T06 · System Persistence
Error
- Location
SKILL.md:133- Finding
Hidden Cross-Session Execution Through the Windows Startup Folder
- Content
View full analysis
- Remediation
View remediation
Security audit
Ollama + OpenClaw Memory Setup Guide
Security checks for vulnerabilities and agentic risk
Overview
This skill is a coherent local Ollama/OpenClaw memory setup guide, but it asks users to run unverified downloaded binaries and create hidden Windows startup persistence without enough safeguards.
Review before installing. Use only a verified Ollama release, check hashes and signatures, avoid the hidden Startup-folder autostart unless you explicitly need it, and treat OpenClaw memory backups as sensitive private data. Do not run the referenced rebuild script unless you have verified its source and contents.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (3)
T03 · Remote Payload Retrieval and Execution
Error
- Location
SKILL.md:44- Finding
Mutable External Binary Retrieval Followed by Local Execution
- Content
View full analysis
- Remediation
View remediation
" $actualHash = (Get-FileHash "D:\temp\ollama-windows-amd64.zip" -Algorithm SHA256).Hash if ($actualHash -ne $expectedHash) { throw "Ollama archive integrity verification failed." } ``` 4. Validate the Authenticode signature of `ollama.exe` and reject unsigned, invalid, or unexpectedly signed binaries: ```powershell $signature = Get-AuthenticodeSignature ".\ollama.exe" if ($signature.Status -ne "Valid") { throw "Executable signature validation failed." } ``` 5. Do not treat mirrors as interchangeable with the official source. If a mirror is necessary, verify its artifact against a checksum obtained independently from the official publisher. 6. Display the verified version, hash, signer, and final executable path before execution. 7. Avoid wildcard copying from a cloned repository; copy only explicitly expected and validated files. 8. Do not create persistence until all integrity and provenance checks have passed. ]]>
T08 · Insecure Dependencies
Warning
- Location
SKILL.md:234- Finding
Unpinned Python Dependencies and Invocation of an Unshipped Script
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (6)
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
nomic-embed-text:latest 0a109f422b47 274 MB 1 minute ago
测试 embedding API
python -c "import requests; r = requests.post('http://localhost:11434/api/embeddings', json={'model':'nomic-embed-text','prompt':'test'}); print(f'Dim: {len(r.json()["embedding"])}')"
输出: Dim: 768
text
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 70% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
nomic-embed-text:latest 0a109f422b47 274 MB 1 minute ago
测试 embedding API
python -c "import requests; r = requests.post('http://localhost:11434/api/embeddings', json={'model':'nomic-embed-text','prompt':'test'}); print(f'Dim: {len(r.json()["embedding"])}')"
输出: Dim: 768
text
Internal Network Request
Medium
- Category
- Server-Side Request Forgery
- Confidence
- 70% confidence
- Finding
Code issues a request to a loopback, link-local, or private-range host. This can reach internal services not meant to be exposed and is a common SSRF pivot.
- Content
nomic-embed-text:latest 0a109f422b47 274 MB 1 minute ago
测试 embedding API
python -c "import requests; r = requests.post('http://localhost:11434/api/embeddings', json={'model':'nomic-embed-text','prompt':'test'}); print(f'Dim: {len(r.json()["embedding"])}')"
输出: Dim: 768
text
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The guide explicitly instructs users to back up and restore memory directories that likely contain conversation logs, extracted memories, and user profile data, but it does not warn that these artifacts may be highly sensitive. In an enterprise setting, this omission can lead to insecure copying, broad filesystem exposure, or migration of personal data without proper access controls or retention review.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
All natural-language instructions in the file are presented in Chinese, with no opt-in, alternative locale, or justification that the skill is region- or language-specific. Under the policy rule for natural-language locale constraints, forcing a single language without user choice can be a policy violation.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The package description is written entirely in Chinese, which imposes a language choice in a user-facing skill descriptor without indicating any language option or opt-in. This can violate a language/locale policy when users are not given a choice or told the skill is intentionally region- or language-specific.
- Content
Static analysis
No suspicious patterns detected.