Security audit

Local AI Stack

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent local AI setup guide, but it asks users to run an unverified remote installer and create recurring update persistence while overstating that the setup needs no internet.

Review before installing. Prefer the official Ollama download or a verified package path instead of piping a remote script into a shell, treat setup and updates as internet-connected, and do not add the cron auto-update unless you have a reviewed local update script with safe permissions and a clear way to disable it.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

Location: SKILL.md:23
Finding: Unverified Remote Script Downloaded and Executed Directly## Vulnerability Details **File Location**: `SKILL.md`, line 23 **Vulnerability Type**: Remote payload retrieval and immediate shell execution **Risk Level**: Critical **Vulnerable Code**: ```bash curl -fsSL https://ollama.com/install.sh | sh ``` ### Technical Analysis The installation command retrieves a mutable script from an external server and pipes it directly into `sh`. The script is executed before the user can inspect it, and the instructions provide no immutable version pin, cryptographic checksum, or publisher-signature verification. HTTPS protects the network connection but does not establish that every future version of the script is safe. If the hosting service, publisher account, domain infrastructure, or release process is compromised, the effective payload can be changed after this Skill has been reviewed. The `-f`, `-s`, and `-S` options also reduce normal output, limiting visibility into the retrieval process. ### Attack Path 1. An attacker compromises the remote script’s hosting infrastructure, publisher account, or release process. 2. The attacker replaces `https://ollama.com/install.sh` with a malicious or modified payload. 3. A user follows the Skill’s installation instructions. 4. `curl` downloads the current attacker-controlled response. 5. The pipe passes the response directly to `sh` without inspection or integrity verification. 6. The payload executes with the permissions of the invoking user and any additional privileges the user grants during installation. ### Impact Assessment The remote payload can exercise all permissions available to the shell process. Depending on the invoking account’s access, it could read or modify user files, install or replace software, alter shell configuration, access locally available data, or create additional persistence. The command does not itself demonstrate privilege escalation, and no malicious content from the referenced server was included in the ...[truncated 125 chars]
Remediation: ## Remediation Suggestions - Do not pipe network responses directly into a shell. - Prefer a signed, versioned package distributed through a trusted package manager or the publisher’s documented download channel. - If a script must be used, pin an immutable release and download it to a local file before execution. - Verify the downloaded file using a publisher signature or a SHA-256 digest obtained through a separately trusted channel. - Allow the user to inspect the downloaded script before running it. - Run installation with the least-privileged account possible and request elevated privileges only for narrowly defined operations. - Document how to verify, uninstall, and roll back the installed software. A safer workflow should follow this pattern, using a real publisher-provided digest rather than a placeholder: ```bash curl -fL -o ollama-install.sh "https://trusted.example/immutable-version/install.sh" echo "PUBLISHER_PROVIDED_SHA256 ollama-install.sh" | shasum -a 256 -c - less ollama-install.sh sh ollama-install.sh ```

T06 · System Persistence

Warning

Location: SKILL.md:105
Finding: Unsafe Recurring Execution Through an Undefined Cron Update Script## Vulnerability Details **File Location**: `SKILL.md`, lines 105-113 **Vulnerability Type**: Persistent scheduled execution with an unspecified script target **Risk Level**: Medium **Vulnerable Code**: ```bash ## Bi-Weekly Auto-Update Add to cron for automatic model updates: ```bash # Edit crontab crontab -e # Add this line (1st and 15th of each month at 9 AM) 0 9 1,15 * * /path/to/update-models.sh ``` ``` ### Technical Analysis The instructions recommend creating a cron entry that survives the current Skill run and executes twice each month. Recurring updates are consistent with the declared auto-update feature, but they are not required for the core local model functionality. The referenced `update-models.sh` is not included in the project. Consequently, the audited Skill does not define what the scheduled task executes or how updates are retrieved and validated. It also does not specify secure ownership and permissions, a trusted absolute installation location, artifact integrity checks, execution logging, failure handling, prevention of overlapping runs, or removal instructions. The literal placeholder is not operational as supplied. The exploitable condition arises if a user substitutes a real script path whose file or parent directory can later be modified by another party. Cron would then execute the replaced content automatically under the account that owns the crontab. ### Attack Path 1. A user creates an update script and replaces the placeholder with its path. 2. The script or one of its parent directories is left writable by an untrusted local account or process, or an update mechanism replaces it without integrity verification. 3. An attacker with existing write access modifies or replaces the scheduled script. 4. On the first or fifteenth day of a later month at 09:00, cron invokes the attacker-controlled script. 5. The script executes non-interactively with the permissions of the user who i ...[truncated 676 chars]
Remediation: ## Remediation Suggestions - Make scheduled updates explicitly optional and disabled by default. - Supply the complete update script in the reviewed project rather than referencing an undefined placeholder. - Install the script at a fixed, absolute, user-owned path whose file and parent directories are not writable by other users. - Apply restrictive permissions, such as read and execute access only for the intended owner where practical. - Avoid evaluating model names, URLs, or other update metadata as shell code. - Pin expected sources and verify downloaded artifacts using publisher signatures or documented cryptographic hashes. - Use a minimal and explicit `PATH` in the scheduled environment and absolute paths for invoked programs. - Add logging, failure handling, timeouts, and a lock to prevent concurrent update processes. - Document disk-space requirements, network activity, rollback behavior, and the exact command needed to remove the cron entry. - Prefer a transparent manual update command when unattended updates are not essential.

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Rogue AgentSelf-Modification, Session Persistence
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

External Script Fetching

High

Category: Supply Chain
Content: ### Step 1: Install Ollama ```bash curl -fsSL https://ollama.com/install.sh | sh ``` Or download from: https://ollama.com/download
Confidence: 99% confidence
Finding: Fetching and executing an external install script from a URL delegates trust to a third-party endpoint at execution time. Any compromise of the endpoint or delivery path would let an attacker run arbitrary commands with the user's privileges.

Chaining Abuse

High

Category: Tool Misuse
Content: ### Step 1: Install Ollama ```bash curl -fsSL https://ollama.com/install.sh | sh ``` Or download from: https://ollama.com/download
Confidence: 98% confidence
Finding: The '| sh' chaining pattern is dangerous because it removes the opportunity to inspect downloaded content before execution and converts content retrieval directly into code execution. In a security-sensitive setup guide, this materially increases the chance of supply-chain compromise affecting users.

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The document claims the stack is 'fully offline' and requires 'no internet', but installation and model acquisition explicitly require network access. This can mislead users about the trust boundary and may cause them to run remote downloads under the false assumption that the setup never contacts external services.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The installation command pipes a remotely fetched script directly into the shell without verification, giving the remote server immediate code execution on the user's machine. If the source, transport, DNS, or hosting is compromised, users could execute arbitrary malicious code.

Session Persistence

Medium

Category: Rogue Agent
Content: Add to cron for automatic model updates: ```bash # Edit crontab crontab -e # Add this line (1st and 15th of each month at 9 AM) 0 9 1,15 * * /path/to/update-models.sh
Confidence: 85% confidence
Finding: The instructions tell users to modify crontab, introducing persistent scheduled execution on the host. Persistence itself is not always harmful, but in this context it increases risk because it can repeatedly invoke update logic that may later be changed or point to network-fetched content.

Intent-Code Divergence

Low

Confidence: 82% confidence
Finding: The skill markets a local offline stack while also promoting 'free built-in models' through an OpenCode-hosted model namespace, which suggests use of non-local resources. This ambiguity can cause users to unknowingly send prompts or data to external model providers, undermining privacy expectations.

Missing User Warnings

Low

Confidence: 85% confidence
Finding: The cron-based auto-update guidance creates recurring background downloads without clearly warning users about continued network activity, bandwidth consumption, storage growth, or change management risk. While not inherently malicious, it can lead to unexpected persistent behavior in a tool advertised as offline-focused.

Static analysis

No suspicious patterns detected.