ClawHub
Back to skill

Security audit

Ollama on Windows — Setup, CORS Fix & Custom Models

Security checks across malware telemetry and agentic risk

Overview

This is a documentation-only Ollama setup guide, but it recommends a permanent all-origins CORS setting without warning users about the security risk.

Review the CORS section before following it. Prefer setting OLLAMA_ORIGINS only to the exact trusted app origin you use, such as a specific localhost port, and avoid making OLLAMA_ORIGINS=* permanent except in a controlled temporary test environment.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Description-Behavior Mismatch

Medium
Confidence
97% confidence
Finding
The README explicitly instructs users to set `OLLAMA_ORIGINS="*"`, which allows any web origin to interact with the local Ollama service from a browser. In the context of a generic setup guide, this broadens access far beyond what is necessary and can expose localhost AI endpoints to arbitrary web pages visited by the user.

Context-Inappropriate Capability

Medium
Confidence
98% confidence
Finding
Recommending a globally permissive CORS policy as default guidance is an unsafe configuration pattern because it normalizes exposing a local service to any website origin. If the Ollama API is reachable on localhost and browser-based tools use it, a malicious site could potentially induce requests to the service and interact with locally available models or data flows.

Missing User Warnings

Medium
Confidence
99% confidence
Finding
The guide gives users an insecure CORS configuration without warning them that this can expose the local Ollama service to arbitrary web pages in the browser. The lack of an explicit warning increases the chance that users will apply the setting permanently without understanding that visited websites may gain cross-origin access to the local API.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.