ollama-migrator

AdvisoryAudited by Static analysis on Apr 30, 2026.

Overview

No suspicious patterns detected.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

ConcernHigh Confidence

ASI02: Tool Misuse and Exploitation

What this means

A failed or incomplete migration could still lead to deletion of the original Ollama model files, requiring re-download or recovery from backup.

Why it was flagged

When --cleanup is used, the script deletes the original ~/.ollama/models directory even if verification fails, contradicting the documented safety expectation that cleanup happens only after successful verification.

Skill content

if not self.verify_migration():
            print("警告：验证失败，但迁移可能成功")
...
        if cleanup:
            ...
                shutil.rmtree(self.source)

Recommendation

Do not use --cleanup until you have manually verified the migrated models with `ollama list` and a test run; consider backing up the model directory first.

NoteHigh Confidence

ASI10: Rogue Agents

What this means

Future Ollama commands will use the new model directory until the environment variable is changed or removed.

Why it was flagged

The script persistently changes the user's OLLAMA_MODELS environment variable so future Ollama sessions use the new model path.

Skill content

winreg.OpenKey(winreg.HKEY_CURRENT_USER, "Environment", 0, winreg.KEY_SET_VALUE)
winreg.SetValueEx(key, "OLLAMA_MODELS", 0, winreg.REG_EXPAND_SZ, str(self.target))

Recommendation

Confirm the target path is correct and keep a note of the previous model location before running the migration.

NoteHigh Confidence

ASI04: Agentic Supply Chain Vulnerabilities

What this means

A referenced verification helper may be unavailable, so users may need to verify migration manually.

Why it was flagged

SKILL.md lists `scripts/verify_ollama.py` as a script tool, but the complete manifest only includes two scripts. This looks like incomplete or inconsistent packaging rather than hidden code.

Skill content

3 file(s):
  SKILL.md
  scripts/check_ollama_status.py
  scripts/migrate_ollama.py

Recommendation

Use the built-in `ollama list` and a manual model run to verify success, and treat the missing helper as a documentation/package issue.