Ollama Updater

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:02 PM UTC
• Version: 1.0.1

Overview

This Ollama updater is purpose-aligned, but it asks users to run high-impact privileged installation steps without enough verification or opt-in controls.

Review the bundled shell script before use. Prefer installing from the packaged artifact or a pinned release, not a mutable main-branch URL. Only run it with sudo if you accept system-wide changes, service persistence, user/group modification, and possible GPU driver or kernel-module changes. Back up or inspect Ollama paths before using the documented uninstall commands.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

• Location: INSTALL.md:42
• Finding: Mutable Remote Installation Script Executed with Root Privileges<![CDATA[ ## Vulnerability Details **File Location**: `INSTALL.md:42-49` **Additional Location**: `README.md:104-112` **Vulnerability Type**: Unverified remote payload retrieval and privileged execution **Risk Level**: Critical ### Vulnerable Code ```bash # 1. Download script cd /tmp curl -fsSL https://raw.githubusercontent.com/openclaw/skills/main/ollama-updater/ollama-install.sh -o ollama-install.sh # 2. Add execution permission chmod +x ollama-install.sh # 3. Run installation sudo ./ollama-install.sh ``` The equivalent workflow is also recommended in `README.md:104-112`. ### Technical Analysis The installation instructions download a shell script from the mutable `main` branch of a GitHub repository and subsequently execute it with `sudo`. The retrieved file is not authenticated using a cryptographic signature or a pinned checksum, and the URL does not reference an immutable commit. HTTPS protects the connection in transit but does not ensure that the branch contents remain identical to the version reviewed in this audit. Compromise of the repository, maintainer account, publishing workflow, or GitHub organization could replace the script after review. Unlike a literal `curl | sh` pipeline, this workflow writes the script to disk first. However, the instructions do not require users to inspect it, and no automated integrity check occurs before execution. Its effective security properties therefore remain similar to remote shell execution. ### Attack Path 1. An attacker compromises the repository, a maintainer account, or the workflow permitted to update the `main` branch. 2. The attacker replaces `ollama-install.sh` with a malicious script while preserving the documented URL. 3. A user follows the installation instructions and retrieves the modified file. 4. The user marks the file executable and invokes it with `sudo`. 5. The attacker-controlled script executes with root privileges. 6. The payload can alter system files, install services, acces ...[truncated 626 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Prefer executing the reviewed script bundled in the installed Skill rather than downloading another copy at runtime. 2. If remote retrieval is necessary, use an immutable commit URL rather than a mutable branch: ```text https://raw.githubusercontent.com/openclaw/skills/<full-commit-id>/ollama-updater/ollama-install.sh ``` 3. Publish signed release artifacts and verify the signature before execution. 4. Publish a trusted SHA-256 digest through an independent, authenticated release channel and enforce verification: ```bash curl -fL '<immutable-url>' -o ollama-install.sh printf '%s %s\n' '<expected-sha256>' 'ollama-install.sh' | sha256sum -c - ``` 5. Abort installation if checksum or signature verification fails. 6. Require the user to inspect the downloaded script before running it. 7. Avoid running the entire installer as root. Download and validate artifacts as an unprivileged user, escalating only for narrowly scoped installation operations. 8. Replace the README example containing `curl -fsSL https://ollama.com/install.sh | sh` with a download, verification, review, and execution workflow. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: ollama-install.sh:157
• Finding: Unverified Archives Extracted Directly into Privileged System Locations<![CDATA[ ## Vulnerability Details **File Location**: `ollama-install.sh:157-187` **Related Installation Location**: `ollama-install.sh:190-208` **Vulnerability Type**: Unsafe privileged archive installation without authenticity or path validation **Risk Level**: High ### Vulnerable Code ```sh download_and_extract() { local url_base="$1" local dest_dir="$2" local filename="$3" # Check if .tar.zst is available if curl --fail --silent --head --location "${url_base}/${filename}.tar.zst${VER_PARAM}" >/dev/null 2>&1; then # zst file exists - check if we have zstd tool if ! available zstd; then error "This version requires zstd for extraction. Please install zstd and try again: - Debian/Ubuntu: sudo apt-get install zstd - RHEL/CentOS/Fedora: sudo dnf install zstd - Arch: sudo pacman -S zstd" fi status "Downloading ${filename}.tar.zst (with resumable support)" download_file "${url_base}/${filename}.tar.zst${VER_PARAM}" "$TEMP_DIR/download.tar.zst" status "Extracting..." zstd -d -c "$TEMP_DIR/download.tar.zst" | $SUDO tar -xf - -C "${dest_dir}" return 0 fi # Fall back to .tgz for older versions status "Downloading ${filename}.tgz (with resumable support)" download_file "${url_base}/${filename}.tgz${VER_PARAM}" "$TEMP_DIR/download.tar.gz" status "Extracting..." $SUDO tar -xzf "$TEMP_DIR/download.tar.gz" -C "${dest_dir}" } ``` The destination is subsequently selected from system locations and prepared with root ownership: ```sh for BINDIR in /usr/local/bin /usr/bin /bin; do echo $PATH | grep -q $BINDIR && break || continue done OLLAMA_INSTALL_DIR=$(dirname ${BINDIR}) if [ -d "$OLLAMA_INSTALL_DIR/lib/ollama" ] ; then status "Cleaning up old version at $OLLAMA_INSTALL_DIR/lib/ollama" $SUDO rm -rf "$OLLAMA_INSTALL_DIR/lib/ollama" fi status "Installing ollama to $OLLAMA_INSTALL_DIR" $SUDO install -o0 -g0 -m755 -d $B ...[truncated 2267 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Obtain vendor-provided checksums or signatures over a trusted authenticated channel. 2. Verify the downloaded archive before any privileged processing: ```sh printf '%s %s\n' "$EXPECTED_SHA256" "$ARCHIVE" | sha256sum -c - ``` 3. Prefer signature verification with a pinned vendor public key and fail closed if verification cannot be completed. 4. Download and inspect the archive as an unprivileged user. 5. List and validate every archive entry before extraction. Reject: - Absolute paths. - Paths containing traversal components. - Unsafe symbolic or hard links. - Device nodes and unexpected special files. - Files outside an explicit expected allowlist. 6. Extract into a newly created unprivileged staging directory rather than directly into `/usr`, `/usr/local`, or `/bin`. 7. Validate the staged directory structure, file types, ownership, and executable set. 8. Use narrowly scoped privileged `install` commands to copy only explicitly expected files from staging into the final system directory. 9. Preserve the previously installed version until verification and staging complete successfully, enabling atomic replacement and rollback. ]]>

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: ollama-install.sh:348
• Finding: Automatic GPU Driver, Repository, Kernel, and Boot Configuration Exceeds Least Privilege<![CDATA[ ## Vulnerability Details **File Location**: `ollama-install.sh:348-412` and `ollama-install.sh:436-479` **Vulnerability Type**: Excessive privileged system modification during an updater operation **Risk Level**: Medium ### Vulnerable Code The installer automatically adds external repositories and installs GPU drivers: ```sh install_cuda_driver_yum() { status 'Installing NVIDIA repository...' case $PACKAGE_MANAGER in yum) $SUDO $PACKAGE_MANAGER -y install yum-utils if curl -I --silent --fail --location "https://developer.download.nvidia.com/compute/cuda/repos/$1$2/$(uname -m | sed -e 's/aarch64/sbsa/')/cuda-$1$2.repo" >/dev/null ; then $SUDO $PACKAGE_MANAGER-config-manager --add-repo https://developer.download.nvidia.com/compute/cuda/repos/$1$2/$(uname -m | sed -e 's/aarch64/sbsa/')/cuda-$1$2.repo else error $CUDA_REPO_ERR_MSG fi ;; dnf) if curl -I --silent --fail --location "https://developer.download.nvidia.com/compute/cuda/repos/$1$2/$(uname -m | sed -e 's/aarch64/sbsa/')/cuda-$1$2.repo" >/dev/null ; then $SUDO $PACKAGE_MANAGER config-manager --add-repo https://developer.download.nvidia.com/compute/cuda/repos/$1$2/$(uname -m | sed -e 's/aarch64/sbsa/')/cuda-$1$2.repo else error $CUDA_REPO_ERR_MSG fi ;; esac case $1 in rhel) status 'Installing EPEL repository...' $SUDO $PACKAGE_MANAGER -y install https://dl.fedoraproject.org/pub/epel/epel-release-latest-$2.noarch.rpm || true ;; esac status 'Installing CUDA driver...' if [ "$1" = 'centos' ] || [ "$1$2" = 'rhel7' ]; then $SUDO $PACKAGE_MANAGER -y install nvidia-driver-latest-dkms fi $SUDO $PACKAGE_MANAGER -y install cuda-drivers } install_cuda_driver_apt() { status 'Installing NVIDIA repository...' if curl -I ...[truncated 5154 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Make GPU driver installation a separate operation that is disabled by default. 2. Require an explicit option such as: ```sh ollama-install.sh --install-gpu-driver ``` 3. Display the exact repositories, packages, files, and kernel modules that will be changed, then obtain confirmation before proceeding. 4. Allow GPU-enabled Ollama packages to be installed without changing host drivers whenever a compatible driver is already available. 5. Separate application installation from driver administration so users can follow distribution- or vendor-supported driver procedures. 6. Verify downloaded keyring packages using a pinned digest or vendor signature before invoking `dpkg`. 7. Validate OS and version values against a strict allowlist before constructing repository URLs. 8. Avoid silent or unconditional noninteractive package installation unless the user explicitly requested unattended operation. 9. Provide rollback instructions for repositories, keyrings, drivers, DKMS modules, and `/etc/modules-load.d/nvidia.conf`. 10. Add separate `--enable-service` and `--no-service` controls for systemd persistence, with service creation requiring informed consent. 11. Limit privilege escalation to the individual commands that require it rather than recommending execution of the entire installer as root. ]]>

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (109)

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The uninstall section includes destructive commands such as rm and userdel under sudo, but does not clearly warn that files, services, and the ollama user account will be permanently removed. This raises the risk of accidental data loss or service disruption, especially if users copy-paste commands without understanding their effects.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

sudo systemctl disable ollama

# 删除文件
sudo rm -rf /usr/local/lib/ollama
sudo rm /usr/local/bin/ollama
sudo rm /etc/systemd/system/ollama.service

• Confidence: 90% confidence
• Finding: The documented use of sudo rm -rf on an installation directory is a destructive operation that can remove data recursively without confirmation. In an uninstall context this can be legitimate, but without clear warnings or verification steps it still presents accidental-loss risk.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

sudo systemctl disable ollama

# 删除文件
sudo rm -rf /usr/local/lib/ollama
sudo rm /usr/local/bin/ollama
sudo rm /etc/systemd/system/ollama.service

• Confidence: 90% confidence
• Finding: The documented use of sudo rm -rf on an installation directory is a destructive operation that can remove data recursively without confirmation. In an uninstall context this can be legitimate, but without clear warnings or verification steps it still presents accidental-loss risk.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

# 删除文件
sudo rm -rf /usr/local/lib/ollama
sudo rm /usr/local/bin/ollama
sudo rm /etc/systemd/system/ollama.service

# 删除用户

• Confidence: 85% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

# 删除文件
sudo rm -rf /usr/local/lib/ollama
sudo rm /usr/local/bin/ollama
sudo rm /etc/systemd/system/ollama.service

# 删除用户
sudo userdel -r ollama

• Confidence: 85% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

External Script Fetching

High

• Category: Supply Chain

Content

```bash
# 官方脚本 - 下载中断后需要重新开始
$ curl -fsSL https://ollama.com/install.sh | sh
>>> Downloading ollama-linux-amd64.tar.zst
###################### 31.1%
curl: (92) HTTP/2 stream 1 was not closed cleanly: PROTOCOL_ERROR

• Confidence: 97% confidence
• Finding: The README includes a classic pattern of fetching a remote script and piping it directly to sh. Even though it is presented as the official upstream example, this is dangerous because it executes network-delivered code immediately without review, integrity verification, or pinning, enabling full code execution if the remote source or transport path is compromised.

Chaining Abuse

High

• Category: Tool Misuse

Content

```bash
# 官方脚本 - 下载中断后需要重新开始
$ curl -fsSL https://ollama.com/install.sh | sh
>>> Downloading ollama-linux-amd64.tar.zst
###################### 31.1%
curl: (92) HTTP/2 stream 1 was not closed cleanly: PROTOCOL_ERROR

• Confidence: 97% confidence
• Finding: The shell-chaining pattern '| sh' causes whatever is fetched over the network to be executed immediately. In an installer context this is especially risky because users are likely to run it verbatim, making any upstream compromise or content substitution a direct arbitrary code execution path.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

if [ -d "/Applications/Ollama.app" ]; then
        status "Removing existing Ollama installation..."
        rm -rf "/Applications/Ollama.app"
    fi

    status "Downloading Ollama for macOS (with resumable support)..."

• Confidence: 100% confidence
• Finding: Using rm -rf to delete an existing application bundle without confirmation is a hazardous destructive operation. Even though the path is fixed, forceful recursive deletion is unforgiving and can cause data loss or remove a legitimate prior installation unexpectedly.

Chaining Abuse

High

• Category: Tool Misuse

Content

if [ ! -L "/usr/local/bin/ollama" ] || [ "$(readlink "/usr/local/bin/ollama")" != "/Applications/Ollama.app/Contents/Resources/ollama" ]; then
        status "Adding 'ollama' command to PATH (may require password)..."
        mkdir -p "/usr/local/bin" 2>/dev/null || sudo mkdir -p "/usr/local/bin"
        ln -sf "/Applications/Ollama.app/Contents/Resources/ollama" "/usr/local/bin/ollama" 2>/dev/null || \
            sudo ln -sf "/Applications/Ollama.app/Contents/Resources/ollama" "/usr/local/bin/ollama"
    fi

• Confidence: 75% confidence
• Finding: Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

if [ -d "$OLLAMA_INSTALL_DIR/lib/ollama" ] ; then
    status "Cleaning up old version at $OLLAMA_INSTALL_DIR/lib/ollama"
    $SUDO rm -rf "$OLLAMA_INSTALL_DIR/lib/ollama"
fi
status "Installing ollama to $OLLAMA_INSTALL_DIR"
$SUDO install -o0 -g0 -m755 -d $BINDIR

• Confidence: 95% confidence
• Finding: rm -rf under sudo on the existing install directory is a risky command pattern because any path computation error can become destructive at root privilege. The constrained path lowers risk somewhat, but not enough to dismiss it in an agent automation context.

Credential Access

High

• Category: Privilege Escalation

Content

# ref: https://docs.nvidia.com/cuda/cuda-installation-guide-linux/index.html#debian
install_cuda_driver_apt() {
    status 'Installing NVIDIA repository...'
    if curl -I --silent --fail --location "https://developer.download.nvidia.com/compute/cuda/repos/$1$2/$(uname -m | sed -e 's/aarch64/sbsa/')/cuda-keyring_1.1-1_all.deb" >/dev/null ; then
        curl -fsSL -o $TEMP_DIR/cuda-keyring.deb https://developer.download.nvidia.com/compute/cuda/repos/$1$2/$(uname -m | sed -e 's/aarch64/sbsa/')/cuda-keyring_1.1-1_all.deb
    else
        error $CUDA_REPO_ERR_MSG

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

# ref: https://docs.nvidia.com/cuda/cuda-installation-guide-linux/index.html#debian
install_cuda_driver_apt() {
    status 'Installing NVIDIA repository...'
    if curl -I --silent --fail --location "https://developer.download.nvidia.com/compute/cuda/repos/$1$2/$(uname -m | sed -e 's/aarch64/sbsa/')/cuda-keyring_1.1-1_all.deb" >/dev/null ; then
        curl -fsSL -o $TEMP_DIR/cuda-keyring.deb https://developer.download.nvidia.com/compute/cuda/repos/$1$2/$(uname -m | sed -e 's/aarch64/sbsa/')/cuda-keyring_1.1-1_all.deb
    else
        error $CUDA_REPO_ERR_MSG

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

# ref: https://docs.nvidia.com/cuda/cuda-installation-guide-linux/index.html#debian
install_cuda_driver_apt() {
    status 'Installing NVIDIA repository...'
    if curl -I --silent --fail --location "https://developer.download.nvidia.com/compute/cuda/repos/$1$2/$(uname -m | sed -e 's/aarch64/sbsa/')/cuda-keyring_1.1-1_all.deb" >/dev/null ; then
        curl -fsSL -o $TEMP_DIR/cuda-keyring.deb https://developer.download.nvidia.com/compute/cuda/repos/$1$2/$(uname -m | sed -e 's/aarch64/sbsa/')/cuda-keyring_1.1-1_all.deb
    else
        error $CUDA_REPO_ERR_MSG

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Chaining Abuse

High

• Category: Tool Misuse

Content

$SUDO dpkg -i $TEMP_DIR/cuda-keyring.deb
    $SUDO apt-get update

    [ -n "$SUDO" ] && SUDO_E="$SUDO -E" || SUDO_E=
    DEBIAN_FRONTEND=noninteractive $SUDO_E apt-get -y install cuda-drivers -q
}

• Confidence: 75% confidence
• Finding: Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The manual installation path instructs users to download a script over the network and execute it with sudo, but provides no warning about privileged system modification or guidance to verify the script contents or provenance first. This is dangerous because a compromised upstream source, MITM at fetch time, or repository takeover would result in root-level arbitrary code execution on the user's machine.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

chmod +x ollama-install.sh

# 3. 运行安装
sudo ./ollama-install.sh
```

### 方法 4: Git 克隆

• Confidence: 93% confidence
• Finding: This line directs users to run the installer with sudo, granting the script full root privileges. In the context of a downloaded installer script, that means any malicious or compromised logic executes with complete control over the system.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The git-clone installation flow also ends in running the installer with sudo without any warning about root-level changes, review expectations, or trust boundary. Even though the source is cloned locally first, users are still directed to execute repository code as root, which can cause full system compromise if the repo content is malicious or tampered with.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

cd skills/ollama-updater

# 2. 运行安装
sudo ./ollama-install.sh
```

---

• Confidence: 90% confidence
• Finding: Running the cloned installer with sudo gives repository-provided code unrestricted administrative access. If the repository contents are altered maliciously or unexpectedly, this becomes a straightforward route to root compromise.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

sudo -v

# 然后运行
sudo ollama-updater
```

### 问题 3: zstd 错误

• Confidence: 88% confidence
• Finding: This instruction tells users to run the updater with sudo, implying the skill may perform privileged operations without clearly describing the resulting system impact. If the updater or its dependencies are unsafe, execution occurs with elevated privileges.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

sudo systemctl disable ollama

# 删除文件
sudo rm -rf /usr/local/lib/ollama
sudo rm /usr/local/bin/ollama
sudo rm /etc/systemd/system/ollama.service

• Confidence: 92% confidence
• Finding: This command performs a recursive forced deletion under sudo. Although the path is specific rather than wildcarded, destructive root-level deletion without explicit warning increases the risk of accidental data loss and makes any path mistake highly consequential.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

sudo rm /etc/systemd/system/ollama.service

# 删除用户
sudo userdel -r ollama
```

### 卸载技能

• Confidence: 90% confidence
• Finding: Deleting the ollama user account with sudo userdel -r removes the account and associated home data, which can cause irreversible data loss if users are not warned. In documentation form, copy-paste execution without explanation makes accidental destructive action more likely.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The README tells users to download and execute an installation script with sudo, but does not clearly warn that it will make privileged system changes or advise users to inspect and verify the script first. In a package-installation skill, this increases the risk of users blindly running remote code as root, which can lead to full system compromise if the script source is tampered with or malicious.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

chmod +x ollama-install.sh

# 运行
sudo ./ollama-install.sh
```

### 方法 3: 使用 ClawHub

• Confidence: 94% confidence
• Finding: The README instructs users to run a downloaded script with sudo, granting root privileges to code fetched from an external source. In this context, the danger is amplified because the skill is specifically an installer/updater, so users are primed to execute privileged commands with minimal scrutiny.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

### 手动运行

```bash
# 使用 sudo 运行
sudo bash /path/to/ollama-install.sh
```

• Confidence: 95% confidence
• Finding: Manual execution instructions explicitly call for sudo bash on the installer, which runs the entire script as root. If the script is modified upstream, intercepted, or replaced locally, this gives an attacker immediate privileged execution on the host.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

```bash
# 使用 sudo 运行
sudo bash /path/to/ollama-install.sh
```

---

• Confidence: 91% confidence
• Finding: This duplicate sudo-based instruction reinforces root execution without safety caveats. Repetition in documentation can normalize unsafe behavior and increase the chance that users execute unreviewed installer code with full privileges.

Static analysis

Detected: suspicious.destructive_delete_command

Documentation contains a destructive delete command without an explicit confirmation gate.

Warn

• Code: suspicious.destructive_delete_command
• Location: INSTALL.md:281