yannelli/cli-command-risk-GGUF

A newer version is available: CLI Command Risk v1.5 GGUF, trained on the dataset revision tagged v1.5. These builds come from v1, which was trained on the revision tagged v1.

CLI Command Risk GGUF

GGUF builds of a decision model that rates the risk of a shell command, for llama.cpp and Ollama. Give the model a command and its shell, and it answers 17 typed questions with probabilities: the risk level from safe to critical, whether the command is risky, which of 13 risk categories apply, whether the effect can be undone without backups, and whether the harm needs root. The model scores answer options directly and generates no text.

The source model is LiquidAI/d1-3B fine-tuned with LoRA on CLI Command Risk. Test-split results of the source model (PyTorch bf16, 12,689 commands, 215,713 decisions):

Source model	Params	Macro F1 @ 0.5	Level macro F1	Accuracy	ECE	Builds here
d1-3B CLI Command Risk	3.1B	0.929	0.669	0.963	0.030	BF16, Q8_0, Q4_K_M

Macro F1 averages the 13 risk-category questions at a 0.5 cutoff. Level macro F1 averages F1 over the 5 risk levels, using the most likely level. Accuracy counts every decision. The source model card holds the full results, training details and limitations.

Files

File	Size	Runtime
d1-3b-cli-command-risk-Q8_0.gguf	2.9 GB	llama.cpp llama-server, /v1/systemone
d1-3b-cli-command-risk-Q4_K_M.gguf	1.7 GB	llama.cpp llama-server, /v1/systemone
d1-3b-cli-command-risk-BF16.gguf	5.4 GB	llama.cpp llama-server, /v1/systemone
ollama/d1-3b-cli-command-risk-Q4_K_M.gguf + ollama/Modelfile	1.7 GB	Ollama, with ollama/ollama_d1.py
ollama/d1-3b-cli-command-risk-Q8_0.gguf + ollama/Modelfile.Q8_0	2.9 GB	Ollama, with ollama/ollama_d1.py
questions.json	6 KB	The 17 questions the model was trained on

Use Q8_0. It matches the PyTorch model on 99.9% of top answers in the CPU benchmark below. Q4_K_M changes 2.1% of top answers, so use it only when memory is tight.

Questions

questions.json holds the 17 questions in the System One schema:

• risk_level: a score from 0 (safe) to 4 (critical). Each level's definition is in the question's criteria.
• risky: a yes/no question (noul). Yes when running the command as written can destroy data, change permissions or privileges, expose secrets, or disrupt the system.
• 13 category nouls: data_destruction, device_overwrite, overbroad_permissions, privilege_escalation, remote_code_execution, unsafe_download_exec, resource_exhaustion, credential_exposure, irreversible_config, history_log_tampering, network_disruption, signal_kill, shell_footgun.
• reversible and requires_root: nouls for undoing the effect without backups and for needing root to do the harm.

The state is {"shell": ..., "command": ...}, with shell one of bash, zsh, sh, dash, or fish. The model accepts other questions in the same schema, but it was trained and evaluated only on these 17.

llama.cpp

llama-server serves the model through its /v1/systemone endpoint. It reads the command once and answers all 17 questions from that prefix.

hf download yannelli/cli-command-risk-GGUF d1-3b-cli-command-risk-Q8_0.gguf questions.json --local-dir .
llama-server -m d1-3b-cli-command-risk-Q8_0.gguf -c 4096

import json
import urllib.request

questions = json.load(open("questions.json"))["questions"]
state = {"shell": "bash", "command": "dd if=/dev/zero of=/dev/sda"}

body = json.dumps({"state": state, "questions": questions}).encode()
request = urllib.request.Request("http://127.0.0.1:8080/v1/systemone", body, {"Content-Type": "application/json"})
answers = json.load(urllib.request.urlopen(request))["answers"]
print(json.dumps(answers, indent=1))

The answers use the System One shape: a noul answer is P(yes), and a score answer has score (the expected level), probabilities over the levels, and the legend. Read probabilities for each level's probability.

On two test-split commands, Q8_0 on CPU gives:

Question	dd if=/dev/zero of=/dev/sda	Gold	printf '%s\n' 'deploy ALL=(ALL) NOPASSWD: ALL' | sudo tee -a /etc/sudoers	Gold
risk_level	critical (0.999)	critical	critical (0.996)	critical
risky	P(yes) 1.00	yes	P(yes) 1.00	yes
Categories above 0.5	device_overwrite 1.00, data_destruction 0.98	the same two	privilege_escalation 0.99	the same one
Other categories	P(yes) 0.001 or less	no	P(yes) 0.03 or less	no
reversible	P(yes) 0.001	no	P(yes) 0.997	yes
requires_root	P(yes) 1.00	yes	P(yes) 1.00	yes

Tested with llama.cpp at commit f2cc728 (2026-10-11). The GGUF files carry lfm2.decision.type and a systemone chat template, so a llama.cpp build with decision-model support serves them without extra flags.

Ollama

The files in ollama/ hold the same weights with the lfm2.decision.type key removed, because Ollama (tested with v0.40.3) refuses completion for a GGUF that carries it and its /v1/systemone endpoint does not support d1. ollama_d1.py sends d1's prompt for each question through /api/generate and reads the log-probabilities of the answer tokens. It uses the Python standard library only.

cd ollama
ollama create d1-3b-cli-command-risk -f Modelfile.Q8_0
python3 ollama_d1.py --model d1-3b-cli-command-risk request.json    # {"state": ..., "questions": {...}}

Ollama sends one request per question and cannot reuse the command's prompt cache on this hybrid convolution and attention model, so on the CPU benchmark below it takes 4.8 s per command, against 3.3 s for llama-server.

Benchmarks

Answers are compared with the PyTorch model's answers (bf16). A decision agrees when its top answer is the same (P(yes) on the same side of 0.5 for nouls). The difference is the largest absolute probability gap within a decision. Latency is wall-clock time for one command with all 17 questions, one request at a time.

CPU (16 Neoverse V3 cores)

106 test commands from 5 template families picked at random (seed 0), 1,802 decisions.

Build	Runtime	Commands	Top answer agreement	Median diff	p95 diff	Max diff	p50 s/command
d1-3B Q8_0	llama-server /v1/systemone	106	99.9%	0.0000	0.005	0.061	3.3
d1-3B Q4_K_M	llama-server /v1/systemone	106	97.9%	0.0000	0.050	0.718	4.3
d1-3B BF16	llama-server /v1/systemone	6	100%	0.0000	0.001	0.002	144.4
d1-3B Q8_0	Ollama 0.40.3 + ollama_d1.py	106	99.9%	0.0000	0.005	0.065	4.8

BF16 runs at about 144 s per command on this CPU, so it was stopped after 6 commands. For reference, the PyTorch model takes 44 ms per command on an A100.

Limitations

Quantization adds the differences shown in Benchmarks; Q4_K_M can flip answers close to the cutoff. The source model card covers the model's own limitations.

License

These files are derivatives of LiquidAI/d1-3B and are released under the base model's LFM Open License v1.0, included as LICENSE. The license allows commercial use only for entities with less than $10M in annual revenue; read LICENSE for the full terms.

The training data, CLI Command Risk, is CC BY 4.0.

Citation

@misc{yannelli2026clicommandriskgguf,
  title        = {CLI Command Risk GGUF},
  author       = {Ryan Yannelli},
  year         = {2026},
  publisher    = {Hugging Face},
  howpublished = {\url{https://huggingface.co/yannelli/cli-command-risk-GGUF}}
}

@misc{yannelli2026clicommandrisk,
  title        = {CLI Command Risk},
  author       = {Ryan Yannelli},
  year         = {2026},
  publisher    = {Hugging Face},
  howpublished = {\url{https://huggingface.co/datasets/yannelli/cli-command-risk}}
}

Maintainer

Ryan Yannelli | 10/19/2026 | GitHub: @yannelli | Hugging Face: yannelli