Local AI Stack

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:56 AM UTC
• Version: 1.0.0

Overview

The skill is a coherent local AI setup guide, but it asks users to run an unverified remote installer and create recurring update persistence while overstating that the setup needs no internet.

Review before installing. Prefer the official Ollama download or a verified package path instead of piping a remote script into a shell, treat setup and updates as internet-connected, and do not add the cron auto-update unless you have a reviewed local update script with safe permissions and a clear way to disable it.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:23

Finding

Unverified Remote Script Downloaded and Executed Directly

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 23
Vulnerability Type: Remote payload retrieval and immediate shell execution
Risk Level: Critical

Vulnerable Code:

bash

curl -fsSL https://ollama.com/install.sh | sh

Technical Analysis

The installation command retrieves a mutable script from an external server and pipes it directly into sh. The script is executed before the user can inspect it, and the instructions provide no immutable version pin, cryptographic checksum, or publisher-signature verification.

HTTPS protects the network connection but does not establish that every future version of the script is safe. If the hosting service, publisher account, domain infrastructure, or release process is compromised, the effective payload can be changed after this Skill has been reviewed. The -f, -s, and -S options also reduce normal output, limiting visibility into the retrieval process.

Attack Path

1. An attacker compromises the remote script’s hosting infrastructure, publisher account, or release process.
2. The attacker replaces https://ollama.com/install.sh with a malicious or modified payload.
3. A user follows the Skill’s installation instructions.
4. curl downloads the current attacker-controlled response.
5. The pipe passes the response directly to sh without inspection or integrity verification.
6. The payload executes with the permissions of the invoking user and any additional privileges the user grants during installation.

Impact Assessment

The remote payload can exercise all permissions available to the shell process. Depending on the invoking account’s access, it could read or modify user files, install or replace software, alter shell configuration, access locally available data, or create additional persistence.

The command does not itself demonstrate privilege escalation, and no malicious content from the referenced server was included in the ...[truncated 125 chars]

Remediation

View remediation

Remediation Suggestions

• Do not pipe network responses directly into a shell.
• Prefer a signed, versioned package distributed through a trusted package manager or the publisher’s documented download channel.
• If a script must be used, pin an immutable release and download it to a local file before execution.
• Verify the downloaded file using a publisher signature or a SHA-256 digest obtained through a separately trusted channel.
• Allow the user to inspect the downloaded script before running it.
• Run installation with the least-privileged account possible and request elevated privileges only for narrowly defined operations.
• Document how to verify, uninstall, and roll back the installed software.

A safer workflow should follow this pattern, using a real publisher-provided digest rather than a placeholder:

bash

curl -fL -o ollama-install.sh "https://trusted.example/immutable-version/install.sh"
echo "PUBLISHER_PROVIDED_SHA256  ollama-install.sh" | shasum -a 256 -c -
less ollama-install.sh
sh ollama-install.sh

T06 · System Persistence

Warning

• Location: SKILL.md:105

Finding

Unsafe Recurring Execution Through an Undefined Cron Update Script

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 105-113
Vulnerability Type: Persistent scheduled execution with an unspecified script target
Risk Level: Medium

Vulnerable Code:

bash

## Bi-Weekly Auto-Update

Add to cron for automatic model updates:
```bash
# Edit crontab
crontab -e

# Add this line (1st and 15th of each month at 9 AM)
0 9 1,15 * * /path/to/update-models.sh

text

### Technical Analysis

The instructions recommend creating a cron entry that survives the current Skill run and executes twice each month. Recurring updates are consistent with the declared auto-update feature, but they are not required for the core local model functionality.

The referenced `update-models.sh` is not included in the project. Consequently, the audited Skill does not define what the scheduled task executes or how updates are retrieved and validated. It also does not specify secure ownership and permissions, a trusted absolute installation location, artifact integrity checks, execution logging, failure handling, prevention of overlapping runs, or removal instructions.

The literal placeholder is not operational as supplied. The exploitable condition arises if a user substitutes a real script path whose file or parent directory can later be modified by another party. Cron would then execute the replaced content automatically under the account that owns the crontab.

### Attack Path

1. A user creates an update script and replaces the placeholder with its path.
2. The script or one of its parent directories is left writable by an untrusted local account or process, or an update mechanism replaces it without integrity verification.
3. An attacker with existing write access modifies or replaces the scheduled script.
4. On the first or fifteenth day of a later month at 09:00, cron invokes the attacker-controlled script.
5. The script executes non-interactively with the permissions of the user who i
...[truncated 676 chars]

Remediation

View remediation

Remediation Suggestions

• Make scheduled updates explicitly optional and disabled by default.
• Supply the complete update script in the reviewed project rather than referencing an undefined placeholder.
• Install the script at a fixed, absolute, user-owned path whose file and parent directories are not writable by other users.
• Apply restrictive permissions, such as read and execute access only for the intended owner where practical.
• Avoid evaluating model names, URLs, or other update metadata as shell code.
• Pin expected sources and verify downloaded artifacts using publisher signatures or documented cryptographic hashes.
• Use a minimal and explicit PATH in the scheduled environment and absolute paths for invoked programs.
• Add logging, failure handling, timeouts, and a lock to prevent concurrent update processes.
• Document disk-space requirements, network activity, rollback behavior, and the exact command needed to remove the cron entry.
• Prefer a transparent manual update command when unattended updates are not essential.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 99% confidence

Finding

Fetching and executing an external install script from a URL delegates trust to a third-party endpoint at execution time. Any compromise of the endpoint or delivery path would let an attacker run arbitrary commands with the user's privileges.

Content

Scanner excerpt · SKILL.md (reported line 23)May include surrounding context.

Step 1: Install Ollama

bash

curl -fsSL https://ollama.com/install.sh | sh

Or download from: https://ollama.com/download

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 98% confidence

Finding

The '| sh' chaining pattern is dangerous because it removes the opportunity to inspect downloaded content before execution and converts content retrieval directly into code execution. In a security-sensitive setup guide, this materially increases the chance of supply-chain compromise affecting users.

Content

Scanner excerpt · SKILL.md (reported line 23)May include surrounding context.

Step 1: Install Ollama

bash

curl -fsSL https://ollama.com/install.sh | sh

Or download from: https://ollama.com/download

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The document claims the stack is 'fully offline' and requires 'no internet', but installation and model acquisition explicitly require network access. This can mislead users about the trust boundary and may cause them to run remote downloads under the false assumption that the setup never contacts external services.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The installation command pipes a remotely fetched script directly into the shell without verification, giving the remote server immediate code execution on the user's machine. If the source, transport, DNS, or hosting is compromised, users could execute arbitrary malicious code.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

The instructions tell users to modify crontab, introducing persistent scheduled execution on the host. Persistence itself is not always harmful, but in this context it increases risk because it can repeatedly invoke update logic that may later be changed or point to network-fetched content.

Content

Scanner excerpt · SKILL.md (reported line 109)May include surrounding context.

Add to cron for automatic model updates:

bash

# Edit crontab
crontab -e

# Add this line (1st and 15th of each month at 9 AM)
0 9 1,15 * * /path/to/update-models.sh

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The skill markets a local offline stack while also promoting 'free built-in models' through an OpenCode-hosted model namespace, which suggests use of non-local resources. This ambiguity can cause users to unknowingly send prompts or data to external model providers, undermining privacy expectations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The cron-based auto-update guidance creates recurring background downloads without clearly warning users about continued network activity, bandwidth consumption, storage growth, or change management risk. While not inherently malicious, it can lead to unexpected persistent behavior in a tool advertised as offline-focused.

Content

No source excerpt is available for this finding.