本地长记忆

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:18 AM UTC
• Version: 1.0.0

Overview

The skill has a coherent local-memory purpose, but it uses risky install guidance and tells agents to persist conversation details without a clear consent gate.

Install only if you intentionally want an agent to keep durable local memory. Review or replace the Ollama install command with a verified installation method, avoid storing regulated medical/legal/financial data unless you have appropriate controls, and configure the agent to ask before saving, deleting, backing up, or recalling memories.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:83

Finding

Unverified Remote Installer Piped Directly into a Shell

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:83
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

Vulnerable Code

bash

curl -fsSL https://ollama.com/install.sh | sh

Technical Analysis

The installation instructions download a mutable script from an external URL and immediately execute it with sh. The command does not pin an installer version, validate a cryptographic checksum or signature, or give the user an opportunity to inspect the downloaded content before execution.

Installing Ollama is relevant to the Skill's declared local-embedding functionality, and the referenced domain is consistent with that dependency. However, direct network-to-shell execution is not the minimum privilege or safest installation mechanism. The effective code can change after the Skill has been reviewed, while the downloaded script receives all privileges available to the invoking user. If the command is run with elevated privileges, the script receives those elevated privileges as well.

No evidence in the audited artifact establishes that the remote installer is itself malicious. The confirmed vulnerability is the unsafe, unverified remote execution mechanism.

Attack Path

1. A user or enabled Agent follows the quick-start instructions.
2. curl requests the current contents of https://ollama.com/install.sh.
3. An attacker compromises or maliciously alters the origin, hosting infrastructure, delivery pipeline, DNS/TLS trust path, or future installer contents.
4. The altered response is streamed directly to sh.
5. The shell executes the attacker-controlled commands without local integrity verification or prior inspection.
6. The payload acts with the invoking user's permissions and may modify files, read accessible data, install additional components, or establish persistence.

Impact Assessment

Successful exploitation permits arbitrary command execution under the ...[truncated 594 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the curl ... | sh installation pattern.

2. Prefer an official operating-system package manager or a signed, version-pinned release package.

3. If a standalone installer is necessary, separate download, verification, inspection, and execution:

   bash

   curl -fL -o ollama-install.sh "https://ollama.com/install.sh"
   printf '%s  %s\n' "<PUBLISHED_SHA256>" "ollama-install.sh" | sha256sum --check -
   less ollama-install.sh
   sh ollama-install.sh
   

4. Publish the expected checksum through an independent, trusted release channel. A checksum fetched from the same mutable location does not adequately protect against origin compromise.

5. Where available, verify a maintainer signature in addition to the checksum.

6. Pin a specific release rather than retrieving a moving installer endpoint.

7. Require explicit user confirmation before installation and clearly document whether elevated privileges are needed.

8. Run installation with the least-privileged account possible; do not recommend sudo unless a specific operation requires it.

9. Document the files, services, users, network listeners, and other system changes the installer is expected to create so users can assess its privilege requirements.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 99% confidence

Finding

The skill instructs users to fetch and immediately execute a remote shell script with curl ... | sh. This is dangerous because it grants code execution to whatever content is served at that URL at runtime, enabling supply-chain compromise, man-in-the-middle abuse, or unexpected installer behavior.

Content

Scanner excerpt · SKILL.md (reported line 83)May include surrounding context.

bash

# 安装 Ollama
# macOS/Linux
curl -fsSL https://ollama.com/install.sh | sh

# Windows: 从 https://ollama.com/download 下载安装包

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 99% confidence

Finding

The | sh pattern is a direct command-chaining execution primitive that turns remote content retrieval into immediate shell execution. In an agent skill with exec capability, this is especially risky because it normalizes unsafe execution habits and could lead to arbitrary code execution if copied or automated.

Content

Scanner excerpt · SKILL.md (reported line 83)May include surrounding context.

bash

# 安装 Ollama
# macOS/Linux
curl -fsSL https://ollama.com/install.sh | sh

# Windows: 从 https://ollama.com/download 下载安装包

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The example explicitly stores medical information ('患者青霉素过敏') in persistent local memory. Even though storage is local, medical data is highly sensitive and may be exposed through local compromise, backups, shared devices, or unintended retrieval by the agent later.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The trigger list includes broad terms such as “embedding” and “local memory,” which are common in unrelated workflows. This can cause unintended activation of the skill, leading the agent to apply memory-writing behavior in contexts where the user did not explicitly request persistent local storage.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

These instructions tell the agent to store, search, and delete local memory through CLI commands, but do not prominently warn that they modify persistent filesystem state. Users may unknowingly cause creation, retention, or deletion of local data, which is especially sensitive given the skill’s privacy-focused positioning.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The WAL protocol explicitly directs the agent to write user content to SESSION-STATE.md and other memory stores before replying. Automatic pre-reply persistence without clear consent is dangerous because users may disclose sensitive information assuming it is only used transiently in conversation.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill instructs the agent to persist user preferences, decisions, deadlines, and corrections by default, which creates a durable record of potentially sensitive personal or operational information. Because persistence is framed as routine behavior, the context increases risk of over-collection and retention beyond user expectations.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The conversation-handling guidance tells the agent to capture concrete user details and save them into persistent memory during normal dialogue. In practice, this can silently accumulate sensitive personal or project information on disk, especially when combined with automatic recall and local file writes.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

Key user-facing metadata and most operational instructions are written in Chinese, while no language-selection option or locale justification is provided. This may violate a language/locale policy if users are expected to receive instructions in their preferred language unless they opt in.

Content

No source excerpt is available for this finding.