ClawHub
Back to skill

Security audit

Ollama Toolkit Free

Security checks across malware telemetry and agentic risk

Overview

The skill is mostly a coherent Ollama helper, but it includes broad activation wording and examples that can delete models or expose an unauthenticated Ollama service on the network without strong safeguards.

Install only if you want an agent to help operate local Ollama through shell commands. Require explicit confirmation before running deletion commands, pulling large models, piping private files into models, or starting Ollama on 0.0.0.0; prefer localhost unless you have firewall rules and access controls in place.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Vague Triggers

Medium
Confidence
86% confidence
Finding
The activation description is broad enough to trigger on generic AI, dialogue, orchestration, and application requests, increasing the chance the skill is invoked outside its intended scope. In an agent environment with `exec` and `write` permissions, overbroad matching can cause unnecessary command execution and unexpected local system changes.

Vague Triggers

Medium
Confidence
90% confidence
Finding
The keyword coverage list contains very general terms such as 'Skill', 'Agent', 'API', 'Use', and broad AI-related phrases that could match many unrelated requests. This raises the risk of accidental activation, after which the skill may run local commands, download models, or alter configuration without the user specifically asking for Ollama operations.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The documentation includes a destructive deletion command (`ollama rm`) without any warning, confirmation guidance, or restriction language. In an agent context, users may follow examples verbatim or the skill may be adapted into executable workflows, leading to unintended deletion of locally installed models and disruption of dependent tasks.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The skill shows how to bind Ollama to `0.0.0.0:11434`, exposing the service to the network, while also documenting that the service has no authentication by default. Publishing an unauthenticated model service on all interfaces can enable unauthorized use, prompt injection through exposed endpoints, data leakage via model interactions, and lateral misuse within a LAN.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.