Ollama Updater

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:02 PM UTC
• Version: 1.0.1

Overview

This Ollama updater is purpose-aligned, but it asks users to run high-impact privileged installation steps without enough verification or opt-in controls.

Review the bundled shell script before use. Prefer installing from the packaged artifact or a pinned release, not a mutable main-branch URL. Only run it with sudo if you accept system-wide changes, service persistence, user/group modification, and possible GPU driver or kernel-module changes. Back up or inspect Ollama paths before using the documented uninstall commands.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

• Location: INSTALL.md:42

Finding

Mutable Remote Installation Script Executed with Root Privileges

Content

View full analysis

Remediation

View remediation

/ollama-updater/ollama-install.sh ``` 3. Publish signed release artifacts and verify the signature before execution. 4. Publish a trusted SHA-256 digest through an independent, authenticated release channel and enforce verification: ```bash curl -fL '' -o ollama-install.sh printf '%s %s\n' '' 'ollama-install.sh' | sha256sum -c - ``` 5. Abort installation if checksum or signature verification fails. 6. Require the user to inspect the downloaded script before running it. 7. Avoid running the entire installer as root. Download and validate artifacts as an unprivileged user, escalating only for narrowly scoped installation operations. 8. Replace the README example containing `curl -fsSL https://ollama.com/install.sh | sh` with a download, verification, review, and execution workflow. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: ollama-install.sh:157

Finding

Unverified Archives Extracted Directly into Privileged System Locations

Content

View full analysis

/dev/null 2>&1; then # zst file exists - check if we have zstd tool if ! available zstd; then error "This version requires zstd for extraction. Please install zstd and try again: - Debian/Ubuntu: sudo apt-get install zstd - RHEL/CentOS/Fedora: sudo dnf install zstd - Arch: sudo pacman -S zstd" fi status "Downloading ${filename}.tar.zst (with resumable support)" download_file "${url_base}/${filename}.tar.zst${VER_PARAM}" "$TEMP_DIR/download.tar.zst" status "Extracting..." zstd -d -c "$TEMP_DIR/download.tar.zst" | $SUDO tar -xf - -C "${dest_dir}" return 0 fi # Fall back to .tgz for older versions status "Downloading ${filename}.tgz (with resumable support)" download_file "${url_base}/${filename}.tgz${VER_PARAM}" "$TEMP_DIR/download.tar.gz" status "Extracting..." $SUDO tar -xzf "$TEMP_DIR/download.tar.gz" -C "${dest_dir}" } ``` The destination is subsequently selected from system locations and prepared with root ownership: ```sh for BINDIR in /usr/local/bin /usr/bin /bin; do echo $PATH | grep -q $BINDIR && break || continue done OLLAMA_INSTALL_DIR=$(dirname ${BINDIR}) if [ -d "$OLLAMA_INSTALL_DIR/lib/ollama" ] ; then status "Cleaning up old version at $OLLAMA_INSTALL_DIR/lib/ollama" $SUDO rm -rf "$OLLAMA_INSTALL_DIR/lib/ollama" fi status "Installing ollama to $OLLAMA_INSTALL_DIR" $SUDO install -o0 -g0 -m755 -d $B ...[truncated 2267 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: ollama-install.sh:348

Finding

Automatic GPU Driver, Repository, Kernel, and Boot Configuration Exceeds Least Privilege

Content

View full analysis

/dev/null ; then $SUDO $PACKAGE_MANAGER-config-manager --add-repo https://developer.download.nvidia.com/compute/cuda/repos/$1$2/$(uname -m | sed -e 's/aarch64/sbsa/')/cuda-$1$2.repo else error $CUDA_REPO_ERR_MSG fi ;; dnf) if curl -I --silent --fail --location "https://developer.download.nvidia.com/compute/cuda/repos/$1$2/$(uname -m | sed -e 's/aarch64/sbsa/')/cuda-$1$2.repo" >/dev/null ; then $SUDO $PACKAGE_MANAGER config-manager --add-repo https://developer.download.nvidia.com/compute/cuda/repos/$1$2/$(uname -m | sed -e 's/aarch64/sbsa/')/cuda-$1$2.repo else error $CUDA_REPO_ERR_MSG fi ;; esac case $1 in rhel) status 'Installing EPEL repository...' $SUDO $PACKAGE_MANAGER -y install https://dl.fedoraproject.org/pub/epel/epel-release-latest-$2.noarch.rpm || true ;; esac status 'Installing CUDA driver...' if [ "$1" = 'centos' ] || [ "$1$2" = 'rhel7' ]; then $SUDO $PACKAGE_MANAGER -y install nvidia-driver-latest-dkms fi $SUDO $PACKAGE_MANAGER -y install cuda-drivers } install_cuda_driver_apt() { status 'Installing NVIDIA repository...' if curl -I ...[truncated 5154 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (109)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The uninstall section includes destructive commands such as rm and userdel under sudo, but does not clearly warn that files, services, and the ollama user account will be permanently removed. This raises the risk of accidental data loss or service disruption, especially if users copy-paste commands without understanding their effects.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

The documented use of sudo rm -rf on an installation directory is a destructive operation that can remove data recursively without confirmation. In an uninstall context this can be legitimate, but without clear warnings or verification steps it still presents accidental-loss risk.

Content

Scanner excerpt · INSTALL.md (reported line 281)May include surrounding context.

md

sudo systemctl disable ollama

# 删除文件
sudo rm -rf /usr/local/lib/ollama
sudo rm /usr/local/bin/ollama
sudo rm /etc/systemd/system/ollama.service

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

The documented use of sudo rm -rf on an installation directory is a destructive operation that can remove data recursively without confirmation. In an uninstall context this can be legitimate, but without clear warnings or verification steps it still presents accidental-loss risk.

Content

Scanner excerpt · INSTALL.md (reported line 281)May include surrounding context.

md

sudo systemctl disable ollama

# 删除文件
sudo rm -rf /usr/local/lib/ollama
sudo rm /usr/local/bin/ollama
sudo rm /etc/systemd/system/ollama.service

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · INSTALL.md (reported line 282)May include surrounding context.

md

# 删除文件
sudo rm -rf /usr/local/lib/ollama
sudo rm /usr/local/bin/ollama
sudo rm /etc/systemd/system/ollama.service

# 删除用户

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · INSTALL.md (reported line 283)May include surrounding context.

md

# 删除文件
sudo rm -rf /usr/local/lib/ollama
sudo rm /usr/local/bin/ollama
sudo rm /etc/systemd/system/ollama.service

# 删除用户
sudo userdel -r ollama

External Script Fetching

High

• Category: Supply Chain
• Confidence: 97% confidence

Finding

The README includes a classic pattern of fetching a remote script and piping it directly to sh. Even though it is presented as the official upstream example, this is dangerous because it executes network-delivered code immediately without review, integrity verification, or pinning, enabling full code execution if the remote source or transport path is compromised.

Content

Scanner excerpt · README.md (reported line 15)May include surrounding context.

bash

# 官方脚本 - 下载中断后需要重新开始
$ curl -fsSL https://ollama.com/install.sh | sh
>>> Downloading ollama-linux-amd64.tar.zst
###################### 31.1%
curl: (92) HTTP/2 stream 1 was not closed cleanly: PROTOCOL_ERROR

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 97% confidence

Finding

The shell-chaining pattern '| sh' causes whatever is fetched over the network to be executed immediately. In an installer context this is especially risky because users are likely to run it verbatim, making any upstream compromise or content substitution a direct arbitrary code execution path.

Content

Scanner excerpt · README.md (reported line 15)May include surrounding context.

bash

# 官方脚本 - 下载中断后需要重新开始
$ curl -fsSL https://ollama.com/install.sh | sh
>>> Downloading ollama-linux-amd64.tar.zst
###################### 31.1%
curl: (92) HTTP/2 stream 1 was not closed cleanly: PROTOCOL_ERROR

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 100% confidence

Finding

Using rm -rf to delete an existing application bundle without confirmation is a hazardous destructive operation. Even though the path is fixed, forceful recursive deletion is unforgiving and can cause data loss or remove a legitimate prior installation unexpectedly.

Content

Scanner excerpt · ollama-install.sh (reported line 66)May include surrounding context.

sh

if [ -d "/Applications/Ollama.app" ]; then
        status "Removing existing Ollama installation..."
        rm -rf "/Applications/Ollama.app"
    fi

    status "Downloading Ollama for macOS (with resumable support)..."

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · ollama-install.sh (reported line 80)May include surrounding context.

sh

if [ ! -L "/usr/local/bin/ollama" ] || [ "$(readlink "/usr/local/bin/ollama")" != "/Applications/Ollama.app/Contents/Resources/ollama" ]; then
        status "Adding 'ollama' command to PATH (may require password)..."
        mkdir -p "/usr/local/bin" 2>/dev/null || sudo mkdir -p "/usr/local/bin"
        ln -sf "/Applications/Ollama.app/Contents/Resources/ollama" "/usr/local/bin/ollama" 2>/dev/null || \
            sudo ln -sf "/Applications/Ollama.app/Contents/Resources/ollama" "/usr/local/bin/ollama"
    fi

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

rm -rf under sudo on the existing install directory is a risky command pattern because any path computation error can become destructive at root privilege. The constrained path lowers risk somewhat, but not enough to dismiss it in an agent automation context.

Content

Scanner excerpt · ollama-install.sh (reported line 197)May include surrounding context.

sh

if [ -d "$OLLAMA_INSTALL_DIR/lib/ollama" ] ; then
    status "Cleaning up old version at $OLLAMA_INSTALL_DIR/lib/ollama"
    $SUDO rm -rf "$OLLAMA_INSTALL_DIR/lib/ollama"
fi
status "Installing ollama to $OLLAMA_INSTALL_DIR"
$SUDO install -o0 -g0 -m755 -d $BINDIR

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · ollama-install.sh (reported line 391)May include surrounding context.

sh

# ref: https://docs.nvidia.com/cuda/cuda-installation-guide-linux/index.html#debian
install_cuda_driver_apt() {
    status 'Installing NVIDIA repository...'
    if curl -I --silent --fail --location "https://developer.download.nvidia.com/compute/cuda/repos/$1$2/$(uname -m | sed -e 's/aarch64/sbsa/')/cuda-keyring_1.1-1_all.deb" >/dev/null ; then
        curl -fsSL -o $TEMP_DIR/cuda-keyring.deb https://developer.download.nvidia.com/compute/cuda/repos/$1$2/$(uname -m | sed -e 's/aarch64/sbsa/')/cuda-keyring_1.1-1_all.deb
    else
        error $CUDA_REPO_ERR_MSG

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · ollama-install.sh (reported line 392)May include surrounding context.

sh

# ref: https://docs.nvidia.com/cuda/cuda-installation-guide-linux/index.html#debian
install_cuda_driver_apt() {
    status 'Installing NVIDIA repository...'
    if curl -I --silent --fail --location "https://developer.download.nvidia.com/compute/cuda/repos/$1$2/$(uname -m | sed -e 's/aarch64/sbsa/')/cuda-keyring_1.1-1_all.deb" >/dev/null ; then
        curl -fsSL -o $TEMP_DIR/cuda-keyring.deb https://developer.download.nvidia.com/compute/cuda/repos/$1$2/$(uname -m | sed -e 's/aarch64/sbsa/')/cuda-keyring_1.1-1_all.deb
    else
        error $CUDA_REPO_ERR_MSG

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · ollama-install.sh (reported line 408)May include surrounding context.

sh

# ref: https://docs.nvidia.com/cuda/cuda-installation-guide-linux/index.html#debian
install_cuda_driver_apt() {
    status 'Installing NVIDIA repository...'
    if curl -I --silent --fail --location "https://developer.download.nvidia.com/compute/cuda/repos/$1$2/$(uname -m | sed -e 's/aarch64/sbsa/')/cuda-keyring_1.1-1_all.deb" >/dev/null ; then
        curl -fsSL -o $TEMP_DIR/cuda-keyring.deb https://developer.download.nvidia.com/compute/cuda/repos/$1$2/$(uname -m | sed -e 's/aarch64/sbsa/')/cuda-keyring_1.1-1_all.deb
    else
        error $CUDA_REPO_ERR_MSG

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · ollama-install.sh (reported line 411)May include surrounding context.

sh

$SUDO dpkg -i $TEMP_DIR/cuda-keyring.deb
    $SUDO apt-get update

    [ -n "$SUDO" ] && SUDO_E="$SUDO -E" || SUDO_E=
    DEBIAN_FRONTEND=noninteractive $SUDO_E apt-get -y install cuda-drivers -q
}

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manual installation path instructs users to download a script over the network and execute it with sudo, but provides no warning about privileged system modification or guidance to verify the script contents or provenance first. This is dangerous because a compromised upstream source, MITM at fetch time, or repository takeover would result in root-level arbitrary code execution on the user's machine.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 93% confidence

Finding

This line directs users to run the installer with sudo, granting the script full root privileges. In the context of a downloaded installer script, that means any malicious or compromised logic executes with complete control over the system.

Content

Scanner excerpt · INSTALL.md (reported line 50)May include surrounding context.

chmod +x ollama-install.sh

3. 运行安装

sudo ./ollama-install.sh

text

### 方法 4: Git 克隆

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The git-clone installation flow also ends in running the installer with sudo without any warning about root-level changes, review expectations, or trust boundary. Even though the source is cloned locally first, users are still directed to execute repository code as root, which can cause full system compromise if the repo content is malicious or tampered with.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

Running the cloned installer with sudo gives repository-provided code unrestricted administrative access. If the repository contents are altered maliciously or unexpectedly, this becomes a straightforward route to root compromise.

Content

Scanner excerpt · INSTALL.md (reported line 61)May include surrounding context.

cd skills/ollama-updater

2. 运行安装

sudo ./ollama-install.sh

text

---

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 88% confidence

Finding

This instruction tells users to run the updater with sudo, implying the skill may perform privileged operations without clearly describing the resulting system impact. If the updater or its dependencies are unsafe, execution occurs with elevated privileges.

Content

Scanner excerpt · INSTALL.md (reported line 189)May include surrounding context.

sudo -v

然后运行

sudo ollama-updater

text

### 问题 3: zstd 错误

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 92% confidence

Finding

This command performs a recursive forced deletion under sudo. Although the path is specific rather than wildcarded, destructive root-level deletion without explicit warning increases the risk of accidental data loss and makes any path mistake highly consequential.

Content

Scanner excerpt · INSTALL.md (reported line 281)May include surrounding context.

md

sudo systemctl disable ollama

# 删除文件
sudo rm -rf /usr/local/lib/ollama
sudo rm /usr/local/bin/ollama
sudo rm /etc/systemd/system/ollama.service

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

Deleting the ollama user account with sudo userdel -r removes the account and associated home data, which can cause irreversible data loss if users are not warned. In documentation form, copy-paste execution without explanation makes accidental destructive action more likely.

Content

Scanner excerpt · INSTALL.md (reported line 286)May include surrounding context.

sudo rm /etc/systemd/system/ollama.service

删除用户

sudo userdel -r ollama

text

### 卸载技能

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The README tells users to download and execute an installation script with sudo, but does not clearly warn that it will make privileged system changes or advise users to inspect and verify the script first. In a package-installation skill, this increases the risk of users blindly running remote code as root, which can lead to full system compromise if the script source is tampered with or malicious.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 94% confidence

Finding

The README instructs users to run a downloaded script with sudo, granting root privileges to code fetched from an external source. In this context, the danger is amplified because the skill is specifically an installer/updater, so users are primed to execute privileged commands with minimal scrutiny.

Content

Scanner excerpt · README.md (reported line 112)May include surrounding context.

chmod +x ollama-install.sh

运行

sudo ./ollama-install.sh

text

### 方法 3: 使用 ClawHub

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 95% confidence

Finding

Manual execution instructions explicitly call for sudo bash on the installer, which runs the entire script as root. If the script is modified upstream, intercepted, or replaced locally, this gives an attacker immediate privileged execution on the host.

Content

Scanner excerpt · README.md (reported line 146)May include surrounding context.

手动运行

bash

# 使用 sudo 运行
sudo bash /path/to/ollama-install.sh

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 91% confidence

Finding

This duplicate sudo-based instruction reinforces root execution without safety caveats. Repetition in documentation can normalize unsafe behavior and increase the chance that users execute unreviewed installer code with full privileges.

Content

Scanner excerpt · README.md (reported line 147)May include surrounding context.

bash

# 使用 sudo 运行
sudo bash /path/to/ollama-install.sh

---

Static analysis

Detected: suspicious.destructive_delete_command

Documentation contains a destructive delete command without an explicit confirmation gate.

Warn

• Code: suspicious.destructive_delete_command
• Location: INSTALL.md:281