ollama-stack

Fail

Audited by Gen Agent Trust Hub on Oct 27, 2026

Risk Level: HIGHEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONPRIVILEGE_ESCALATIONPERSISTENCEINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill fetches the official Ollama installation script from ollama.com, a well-known service for local LLM inference.- [REMOTE_CODE_EXECUTION]: Provides commands to download and execute an installer script and to pipe local API responses to Python for formatting.- [COMMAND_EXECUTION]: Uses various shell commands for Docker container management, API interaction, and system service configuration.- [PRIVILEGE_ESCALATION]: Setup instructions involve the use of sudo for creating system users and managing systemd units.- [PERSISTENCE]: Includes a systemd service configuration to ensure the Ollama server remains active across system reboots.- [INDIRECT_PROMPT_INJECTION]: The skill processes responses from LLM models, presenting a surface for untrusted data injection. • Ingestion points: Model responses from ollama.chat and OpenAI-compatible endpoints in SKILL.md. • Boundary markers: None explicitly provided in the examples. • Capability inventory: Shell execution capabilities (curl, docker, systemctl) and privileged system access. • Sanitization: No demonstrated filtering or validation of external content.
Recommendations
  • HIGH: Downloads and executes remote code from: http://localhost:11434/api/ps, https://ollama.com/install.sh - DO NOT USE without thorough review
Audit Metadata
Risk Level
HIGH
Analyzed
Oct 27, 2026, 03:53 AM