insight-report

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.70). The bundle contains a direct remote install script (https://ollama.com/install.sh) which is inherently risky to curl|sh even if hosted on an apparent vendor domain, while http://localhost:11434 is only a local API endpoint — combined they enable installing and running local code, so verify the script contents, TLS/hostname, and vendor reputation before executing.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The runtime script posts prompts to the Ollama API (POST to http://localhost:11434/api/generate — via the OLLAMA_HOST env var) and directly consumes those model responses to extract facets and generate the report, so an external Ollama URL used at runtime can control the agent's outputs.