Dify

• Outcome: Review
• Latest audit: Sep 11, 2026 · 6:10 AM UTC
• Version: 1.0.0

Overview

This is a coherent Dify documentation skill, but it needs Review because it includes a copy-paste command that runs a remote installer directly in a shell without verification.

Install this skill only if you are comfortable with a Chinese Dify guide and will review commands before running them. Do not let an agent automatically execute the Ollama `curl | sh` installer; prefer a verified package, pinned release, or manual download-and-inspect flow. Use scoped Dify API keys, avoid uploading sensitive files unless intended, and confirm destructive API calls such as conversation deletion.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: references/model-providers.md:89

Finding

Unverified Remote Installer Executed Directly by a Shell

Content

View full analysis

Vulnerability Details

File Location: references/model-providers.md, line 89
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

Vulnerable Code

bash

# Install Ollama
curl -fsSL https://ollama.com/install.sh | sh

Technical Analysis

This command downloads a mutable shell script from an external URL and sends it directly to sh. The payload is not pinned to a specific release, saved for inspection, or validated using a cryptographic checksum or signature. Consequently, the code executed at installation time can differ from the content that existed when this Skill was reviewed.

Although installing Ollama supports the documented local-model configuration, piping a remote installer directly into a shell is not necessary for that functionality. A compromised upstream publishing account, web server, delivery path, or installer could substitute arbitrary shell commands. The -f, -s, and -S options also make the download relatively quiet, reducing the opportunity for users to notice unexpected behavior before execution.

Attack Path

1. A user or AI agent follows the documented Ollama installation procedure.
2. curl requests the current, externally controlled https://ollama.com/install.sh response.
3. An attacker who compromises the upstream installer or its delivery infrastructure modifies that response to include malicious shell commands.
4. The response is streamed immediately to sh without integrity verification or prior review.
5. The malicious commands execute with the permissions of the invoking user.
6. If the downloaded installer requests elevation and the user approves it, the payload may additionally obtain elevated system privileges.

Impact Assessment

Successful exploitation permits arbitrary command execution with the invoking user's privileges. This may expose or modify files accessible to that account, access locally available credenti ...[truncated 373 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the direct curl | sh installation command.
2. Prefer an official operating-system package manager or a documented manual installation procedure that does not execute network content immediately.
3. If a downloaded installer is required:
   • Pin it to a specific Ollama release rather than a mutable installation endpoint.
   • Download it to a local file first.
   • Verify a vendor-published cryptographic signature or checksum obtained through a trusted channel.
   • Present the script for inspection before execution.
   • Execute it only after explicit user confirmation.
4. Run installation with ordinary user privileges wherever possible, and request elevation only for narrowly identified operations that genuinely require it.
5. Document the expected files, services, network listeners, and permission changes so users can evaluate the installation's security impact.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (13)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 61)May include surrounding context.

启动

cd dify/docker cp .env.example .env docker compose up -d

text

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/api.md (reported line 95)May include surrounding context.

删除会话

http

DELETE /conversations/{id}

---

External Script Fetching

High

• Category: Supply Chain
• Confidence: 99% confidence

Finding

The command curl -fsSL https://ollama.com/install.sh | sh retrieves executable content from an external source and immediately runs it, creating a direct code-execution path if the remote server, network path, or script content is compromised. In skill documentation for self-hosting and model setup, users may copy-paste this verbatim, making the context more dangerous because it is presented as a standard setup step.

Content

Scanner excerpt · references/model-providers.md (reported line 89)May include surrounding context.

bash

# 安装Ollama
curl -fsSL https://ollama.com/install.sh | sh

# 运行模型
ollama run llama2

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 99% confidence

Finding

The | sh construct is a classic chaining pattern that eliminates the opportunity for users or automated review systems to inspect fetched content before execution. This amplifies supply-chain and command-execution risk, especially in an AI skill context where generated setup instructions may be followed automatically or by less experienced operators.

Content

Scanner excerpt · references/model-providers.md (reported line 89)May include surrounding context.

bash

# 安装Ollama
curl -fsSL https://ollama.com/install.sh | sh

# 运行模型
ollama run llama2

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest description is entirely written as a Chinese-only usage description, indicating the skill is intended to operate in Chinese without stating that users may choose another language. This creates a natural-language policy concern because it imposes a specific language/locale without opt-in or justification.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 57)May include surrounding context.

bash

# 克隆最新版本
git clone --branch "$(curl -s https://api.github.com/repos/langgenius/dify/releases/latest | jq -r .tag_name)" https://github.com/langgenius/dify.git

# 启动
cd dify/docker

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api.md (reported line 5)May include surrounding context.

md

## 基础URL

- 云端: `https://api.dify.ai/v1`
- 自托管: `http://your-server/v1`

## 认证

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The markdown explicitly documents a DELETE operation for conversations, which is a destructive action affecting user data. There is no accompanying warning that deletion may be irreversible or remove conversation history.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This markdown file describes uploading binary files and associating them with a user identifier, which can affect user data and privacy. The documentation provides the endpoint and parameters but does not include any warning that file contents will be transmitted to the API service or that remote URLs may cause external content retrieval.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The documentation includes a one-line remote install command that fetches a script over the network and immediately executes it with the shell, but it provides no warning, verification step, or safer alternative. In an agent skill or operational guide, this can normalize unsafe behavior and lead users to run compromised or tampered installer content directly on their systems.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The documentation describes an HTTP Request node that can send arbitrary outbound requests but does not warn that workflow authors may transmit user inputs, retrieved knowledge, credentials, or other sensitive runtime data to external services. In a workflow-building guide, this omission can lead users to create data exfiltration paths unintentionally, especially when variables are easily composed into headers, URLs, or bodies.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The Agent node is documented as capable of autonomous planning and multi-turn tool use without warning about scope, permissions, or downstream side effects. In this context, users may over-trust agent autonomy and connect tools or data sources without understanding that the agent could access sensitive context or trigger actions repeatedly across multiple steps.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The entire skill document is written in Chinese and does not indicate that this locale is optional, user-selectable, or limited to a China-specific audience. Under the stated policy, forcing a specific language without opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.