Security audit
Security checks for vulnerabilities and agentic risk
This skill appears to be a broad Ollama integration guide, but its local-only framing conflicts with API key and network guidance while requesting read, write, and command execution authority.
Review before installing. Use this only if you intentionally want an agent to run local Ollama-related commands and possibly manage files. Do not provide real API keys unless the publisher clarifies what service receives them, what endpoints are contacted, and when prompts or files leave the machine.
The skill claims to integrate a local Ollama runner, but the documentation also instructs users to configure an API key and describes API/network-based integration. This mismatch can cause users or orchestrators to grant unnecessary network access or secrets to a skill they believe is purely local, increasing the chance of unintended data exposure or over-privileged execution.
The file states the skill is 'local-only' while simultaneously requiring API key setup and discussing HTTPS/network protections. Conflicting trust signals are dangerous because operators may approve the skill under a lower-risk local-data assumption while it actually depends on remote connectivity and secret material.
The activation guidance is overly broad, covering generic AI model invocation, conversation, agent orchestration, and LLM applications. In agent ecosystems, vague triggers can cause the skill to be selected for many unrelated tasks, which is risky here because the skill exposes exec/write capabilities and may be invoked in contexts where those powers are unnecessary.
No suspicious patterns detected.
