Ollama Updater

• Outcome: Pass
• Latest audit: May 28, 2026, 2:18 AM
• Version:
  1.0.1

Overview

This is a coherent Ollama installer/updater, but it makes real system-level changes and should only be run by users who intend a privileged Ollama installation.

Install only if you want a system-wide Ollama install or update and are comfortable granting administrator privileges. Review the shell script first, avoid running unpinned remote copies with sudo, and be aware it can replace existing Ollama files, create a service account, enable a background service, and install GPU/CUDA components.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (11)

Intent-Code Divergence

Medium

• Confidence: 91% confidence
• Finding: The document is presented as an 'updater' guide, but the instructions include full installation flows, direct download-and-execute behavior, and later full removal steps. This mismatch can mislead users and automation into performing broader system changes than expected, increasing the chance of unsafe privileged execution.

Intent-Code Divergence

Medium

• Confidence: 94% confidence
• Finding: The comment states that everything after that point is optional, but the subsequent logic can create users, modify groups, install/enable a systemd service, and later install GPU drivers and kernel modules. This mismatch can mislead operators into running the script without realizing it will make persistent privileged system changes.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The guide instructs users to download a script with curl and execute it with sudo, which grants full root privileges to remotely sourced code. Without an explicit warning, integrity verification step, or review recommendation, users may run modified or malicious content that can fully compromise the host.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The repository-clone path also runs a local install script with sudo, again causing privileged execution of unreviewed code from a mutable repository state. Users may assume a cloned script is safer, but it still enables full system compromise if the repo is tampered with or the script behaves unexpectedly.

Missing User Warnings

High

• Confidence: 96% confidence
• Finding: The uninstall section performs destructive actions including recursive deletion of installed files and deletion of a system user, but does not clearly warn that these operations are irreversible and privileged. Users may unintentionally remove data or break a service environment if they run these commands blindly.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The README explicitly tells users to execute a downloaded installer with sudo, but does not provide a clear warning that this grants the script full root access and can modify system files, services, and packages. In a skill context, users may treat documented commands as trusted workflow, which increases the chance of unsafe privileged execution of remotely sourced code.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The README describes behavior with notable system and privacy impact, including network downloads, GPU detection, and systemd service setup, but does not clearly warn users about those effects. For an install/update skill, omission of these disclosures can mislead users into authorizing actions they do not fully understand.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The documentation advertises automatic cleanup and GPU support but does not clearly warn that running the updater may make privileged system changes, including modifying system-installed software and potentially installing drivers. In the context of an installer/updater skill, missing disclosure increases the chance that users execute it without understanding the scope of changes or the need for elevated privileges.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: On macOS, the script stops a running process, removes an existing application bundle, writes into /Applications, and may create a symlink in /usr/local/bin, all without an explicit confirmation step. For an installer this may be common, but it is still risky because a user invoking a remote script may not expect destructive replacement behavior.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The Linux path deletes an existing installation directory and writes new binaries and libraries under system directories with root privileges, without explicit user confirmation. In the context of a curl-piped installer, this increases the risk of unintended destructive changes if the script is altered or misunderstood.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: This section silently creates a system user, alters group memberships, writes a systemd unit, enables persistence, and starts the service. These are privileged and persistent configuration changes that materially affect system behavior and should not be treated as implicit side effects of a basic install.

VirusTotal

66/66 vendors flagged this skill as clean.