Local-First LLM

• Outcome: Review
• Latest audit: Sep 10, 2026 · 11:41 PM UTC
• Version: 1.0.0

Overview

This skill is mostly coherent, but its setup guide tells users to run unverified downloaded code, which deserves careful review before installing.

Install only after replacing the provider setup steps with verified package-manager or pinned checksum/signature flows. Treat any cloud routing decision as permission to send the prompt externally only after you explicitly approve it, especially for private or regulated data.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: references/local-providers.md:7
• Finding: Unverified Remote Installer Is Piped Directly into a Shell<![CDATA[ ## Vulnerability Details **File Location**: `references/local-providers.md`, lines 7-13; vulnerable command at line 12 **Vulnerability Type**: Remote payload retrieval and immediate execution **Risk Level**: High ### Vulnerable Code ```bash # macOS brew install ollama # Linux curl -fsSL https://ollama.ai/install.sh | sh ``` ### Technical Analysis The Linux installation instructions download a mutable script from an external URL and immediately pass its contents to `sh`. No release version is pinned, and no cryptographic signature or checksum is verified before execution. This pattern creates a remote code-execution channel whose effective payload can change after the Skill has been reviewed. Compromise of the referenced domain, DNS or network path, hosting infrastructure, redirect destination, or upstream installer could cause arbitrary commands to be returned and executed. Installing a supported local provider is relevant to the Skill, but direct `curl | sh` execution is not necessary for its routing and savings-tracking functionality and exceeds the minimum-risk installation mechanism. ### Attack Path 1. A user or agent follows the Linux installation instructions. 2. `curl` requests the current contents of `https://ollama.ai/install.sh`. 3. An attacker who has compromised the upstream distribution channel causes the response to contain malicious shell commands. 4. The response is passed directly to `sh` without being saved, inspected, pinned, or cryptographically verified. 5. The malicious commands execute with the privileges of the user running the command. 6. If the remote installer requests elevated privileges and the user grants them, the resulting impact may extend to system-level modification. ### Impact Assessment A malicious installer can obtain arbitrary command execution under the invoking user's account. This may permit access to that user's files, credentials, API configuration, and local model data; modification of shell or ap ...[truncated 337 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the direct `curl | sh` pipeline. 2. Prefer installation through a trusted operating-system package repository where package signatures are verified. 3. If a standalone installer is required: - Pin an explicit, reviewed release URL. - Download the installer to a local file. - Obtain the expected SHA-256 digest or signature through an authenticated, independent release channel. - Verify the digest or publisher signature before execution. - Review the script before running it. - Execute it as an unprivileged user unless a documented installation step specifically requires elevation. 4. Document every privileged operation the installer is expected to perform. 5. Fail closed if integrity or signature verification does not succeed. A safer workflow should resemble: ```bash curl -fL --output ollama-install.sh "PINNED_RELEASE_URL" echo "EXPECTED_SHA256 ollama-install.sh" | sha256sum --check - less ollama-install.sh sh ollama-install.sh ``` The checksum must come from a trusted publisher source and must be updated deliberately when upgrading the pinned release. ]]>

T08 · Insecure Dependencies

Warning

• Location: references/local-providers.md:58
• Finding: Downloaded llamafile Executable Is Run Without Integrity Verification<![CDATA[ ## Vulnerability Details **File Location**: `references/local-providers.md`, lines 58-63 **Vulnerability Type**: Unverified third-party executable dependency **Risk Level**: Medium ### Vulnerable Code ```bash Download from https://github.com/Mozilla-Ocho/llamafile/releases ```bash chmod +x phi-2.Q4_K_M.llamafile ./phi-2.Q4_K_M.llamafile --server --nobrowser --port 8080 ``` ``` ### Technical Analysis The setup guide instructs users to download an executable from a general releases page, mark it executable, and launch it. It does not pin a particular approved release or asset and does not require verification of a publisher signature or cryptographic checksum. Although the stated GitHub repository is relevant to the supported provider, relying only on the download location does not establish the integrity of the obtained binary. A compromised upstream account, release process, hosting path, or substituted local download could result in an attacker-controlled executable being launched. ### Attack Path 1. A user follows the guide and selects a llamafile asset from the linked releases page. 2. An attacker compromises or substitutes the selected release asset or otherwise causes the user to obtain a modified file. 3. The user runs `chmod +x`, making the downloaded file executable. 4. The user launches the file without validating its digest or publisher signature. 5. The substituted executable runs arbitrary native code with the privileges of the invoking user. ### Impact Assessment Successful exploitation provides native code execution under the user's account. The executable could read or alter files accessible to that user, access local credentials and configuration, connect to external services, modify user-level startup configuration, or install additional payloads. No explicit root execution or privilege-escalation mechanism is present in the documented command. The directly demonstrated scope is therefore limited to the invoking user's exist ...[truncated 98 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin a specific reviewed llamafile release and exact asset name rather than linking only to the latest releases page. 2. Publish the expected SHA-256 digest in the setup instructions or reference an authenticated publisher checksum manifest. 3. Require checksum or signature verification before applying executable permissions. 4. Prefer signed releases and document how to validate the signature against a trusted publisher key. 5. Advise users to execute the provider as an unprivileged account and restrict its filesystem and network access where practical. 6. Do not launch the file if its integrity cannot be verified. Example hardened flow: ```bash curl -fL --output phi-2.Q4_K_M.llamafile "PINNED_RELEASE_ASSET_URL" echo "EXPECTED_SHA256 phi-2.Q4_K_M.llamafile" | sha256sum --check - chmod 0755 phi-2.Q4_K_M.llamafile ./phi-2.Q4_K_M.llamafile --server --nobrowser --port 8080 ``` The pinned URL and checksum should be updated only after the new release has been reviewed. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (14)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The supplied code is a narrow availability checker for local LLM providers. It queries localhost endpoints for Ollama, LM Studio, and llamafile, parses model metadata, and outputs availability plus a preferred local provider. That behavior is only a small supporting piece of the declared skill. The declared description promises a broader system that routes requests to local models first, falls back to cloud APIs when needed, and tracks savings in a persistent dashboard. None of those major capabilities appear in this code chunk. While the providers listed are consistent with the description, the actual primary purpose here is provider detection, not request routing or dashboard/cost tracking.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The declared description presents a full routing system with provider support, cloud fallback, and persistent savings/dashboard tracking. The supplied code only makes a heuristic routing decision and prints it as JSON. It does not send requests to any model, interface with Ollama/LM Studio/llamafile, contact cloud APIs, store metrics, or expose a dashboard. While the code is related to routing logic, it implements only a narrow decision component, so the description materially overstates the skill's actual behavior.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The declared description presents a broader skill whose primary purpose is request routing between local and cloud LLMs, with provider support and a dashboard. The supplied code chunk is only a bookkeeping utility for savings metrics persisted to ~/.openclaw/local-first-llm/savings.json. While the tracking portion partially aligns with the description, the core advertised behavior—routing requests to local models first, falling back to cloud APIs, and supporting specific local providers—is absent from this code. Therefore the description materially overstates the implemented capabilities.

Missing User Warnings

High

• Confidence: 95% confidence
• Finding: The skill promotes cloud fallback but does not clearly warn that prompts may be sent to external APIs when local handling is unavailable or deemed unsuitable. In a privacy-focused routing skill, omission of that disclosure is especially dangerous because users may rely on the skill specifically to keep sensitive prompts local.

External Script Fetching

High

• Category: Supply Chain

Content

brew install ollama

# Linux
curl -fsSL https://ollama.ai/install.sh | sh
```

**Start server**

• Confidence: 98% confidence
• Finding: Piping a remotely fetched script directly into `sh` executes unverified code from the network without giving the user a chance to inspect or validate it. If the hosting site, connection path, or install script is compromised, this can lead to arbitrary code execution on the user's machine.

Chaining Abuse

High

• Category: Tool Misuse

Content

brew install ollama

# Linux
curl -fsSL https://ollama.ai/install.sh | sh
```

**Start server**

• Confidence: 98% confidence
• Finding: The `| sh` construct is dangerous because it turns downloaded content into immediate shell execution, collapsing download and execution into a single opaque step. In documentation aimed at setting up local LLM tooling, this increases the chance that users will run privileged or persistent code they have not reviewed.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 85% confidence
• Finding: The skill advertises and demonstrates shell execution, network access, and persistent file writes, but does not declare any tool scope such as permissions or allowed-tools. That creates an implicit capability surface where an agent may invoke sensitive operations without an explicit least-privilege contract, increasing the chance of unsafe or surprising behavior.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The activation text includes a broad trigger: 'any request where local-vs-cloud routing should be decided automatically.' Broad auto-activation can cause the skill to engage in contexts the user did not clearly request, which is risky here because the skill influences network routing, privacy decisions, and persistent logging.

External Transmission

Medium

• Category: Data Exfiltration

Content

### Ollama

```bash
curl http://localhost:11434/api/generate \
  -d '{"model": "llama3.2", "prompt": "YOUR_PROMPT", "stream": false}'
```

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

**Test**

```bash
curl http://localhost:11434/api/generate \
  -d '{"model":"llama3.2","prompt":"Hello","stream":false}'
```

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Whitespace Padding

Medium

• Category: Prompt Injection

Content

Each request is scored before routing. Higher = more complex = prefer cloud.

| Factor                                                                                                                                                                                   | Score Change |
| ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------ |
| Keyword match: `analyze`, `synthesize`, `compare`, `reason`, `architecture`, `code review`, `multi-step`, `evaluate`, `critique`, `refactor`, `design`, `implement`, `debug`, `strategy` | +2 per match |
| Keyword match: `summarize`, `translate`, `list`, `what is`, `define`, `explain briefly`, `convert`, `format`, `reformat`, `spell check`                                                  | −1 per match |

• Confidence: 70% confidence
• Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Whitespace Padding

Medium

• Category: Prompt Injection

Content

| ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------ |
| Keyword match: `analyze`, `synthesize`, `compare`, `reason`, `architecture`, `code review`, `multi-step`, `evaluate`, `critique`, `refactor`, `design`, `implement`, `debug`, `strategy` | +2 per match |
| Keyword match: `summarize`, `translate`, `list`, `what is`, `define`, `explain briefly`, `convert`, `format`, `reformat`, `spell check`                                                  | −1 per match |
| Token count > 4,000                                                                                                                                                                      | +2           |
| Token count < 500                                                                                                                                                                        | −1           |

## Decision Tree

• Confidence: 70% confidence
• Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Whitespace Padding

Medium

• Category: Prompt Injection

Content

| Keyword match: `analyze`, `synthesize`, `compare`, `reason`, `architecture`, `code review`, `multi-step`, `evaluate`, `critique`, `refactor`, `design`, `implement`, `debug`, `strategy` | +2 per match |
| Keyword match: `summarize`, `translate`, `list`, `what is`, `define`, `explain briefly`, `convert`, `format`, `reformat`, `spell check`                                                  | −1 per match |
| Token count > 4,000                                                                                                                                                                      | +2           |
| Token count < 500                                                                                                                                                                        | −1           |

## Decision Tree

• Confidence: 70% confidence
• Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

def run(args: list) -> dict:
    try:
        result = subprocess.run(
            [PY] + args, capture_output=True, text=True, timeout=5
        )
        return json.loads(result.stdout) if result.returncode == 0 and result.stdout.strip() else {}

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Static analysis

No suspicious patterns detected.