ClawHub
Back to skill

Security audit

Ollama Local

Security checks across malware telemetry and agentic risk

Overview

This skill coherently helps manage Ollama models and send requests to a user-configured Ollama server, with privacy and deletion cautions but no hidden or malicious behavior found.

Install this only if you intend to manage or use Ollama from OpenClaw. Keep OLLAMA_HOST on localhost for sensitive prompts, use only trusted remote Ollama servers, and double-check the target host and model name before running pull, rm, or sub-agent workflows.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Lp3

Medium
Category
MCP Least Privilege
Confidence
87% confidence
Finding
The skill documents capabilities that access environment configuration and make network requests, but it does not declare permissions or explicitly signal those capabilities to users. This creates a transparency and trust problem: users may invoke the skill without realizing it can read configuration like OLLAMA_HOST and communicate with local or remote services.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The skill explicitly shows using a remote Ollama host but does not warn that prompts, tool inputs, model requests, and potentially sensitive data will traverse the network to another machine. In a local-LLM skill, users may reasonably assume data stays on-device, so omission of that warning increases the risk of accidental data disclosure to an untrusted or less-secure remote server.

Missing User Warnings

Medium
Confidence
85% confidence
Finding
The rm command deletes a local model immediately without any confirmation, dry-run, or force/interactive distinction. In an agent skill context, this increases the chance of accidental destructive actions from mistaken prompts, automation errors, or unsafe tool chaining, causing loss of local model assets and operational disruption.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.