add-ollama-tool

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The outsider-authored text exposure occurs via tool inputs prompt/system from the agent conversation being sent at runtime to the MCP tool implementation (ollama_generate → ollamaFetch('/api/generate', ...) in ollama-mcp-stdio.ts), and the tool also returns whatever the local Ollama daemon responds with, meaning the agent ingests user-controlled free text.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.80). The skill instructs installing and registering an MCP server in the agent runtime and (optionally) enables management tools that let the agent pull and delete models on the host, thereby allowing the agent to modify host filesystem/state and change the agent's runtime behavior.