Security audit

Ollama集成工具

Security checks across malware telemetry and agentic risk

Overview

This skill is an Ollama integration in name, but its instructions ask for broad read, write, API, and command-execution authority without clear limits.

Install only if you are comfortable giving this skill broad read, write, and command-execution capability for AI automation. Before use, narrow it to local Ollama tasks, avoid sharing secrets or private files through it, and require explicit confirmation for any file changes, network/API calls, or shell commands.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The manifest presents the skill as a local Ollama integration, but the body broadens it into generic API, file, and automation behavior. This mismatch can cause agents or users to authorize the skill under a narrower trust assumption than its documentation later suggests, increasing the risk of overbroad execution and unsafe use.

Context-Inappropriate Capability

Medium

Confidence: 97% confidence
Finding: Claiming generic command-execution capability is substantially broader than needed for a local Ollama integration skill. In the context of a skill with exec tooling, vague command-execution claims can normalize arbitrary shell use and lead to system compromise, data destruction, or secret exposure if invoked unsafely.

Context-Inappropriate Capability

Medium

Confidence: 97% confidence
Finding: Claiming generic command-execution capability is substantially broader than needed for a local Ollama integration skill. In the context of a skill with exec tooling, vague command-execution claims can normalize arbitrary shell use and lead to system compromise, data destruction, or secret exposure if invoked unsafely.

Context-Inappropriate Capability

High

Confidence: 97% confidence
Finding: Claiming generic command-execution capability is substantially broader than needed for a local Ollama integration skill. In the context of a skill with exec tooling, vague command-execution claims can normalize arbitrary shell use and lead to system compromise, data destruction, or secret exposure if invoked unsafely.

Intent-Code Divergence

Medium

Confidence: 90% confidence
Finding: The skill says it is local-only but elsewhere describes API/network-oriented behavior, creating contradictory trust expectations. This inconsistency can cause users to expose data or approve execution under the mistaken belief that no external communication occurs.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The invocation guidance uses broad trigger language such as using the skill whenever AI model calls, orchestration, or LLM applications are needed. Overbroad routing criteria can cause an agent to invoke a high-privilege skill in contexts far beyond its intended use, especially given read/write/exec tools.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The markdown advertises write, API integration, and command execution features without prominent user-facing warnings about their effects. In a skill that can read, write, and execute, insufficient warning and consent language raises the chance of unintended filesystem changes, command execution, and external data disclosure.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.