Wsl2 Local Ai

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:59 AM UTC
• Version: 1.0.0

Overview

This skill is coherent for setting up local AI on WSL2, but its primary setup asks users to execute mutable remote installers and unpinned packages without verification.

Review the install commands before using this skill. Prefer pinned package versions, a tagged or digest-pinned Docker image, and downloading any installer for inspection and checksum or signature verification before execution. The local API examples are expected for this tool, but the setup changes your WSL2 environment and may start long-running local services.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:41
• Finding: Unverified Remote Installer Is Downloaded and Executed Directly## Vulnerability Details **File Location**: `SKILL.md`, line 41 **Vulnerability Type**: Remote payload retrieval and immediate shell execution **Risk Level**: High **Vulnerable Code**: ```bash curl -fsSL https://ollama.ai/install.sh | sh ``` ### Technical Analysis This command streams a mutable script from an external URL directly into `sh`. The effective executable payload is therefore determined at installation time rather than at Skill review time. No version pin, cryptographic signature, checksum verification, local inspection step, or content allowlist is present. Installing Ollama is relevant to the Skill's declared functionality, but executing an unverified network response is not the minimum-risk installation method. HTTPS provides transport protection but does not protect against compromise of the vendor infrastructure, domain, publishing credentials, or the installer itself. It also does not guarantee that future content at the URL matches the version reviewed during this audit. Depending on how the remote installer operates, it may modify system paths, install binaries or services, and request elevated privileges. Any malicious commands delivered by the endpoint would run with the privileges of the user invoking `sh`, including elevated privileges if the installer or user invokes `sudo`. ### Attack Path 1. An attacker compromises the installer endpoint, vendor publishing process, DNS/TLS trust path, or another component capable of controlling the returned script. 2. The user follows the Skill instructions and runs the documented command. 3. `curl` retrieves the attacker-controlled response. 4. The pipe sends the response directly to `sh` without verification or review. 5. The attacker-controlled commands execute with the invoking user's privileges. 6. If elevated authorization is available or requested, the payload may install system-wide files, services, or other persistent components. ### Impact Assessm ...[truncated 466 chars]
• Remediation: ## Remediation Suggestions 1. Replace direct `curl | sh` execution with official manual installation instructions or a pinned release artifact. 2. Download the artifact to a local file without executing it: ```bash curl --proto '=https' --tlsv1.2 -fL -o ollama-installer.sh \ https://ollama.ai/install.sh ``` 3. Verify a vendor-published cryptographic signature or checksum obtained through an independently authenticated channel. 4. Pin the expected release version and integrity value rather than trusting mutable latest content. 5. Allow the user to inspect the downloaded script before explicitly executing it. 6. Run installation with ordinary user privileges wherever possible. Clearly identify any step requiring elevation and explain why it is necessary. 7. Prefer a trusted package manager or signed vendor package when one is available.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:49
• Finding: Unpinned Python Package Installation in Primary Setup Workflow## Vulnerability Details **File Location**: `SKILL.md`, line 49 **Vulnerability Type**: Unpinned third-party dependency installation **Risk Level**: Medium **Vulnerable Code**: ```bash pip install ollama-herd ``` ### Technical Analysis The installation command does not constrain `ollama-herd` to a reviewed version and does not verify package hashes. The package index can consequently resolve a release published after this Skill was audited. Python source distributions and build backends may execute code during package construction or installation, while installed console entry points execute package code when subsequently invoked. The package is directly related to the declared fleet-routing functionality, so the dependency itself is functionally justified. However, selecting mutable latest content without integrity verification exceeds the minimum supply-chain trust necessary to install a known, reviewed version. ### Attack Path 1. The package publisher account, package index, release process, or a dependency is compromised, or a malicious future release is published. 2. The user runs the unpinned `pip install ollama-herd` command. 3. `pip` resolves and downloads the currently selected release rather than a previously audited version. 4. Malicious build hooks may execute during installation, or malicious package code executes when the documented `herd` or `herd-node` commands are launched. 5. The payload gains access to files, credentials, environment variables, and network services available to the invoking user. ### Impact Assessment Exploitation can result in arbitrary code execution with the WSL2 user's privileges. Potentially exposed assets include source repositories, Python credentials, SSH material, environment secrets, local model services, fleet configuration, and Windows files mounted into WSL2. System-wide impact is possible if the command is run from an elevated shell or against a privileged Python insta ...[truncated 8 chars]
• Remediation: ## Remediation Suggestions 1. Pin `ollama-herd` to a specific version that has been reviewed: ```bash python3 -m pip install 'ollama-herd==<reviewed-version>' ``` 2. Publish a lock or requirements file containing hashes and install it with: ```bash python3 -m pip install --require-hashes -r requirements.txt ``` 3. Pin and hash transitive dependencies where practical. 4. Use a dedicated virtual environment rather than a system Python installation. 5. Prefer binary wheels from trusted sources and review any source distribution or custom build backend before installation. 6. Document the expected package index and avoid untrusted extra indexes.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:120
• Finding: Unpinned Python Package Installation Repeated in Docker Workflow## Vulnerability Details **File Location**: `SKILL.md`, line 120 **Vulnerability Type**: Unpinned third-party dependency installation **Risk Level**: Medium **Vulnerable Code**: ```bash pip install ollama-herd ``` ### Technical Analysis The Docker-oriented workflow repeats the unrestricted installation of the latest package version without a lock file, version constraint, signature, or package hash. This creates the same mutable supply-chain execution boundary as the primary installation workflow. The surrounding use of Docker does not isolate this command because it is documented as running directly in WSL2 rather than inside the shown Ollama container. A malicious package release or compromised build dependency can therefore execute in the host WSL2 user context during installation or when the installed `herd` commands are started. ### Attack Path 1. An attacker gains control over a package release, publisher account, package distribution channel, or dependency. 2. The user follows the Docker workflow and executes the unpinned package installation on the WSL2 host. 3. `pip` retrieves the attacker-controlled version selected at that time. 4. Malicious installation hooks or later package entry points execute. 5. The payload accesses the user's WSL2 environment and may interact with local Docker and Ollama services. ### Impact Assessment The payload obtains the permissions of the invoking WSL2 user. In addition to user files and credentials, access to a Docker socket or equivalent Docker control interface could allow control over containers and may provide a path to broader host access. The exact scope depends on the user's Docker permissions and whether installation is performed with elevated privileges.
• Remediation: ## Remediation Suggestions 1. Remove the duplicate installation instruction and reference a single hardened installation procedure. 2. Pin the package and all required dependencies to reviewed versions. 3. Require package hashes through a locked requirements file and `--require-hashes`. 4. Install into a dedicated virtual environment with ordinary user privileges. 5. Do not grant the routing package Docker control unless that access is explicitly required. 6. Document package provenance, supported versions, and a controlled update process.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match

Findings (9)

External Script Fetching

High

• Category: Supply Chain

Content

```bash
# Inside WSL2
curl -fsSL https://ollama.ai/install.sh | sh
ollama serve &
```

• Confidence: 98% confidence
• Finding: Piping a remotely fetched script directly into `sh` executes unverified code from the network without inspection, integrity verification, or version pinning. If the upstream host, CDN, DNS, or connection is compromised, the user could execute arbitrary code inside WSL2 immediately.

Chaining Abuse

High

• Category: Tool Misuse

Content

```bash
# Inside WSL2
curl -fsSL https://ollama.ai/install.sh | sh
ollama serve &
```

• Confidence: 99% confidence
• Finding: The `| sh` chaining pattern is dangerous because it turns network content into immediately executed shell commands with no review boundary. In a setup guide, this materially increases the chance of supply-chain compromise affecting all users who follow the instructions.

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match

Content

desktop | 16GB shared with WSL2 | `phi4`, `codestral`, `qwen3.5:14b` |
| RTX 4060 laptop | 8GB shared with WSL2 | `phi4-mini`, `gemma3:4b` |

> WSL2 shares GPU memory with Windows. Close GPU-heavy Windows apps for more WSL2 AI vRAM.

## WSL2 AI environment

```bash
# WSL2 Ollama optimization
export OLLAMA_KEEP_ALIVE=-1
export OLLAMA_MAX_LOADED_MODELS=-1

# Add to ~/.bashrc for persistence in WSL2
echo 'export OLLAMA_KEEP_ALIVE=-1' >> ~/.bashrc
echo 'export OLLAMA_MAX_LOADED_MODELS=-1' >> ~/.bashrc
```

## Monitor WSL2 AI

```bash
# WSL2 fleet status
curl -s http://localhost:11435/fleet/status | python3 -m json.tool

# WSL2 health checks
curl -s http://localhost:11435/dashboard/api/health | python3 -m json.tool
```

Dashboard at `http://localhost:11435/dashboard` — accessible from both Windows browser and WSL2.

## Also available on WSL2 AI

### Image generation
```bash
curl http://localhost:11435/api/generate-image \
  -d '{"model": "z-image-turbo", "prompt": "developer workspace", "

• Confidence: 75% confidence
• Finding: YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

External Script Fetching

High

• Category: Supply Chain

Content

```bash
# WSL2 fleet status
curl -s http://localhost:11435/fleet/status | python3 -m json.tool

# WSL2 health checks
curl -s http://localhost:11435/dashboard/api/health | python3 -m json.tool

• Confidence: 90% confidence
• Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

External Script Fetching

High

• Category: Supply Chain

Content

curl -s http://localhost:11435/fleet/status | python3 -m json.tool

# WSL2 health checks
curl -s http://localhost:11435/dashboard/api/health | python3 -m json.tool
```

Dashboard at `http://localhost:11435/dashboard` — accessible from both Windows browser and WSL2.

• Confidence: 90% confidence
• Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

External Transmission

Medium

• Category: Data Exfiltration

Content

```powershell
# From Windows PowerShell
curl http://localhost:11435/api/tags    # see WSL2 AI models
```

## Use WSL2 AI

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 75% confidence
• Finding: Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.

Session Persistence

Medium

• Category: Rogue Agent

Content

export OLLAMA_KEEP_ALIVE=-1
export OLLAMA_MAX_LOADED_MODELS=-1

# Add to ~/.bashrc for persistence in WSL2
echo 'export OLLAMA_KEEP_ALIVE=-1' >> ~/.bashrc
echo 'export OLLAMA_MAX_LOADED_MODELS=-1' >> ~/.bashrc
```

• Confidence: 90% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

External Transmission

Medium

• Category: Data Exfiltration

Content

### Image generation
```bash
curl http://localhost:11435/api/generate-image \
  -d '{"model": "z-image-turbo", "prompt": "developer workspace", "width": 1024, "height": 1024}'
```

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Static analysis

No suspicious patterns detected.