Qwen Ollama No-Think

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:58 AM UTC
• Version: 1.0.0

Overview

The skill is purpose-aligned but persistently modifies local Ollama model metadata and lacks strong safeguards against accidental overwrite or Modelfile injection.

Review before installing. Use only with a new derived target tag, run --dry-run first, back up relevant Ollama manifests/blobs, avoid untrusted --system text, and verify OLLAMA_HOST points where you expect. Do not run it against a valuable existing tag unless you are prepared to recreate or repair that tag.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/create_qwen_nothink_ollama.py:111

Finding

Unescaped System Message Permits Modelfile Directive Injection

Content

View full analysis

str: lines = [ f"FROM {source}", f'TEMPLATE """{NO_THINK_TEMPLATE}"""', ] saw_stop = False for key, value in params: if key == "stop": saw_stop = True continue lines.append(f"PARAMETER {key} {value}") if not saw_stop: lines.append('PARAMETER stop "<|im_end|>"') else: lines.append('PARAMETER stop "<|im_end|>"') lines.append(f'SYSTEM """\n{system}\n"""') return "\n".join(lines) + "\n" ``` ```python parser.add_argument("--system", default=DEFAULT_SYSTEM, help="System message for the derived tag.") ``` ```python modelfile = build_modelfile(source, parameters, args.system) ``` The generated file is subsequently passed to Ollama: ```python with tempfile.TemporaryDirectory(prefix="qwen-nothink-") as tmp: modelfile_path = Path(tmp) / "Modelfile" modelfile_path.write_text(modelfile, encoding="utf-8") run(["ollama", "create", target, "-f", str(modelfile_path)]) ``` ### Technical Analysis The user-controlled `--system` value is interpolated directly into a triple-quoted Modelfile block. The implementation neither escapes nor rejects the terminating `"""` sequence. An input containing `"""` can therefore terminate the intended `SYSTEM` block and append additional Modelfile content. Although the subprocess is invoked with an argument list and is not vulnerable to shell metacharacter injection, the generated Modelfile itself is a secondary command/configuration language. Consequently, avoiding `shell=True` does not prevent this form of configuration-language injection. The injected content is interpreted by `ollama create`, not merely stored as system- ...[truncated 1409 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/create_qwen_nothink_ollama.py:205

Finding

Existing Target Model Tag Can Be Overwritten Without Explicit Confirmation

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (10)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill instructs use of shell commands, local file modifications under the Ollama model store, network calls to a local HTTP API, and likely environment access, but it does not declare any explicit tool scope or permission boundaries. This creates an authorization gap where an agent may perform higher-risk actions than a reviewer or runtime policy would expect, especially because the workflow includes persistent model-store mutation.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 86% confidence

Finding

The skill is explicitly designed to create persistent no-think model variants and patch target manifests/config blobs in the local Ollama model store. Persistent modification of local model behavior can outlive the session, affect future inferences, and be difficult for users to notice or revert if the skill does not make those changes and rollback paths extremely explicit.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: ollama-qwen-nothink
description: Create and verify no-thinking variants of local Qwen/Qwen3-series Ollama models. Use when a user asks to disable thinking, hide or remove think-tag output, make /no_think the default, create a non-thinking tag, or convert a local Qwen Ollama model such as qwen3, qwen3.5, qwen3.6, qwen-vl, or custom Qwen MLX/GGUF tags to answer directly without requiring ollama run --think=false every time.
---

# Ollama Qwen Nothink

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 39)May include surrounding context.

5. Verify both CLI and API output do not contain Thinking..., <think>, or reasoning prose:

   bash

   ollama run TARGET_MODEL "用一句话回答：1+1等于几？"
   curl -s http://127.0.0.1:11434/api/chat -d '{"model":"TARGET_MODEL","messages":[{"role":"user","content":"用一句话回答：1+1等于几？"}],"stream":false}'
   

In Codex sandboxes, local Ollama calls or writes under ~/.ollama may require user approval. Request escalation plainly when needed.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The embedded SYSTEM prompt is written in Chinese and directs the assistant's behavior, which can implicitly force a specific language/locale in the derived model configuration. The file does not justify this as a region-specific tool or give the user a way to choose another language.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The document instructs users to write a new blob and repoint the manifest in Ollama’s local model store without any safety guardrails such as backing up files, validating JSON, confirming digest/size consistency, or warning that a mistake can break the derived model or corrupt local metadata. In this skill’s context, the steps directly target internal model storage structures, so omission of precautions increases the chance of accidental damage to locally installed models and difficult-to-diagnose failures.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The default system prompt and verification prompt are hard-coded in Chinese, which imposes a specific language behavior on all users by default. The file does not provide any user-facing locale selection or explain that the language constraint is optional, so this is a natural-language policy violation.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/create_qwen_nothink_ollama.py (reported line 43)May include surrounding context.

python

def run(cmd: list[str], *, check: bool = True) -> subprocess.CompletedProcess[str]:
    proc = subprocess.run(cmd, text=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
    if check and proc.returncode != 0:
        detail = proc.stderr.strip() or proc.stdout.strip()
        raise CommandError(f"{' '.join(cmd)} failed: {detail}")

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The example verification command hard-codes a Chinese prompt, and the manual fallback later uses Chinese system instructions. Because the skill does not indicate that it is China-specific or offer an opt-in language choice, this reads as a locale/language preference being imposed by default.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The manifest describes invocation as "Use $ollama-qwen-nothink to make this local Qwen Ollama model default to no-thinking mode," but it does not clearly define whether this is the only trigger, when it should activate, or any exclusion conditions. In a manifest file, that lack of trigger scope and negative examples can lead to unintended or ambiguous invocation behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The sample command uses a Chinese prompt as the only demonstrated interaction, which imposes a specific language in natural-language instructions. There is no opt-in, alternative language example, or justification that this skill is intended only for Chinese-language use.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.