Self Hosted Ai

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:08 AM UTC
• Version: 0.1.0

Overview

This skill is mostly a self-hosted AI deployment guide, but it includes unsafe default deployment commands that can expose services or execute mutable remote code without enough safeguards.

Review this skill before installing or following it. Prefer verified package or release installation for Ollama instead of curl | sh, bind services to localhost by default, expose remote access only through authenticated TLS/VPN or a restricted reverse proxy, pin container image versions, and set strong N8N credentials before exposing any service.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:22

Finding

Unverified Remote Installer Is Piped Directly Into a Shell

Content

View full analysis

Remediation

View remediation

ollama-installer.sh" | sha256sum --check - less ollama-installer.sh sh ollama-installer.sh ``` The actual artifact URL and digest must come from Ollama's authenticated, official release documentation. The placeholder values must not be used directly. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:29

Finding

Ollama API Is Bound to All Network Interfaces Without Access Controls

Content

View full analysis

> /etc/environment systemctl restart ollama ``` ### Technical Analysis Setting `OLLAMA_HOST=0.0.0.0` instructs Ollama to listen on every available IPv4 network interface. The documented procedure does not pair this exposure with authentication, firewall restrictions, a VPN, TLS, or an authenticated reverse proxy. Binding to every interface exceeds the privileges and network exposure required for a local self-hosted deployment. On a host with a public or broadly reachable interface, the Ollama API may become accessible to untrusted clients. The later nginx example does not mitigate direct access to port 11434 if that port remains reachable. ### Attack Path 1. A user applies the documented configuration on a server connected to an untrusted network or the Internet. 2. Ollama restarts and listens on all interfaces. 3. Host or cloud firewall rules permit access to port 11434, whether intentionally or by default. 4. An attacker discovers the exposed port through scanning or known host information. 5. The attacker communicates directly with the Ollama API without passing through an authentication layer. 6. The attacker enumerates available models or submits repeated inference requests, consuming host resources. ### Impact Assessment An unauthenticated remote party may be able to use the exposed model service, enumerate model-related information, and consume CPU, GPU, memory, and network resources. Repeated or expensive requests can degrade availability or create denial-of-service conditions. The direct demonstrated scope is unauthorized access to the Ollama API and its computational resources. The documentation alone does not establish arbitrary host command execution, so such access should not be assumed without an additional Ollama-s ...[truncated 26 chars]

Remediation

View remediation

> /etc/environment systemctl restart ollama ``` Remote access should then be provided only through a separately secured access layer. ]]>

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:42

Finding

N8N Deployment Uses an Unpinned Mutable Container Image

Content

View full analysis

Remediation

View remediation

@sha256: ``` The version and digest must be obtained from and verified against the official N8N release channel. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 97% confidence

Finding

curl -fsSL https://ollama.com/install.sh | sh 直接获取并执行远程脚本，绕过了完整性校验、人工审查和包管理器审计。如果上游站点、CDN、DNS、TLS 终端或传输链路被劫持，用户会以当前权限执行任意命令，造成主机完全失陷。

Content

Scanner excerpt · SKILL.md (reported line 22)May include surrounding context.

bash

# 1. 安装（Linux）
curl -fsSL https://ollama.com/install.sh | sh

# 2. 拉取模型
ollama pull llama3.2        # 轻量

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 98% confidence

Finding

管道到 sh 形成了“下载即执行”的高危命令链，使任何被返回的内容都立即成为 shell 指令执行。结合该技能的运维部署场景，这种模式尤其危险，因为用户很可能在服务器上、甚至以 root 权限运行，最终导致远程代码执行和持久化植入。

Content

Scanner excerpt · SKILL.md (reported line 22)May include surrounding context.

bash

# 1. 安装（Linux）
curl -fsSL https://ollama.com/install.sh | sh

# 2. 拉取模型
ollama pull llama3.2        # 轻量

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

L03 将触发条件写为“部署 Ollama”“装 N8N”“自己跑 AI”“搭建本地大模型”“自托管 AI 工具”时触发，其中“自己跑 AI”“搭建本地大模型”语义较宽，且未说明排除条件或具体上下文。文档也没有提供负例或限制场景，容易与一般性咨询或讨论重叠。

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

该技能给出了修改系统环境并开放远程访问的步骤，如设置 OLLAMA_HOST=0.0.0.0、暴露容器端口和配置公网反向代理，但没有同步提供清晰的风险提示、最小暴露原则或访问控制要求。在自托管 AI 场景下，这会显著增加未授权访问、服务暴露到公网和错误配置导致的数据泄露风险。

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 34)May include surrounding context.

systemctl restart ollama

4. 验证

curl http://localhost:11434/api/tags

text

## 标准部署流程（N8N）

Static analysis

No suspicious patterns detected.