Ubuntu Ollama

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:45 AM UTC
• Version: 1.0.0

Overview

This skill is a coherent Ollama fleet setup guide, but it asks users to create persistent root services and open a network port broadly.

Review this skill before installing. It is not evidence of malware, but you should avoid running the curl-to-shell command blindly, pin and verify packages where possible, create a dedicated non-root service account, enable only the router or node role you need, restrict port 11435 to trusted hosts or a VPN, and make sure you know how to disable the systemd services.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:19
• Finding: Unverified Remote Installer Is Executed Directly by a Shell<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, line 19 **Vulnerability Type**: Remote payload retrieval and immediate execution **Risk Level**: Critical ### Vulnerable Code ```bash # Install Ollama on Ubuntu curl -fsSL https://ollama.ai/install.sh | sh ``` ### Technical Analysis The installation command streams content from an external URL directly into a shell. The downloaded script is neither version-pinned nor independently inspected, and no cryptographic checksum or publisher signature is verified before execution. Although HTTPS protects the connection against ordinary transit modification, it does not protect users if the upstream website, hosting infrastructure, DNS/CA trust chain, or installer itself is compromised. Because the remote content is retrieved at execution time, its effective behavior can change after the Skill has been reviewed. Piping the response directly to `sh` also eliminates the natural review boundary that would exist if the installer were downloaded and examined before execution. ### Attack Path 1. An attacker compromises the installer URL, upstream hosting account, or relevant delivery infrastructure. 2. The attacker modifies `install.sh` to include arbitrary commands. 3. A user follows the Skill instructions and runs the documented `curl | sh` command. 4. `curl` retrieves the attacker-controlled content and immediately supplies it to the shell. 5. The payload executes with the privileges of the invoking user and may attempt to obtain additional privileges through commands such as `sudo`. 6. The malicious installer can modify files, install additional software, collect accessible data, or establish persistence. ### Impact Assessment Successful exploitation permits arbitrary command execution with the invoking user's privileges. If the installer is run from an elevated shell or successfully invokes an authorized privilege-elevation mechanism, the impact can extend to full system compromise. The affected ...[truncated 283 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Prefer an official, versioned operating-system package or a pinned release artifact. 2. Do not stream downloaded content directly into a shell. Download it to a local file first: ```bash curl --proto '=https' --tlsv1.2 -fLo install.sh \ https://ollama.ai/install.sh ``` 3. Verify a publisher-provided cryptographic signature and a checksum pinned in trusted documentation before execution. 4. Display or inspect the downloaded script before running it. 5. Require explicit user confirmation immediately before execution. 6. Run the installer with the lowest practical privileges and elevate only individual operations that require administrative access. 7. Pin the installer or package to a reviewed release rather than relying on a mutable URL. ]]>

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:27
• Finding: Persistent Root Services Execute Unpinned Third-Party Package Binaries<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 27–30 and 59–96 **Vulnerability Type**: Excessive privilege, persistent service registration, and insecure dependency installation **Risk Level**: Critical ### Vulnerable Code ```bash # Ubuntu prerequisites sudo apt update && sudo apt install python3-pip curl -y # Install Ubuntu Ollama fleet router pip install ollama-herd ``` ```bash # Ubuntu Ollama router service sudo tee /etc/systemd/system/herd-router.service << 'EOF' [Unit] Description=Ubuntu Ollama Router After=network.target ollama.service [Service] Type=simple ExecStart=/usr/local/bin/herd Restart=always RestartSec=5 [Install] WantedBy=multi-user.target EOF # Ubuntu Ollama node service sudo tee /etc/systemd/system/herd-node.service << 'EOF' [Unit] Description=Ubuntu Ollama Node After=network.target ollama.service [Service] Type=simple ExecStart=/usr/local/bin/herd-node Restart=always RestartSec=5 [Install] WantedBy=multi-user.target EOF sudo systemctl enable --now herd-router sudo systemctl enable --now herd-node ``` ### Technical Analysis The Skill installs `ollama-herd` without an exact version constraint, integrity hash, or dependency lock. Consequently, the installed package and its transitive dependencies may differ between executions and can incorporate a malicious or compromised future release. The resulting executables are configured as systemd services. Neither service defines `User=` or `Group=`, so a system-level systemd unit runs as root by default. No systemd sandboxing controls such as `NoNewPrivileges=`, `ProtectSystem=`, `ProtectHome=`, or capability restrictions are specified. Both units use `Restart=always`, causing continual relaunch after process termination, and `systemctl enable` configures them to start after reboot. This is genuine cross-session persistence. Persistent execution is relevant to the declared always-on routing functionality, but executing these network-facing Python applications as r ...[truncated 1902 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin `ollama-herd` and all transitive dependencies to reviewed versions and verified hashes. 2. Install the application into a dedicated virtual environment rather than a mutable global Python environment. 3. Use a dedicated unprivileged service account: ```ini User=ollama-herd Group=ollama-herd ``` 4. Ensure the service account cannot modify its executable, environment, dependencies, or unit files. 5. Add systemd hardening appropriate to the application's requirements, for example: ```ini NoNewPrivileges=true ProtectSystem=strict ProtectHome=true PrivateTmp=true PrivateDevices=true ProtectKernelTunables=true ProtectKernelModules=true ProtectControlGroups=true RestrictSUIDSGID=true LockPersonality=true CapabilityBoundingSet= AmbientCapabilities= ``` 6. Add narrowly scoped writable paths with `ReadWritePaths=` or `StateDirectory=` only where application state must be stored. 7. Install and enable only the required role. Do not enable the router service on machines intended solely to be nodes. 8. Ask for explicit confirmation before creating persistent services and provide complete disable/removal instructions. 9. Use an appropriate restart policy, such as `Restart=on-failure`, with rate limiting. 10. Document and verify the expected executable path before service activation. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:179
• Finding: Firewall Rule Exposes the Fleet Service Without Source Restrictions<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 179–180 **Vulnerability Type**: Overly broad network exposure **Risk Level**: Medium ### Vulnerable Code ```bash # Ubuntu UFW sudo ufw allow 11435/tcp sudo ufw reload ``` ### Technical Analysis The UFW rule allows inbound TCP connections to port 11435 without restricting the source address or network. The document identifies inference, dashboard, health, model-status, embedding, and image-generation routes on this port, but it does not configure authentication, TLS, or network-layer isolation. Opening the port may be necessary for multi-machine fleet routing, but allowing every network source that can reach the host exceeds the minimum access needed when fleet members occupy a known trusted subnet. The documented URLs also use plaintext HTTP. The actual degree of exposure depends on upstream firewalls, network topology, service bind settings, and whether the implementation independently provides access controls. Those protections are not established by the audited file. ### Attack Path 1. A user applies the unrestricted UFW rule and starts the router on port 11435. 2. An attacker obtains network reachability to the host through a local network, exposed cloud interface, VPN, or port forwarding. 3. The attacker scans or directly connects to TCP port 11435. 4. If the service lacks independent authentication, the attacker invokes documented inference or monitoring endpoints. 5. The attacker consumes CPU/GPU resources, enumerates operational information, or repeatedly submits expensive requests to degrade availability. 6. If traffic crosses an untrusted network, plaintext HTTP requests and responses may also be observed or modified by a suitably positioned attacker. ### Impact Assessment Potential impact includes unauthorized use of inference resources, GPU or CPU exhaustion, denial of service, disclosure of fleet health and model information, and exposure or modification of plaintext t ...[truncated 185 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Bind the service to `127.0.0.1` by default when remote fleet access is not required. 2. When remote nodes require access, permit only known node addresses or a dedicated trusted subnet: ```bash sudo ufw allow from 10.0.0.0/24 to any port 11435 proto tcp ``` 3. Remove any broader pre-existing rule for port 11435 after verifying the restricted rule. 4. Place fleet communication behind a VPN or mutually authenticated private network. 5. Require application-layer authentication and authorization for inference, management, and monitoring endpoints. 6. Use TLS for traffic that can cross an untrusted network. 7. Apply request-size, concurrency, and rate limits to reduce resource-exhaustion risk. 8. Clearly warn users that opening this port may expose the service and require explicit confirmation before changing firewall policy. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence

Findings (22)

External Script Fetching

High

• Category: Supply Chain

Content

```bash
# Install Ollama on Ubuntu
curl -fsSL https://ollama.ai/install.sh | sh

# Verify Ollama is running on Ubuntu
ollama --version

• Confidence: 98% confidence
• Finding: Piping a remotely fetched script directly into sh executes unreviewed code from the network with no integrity verification, making compromise of the upstream server, transport, or install script immediately dangerous. Because this is part of the primary installation path, it increases the chance users will run arbitrary code without inspection.

Chaining Abuse

High

• Category: Tool Misuse

Content

```bash
# Install Ollama on Ubuntu
curl -fsSL https://ollama.ai/install.sh | sh

# Verify Ollama is running on Ubuntu
ollama --version

• Confidence: 98% confidence
• Finding: The '| sh' construct chains a network fetch directly into shell execution, eliminating review and substantially raising the impact of any upstream compromise or malicious modification. This pattern is especially risky because it is concise, common, and likely to be copied blindly by users.

Chaining Abuse

High

• Category: Tool Misuse

Content

```bash
# Ubuntu prerequisites
sudo apt update && sudo apt install python3-pip curl -y

# Install Ubuntu Ollama fleet router
pip install ollama-herd

• Confidence: 75% confidence
• Finding: Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

External Script Fetching

High

• Category: Supply Chain

Content

```bash
# Ubuntu Ollama fleet status
curl -s http://localhost:11435/fleet/status | python3 -m json.tool

# Ubuntu Ollama health — 15 automated checks
curl -s http://localhost:11435/dashboard/api/health | python3 -m json.tool

• Confidence: 90% confidence
• Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

External Script Fetching

High

• Category: Supply Chain

Content

curl -s http://localhost:11435/fleet/status | python3 -m json.tool

# Ubuntu Ollama health — 15 automated checks
curl -s http://localhost:11435/dashboard/api/health | python3 -m json.tool

# Ubuntu Ollama models loaded
curl -s http://localhost:11435/api/ps | python3 -m json.tool

• Confidence: 90% confidence
• Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

External Script Fetching

High

• Category: Supply Chain

Content

curl -s http://localhost:11435/dashboard/api/health | python3 -m json.tool

# Ubuntu Ollama models loaded
curl -s http://localhost:11435/api/ps | python3 -m json.tool

# Ubuntu Ollama logs
journalctl -u herd-router -f

• Confidence: 90% confidence
• Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

```bash
# Ubuntu prerequisites
sudo apt update && sudo apt install python3-pip curl -y

# Install Ubuntu Ollama fleet router
pip install ollama-herd

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

```bash
# Ubuntu prerequisites
sudo apt update && sudo apt install python3-pip curl -y

# Install Ubuntu Ollama fleet router
pip install ollama-herd

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

```bash
# Ubuntu prerequisites
sudo apt update && sudo apt install python3-pip curl -y

# Install Ubuntu Ollama fleet router
pip install ollama-herd

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

```bash
# Ubuntu prerequisites
sudo apt update && sudo apt install python3-pip curl -y

# Install Ubuntu Ollama fleet router
pip install ollama-herd

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

```bash
# Ubuntu prerequisites
sudo apt update && sudo apt install python3-pip curl -y

# Install Ubuntu Ollama fleet router
pip install ollama-herd

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

```bash
# Ubuntu prerequisites
sudo apt update && sudo apt install python3-pip curl -y

# Install Ubuntu Ollama fleet router
pip install ollama-herd

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

```bash
# Ubuntu prerequisites
sudo apt update && sudo apt install python3-pip curl -y

# Install Ubuntu Ollama fleet router
pip install ollama-herd

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

```bash
# Ubuntu prerequisites
sudo apt update && sudo apt install python3-pip curl -y

# Install Ubuntu Ollama fleet router
pip install ollama-herd

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

```bash
# Ubuntu prerequisites
sudo apt update && sudo apt install python3-pip curl -y

# Install Ubuntu Ollama fleet router
pip install ollama-herd

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

EOF

# Ubuntu Ollama node service
sudo tee /etc/systemd/system/herd-node.service << 'EOF'
[Unit]
Description=Ubuntu Ollama Node
After=network.target ollama.service

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

EOF

# Ubuntu Ollama node service
sudo tee /etc/systemd/system/herd-node.service << 'EOF'
[Unit]
Description=Ubuntu Ollama Node
After=network.target ollama.service

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Session Persistence

Medium

• Category: Rogue Agent

Content

WantedBy=multi-user.target
EOF

sudo systemctl enable --now herd-router
sudo systemctl enable --now herd-node
```

• Confidence: 80% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium

• Category: Rogue Agent

Content

WantedBy=multi-user.target
EOF

sudo systemctl enable --now herd-router
sudo systemctl enable --now herd-node
```

• Confidence: 80% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

External Transmission

Medium

• Category: Data Exfiltration

Content

print(chunk.choices[0].delta.content or "", end="")
```

### curl (Ollama format)

```bash
# Ubuntu Ollama inference

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

### Image generation
```bash
curl http://localhost:11435/api/generate-image \
  -d '{"model": "z-image-turbo", "prompt": "Ubuntu penguin in space", "width": 1024, "height": 1024}'
```

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Script Fetching

Low

• Category: Supply Chain

Content

```bash
# Ubuntu prerequisites
sudo apt update && sudo apt install python3-pip curl -y

# Install Ubuntu Ollama fleet router
pip install ollama-herd

• Confidence: 15% confidence
• Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Static analysis

No suspicious patterns detected.