it does not warn that these entries may contain sensitive local system or workflow information. In a local-model/privacy-focused workflow, users may reasonably record host details, service configuration, remote/local access patterns, or other sensitive metadata that could later be exposed through local compromise, backups, sync tools, or accidental sharing.
The activation guidance is intentionally broad, telling the skill to engage whenever Ollama, local LLMs, Modelfiles, embeddings, or local RAG are mentioned, and even to intervene proactively. This can cause over-activation outside narrowly relevant contexts, increasing the chance the skill influences conversations, gathers durable context, or steers decisions when the user did not clearly request it.