medxpert-llm-library

• Outcome: Review
• Latest audit: Aug 31, 2026 · 2:30 PM UTC
• Version: 1.29.1

Overview

The skill is mostly a local Ollama knowledge-base guide, but its helper script can send local library contents to an environment-selected endpoint despite strong local-only privacy claims.

Review this skill before installing if your knowledge base may contain private or regulated content. Use it only with OLLAMA_BASE unset or explicitly set to localhost/127.0.0.1, keep LIBRARY_DIR scoped to the intended library folder, and treat the included audit report cautiously because it describes an older version and says there are no network requests even though quickstart.py performs Ollama HTTP requests.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Tainted flow: 'OLLAMA_BASE' from os.environ.get (line 34, credential/environment) → requests.get (network output)

Critical

• Category: Data Flow

Content

def check_ollama():
    """检查 Ollama 是否在线（带超时与异常分类）"""
    try:
        resp = requests.get(f"{OLLAMA_BASE}/api/tags", timeout=OLLAMA_TIMEOUT)
        if resp.status_code != 200:
            print(f"[!] Ollama 返回异常状态码: {resp.status_code}")
            return False

• Confidence: 91% confidence
• Finding: OLLAMA_BASE is taken directly from the environment and used as the destination for HTTP requests without validation. If an attacker can influence the environment, the script can be coerced into making requests to arbitrary hosts, enabling SSRF-like behavior, unexpected data disclosure, or interaction with unintended internal services.

Tainted flow: 'OLLAMA_BASE' from os.environ.get (line 34, credential/environment) → requests.get (network output)

Critical

• Category: Data Flow

Content

print(f"[2/5] requests 库: ✓ 已安装 (v{requests.__version__})")

    try:
        resp = requests.get(f"{OLLAMA_BASE}/api/tags", timeout=OLLAMA_TIMEOUT)
        if resp.status_code == 200:
            models = [m["name"] for m in resp.json().get("models", [])]
            print(f"[3/5] Ollama 服务: ✓ 在线（已装 {len(models)} 个模型）")

• Confidence: 91% confidence
• Finding: The doctor routine also uses environment-controlled OLLAMA_BASE directly in a network request, creating the same unvalidated outbound-request issue. In this context it leaks less content than ask/summarize, but still permits probing or contacting arbitrary endpoints under attacker-controlled environment settings.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The trigger list contains broad, common phrases such as 'how to run LLMs', 'local deployment', and 'offline use' that are likely to match many unrelated user requests. This can cause unintended invocation of the skill, unexpectedly steering conversations toward this skill's content, promotions, or operational guidance even when the user did not explicitly ask for it.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The manifest advertises a very large set of generic trigger phrases such as how to build a knowledge base, run local models, do RAG, local deployment, privacy AI, and remote access. These overlap with common user requests outside the skill’s narrow scope, which can cause the router to invoke this skill too broadly and unexpectedly steer users into unrelated or commercialized flows.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.