yannelli/cli-command-risk-v1.5-GGUF

CLI Command Risk v1.5 GGUF

GGUF builds of a decision model that rates the risk of a shell command, for llama.cpp and Ollama. Give the model a command and its shell, and it answers 19 typed questions with probabilities: the risk level from safe to critical, whether the command is risky, which of 14 risk categories apply, whether the effect can be undone without backups, whether the harm needs root, and whether a person should review the command before it runs. The model scores answer options directly and generates no text.

With the risky answer at a 0.5 cutoff, v1.5 misses 38 of 6,142 high and critical test commands where v1 misses 182 (79% fewer), and calls 2.9% of safe test commands risky (v1 3.0%).

The source model is LiquidAI/d1-3B with LoRA weights merged in, trained on CLI Command Risk. The merge blends the LoRA of the first release (v1, two parts) with a new LoRA trained on rebuild 6 of the dataset, tag v1.5 (one part). Test-split results of the source model on rebuild 6 (PyTorch bf16, 14,055 commands, 267,045 decisions), next to v1 scored on the same test:

Source model	Params	Macro F1 @ 0.5	Level macro F1	Accuracy	ECE	Builds here
d1-3B CLI Command Risk v1.5	3.1B	0.894	0.670	0.956	0.038	BF16, Q8_0, Q4_K_M
v1 of the same model, same test	3.1B	0.864	0.643	0.946	0.046	none

Macro F1 averages the 14 risk-category questions at a 0.5 cutoff. Level macro F1 averages F1 over the 5 risk levels, using the most likely level. Accuracy counts every decision. v1 also misses all 38 high and critical test commands that v1.5 misses. The source model card holds the full results, training details and limitations.

Files

File	Size	Runtime
d1-3b-cli-command-risk-Q8_0.gguf	2.9 GB	llama.cpp llama-server, /v1/systemone
d1-3b-cli-command-risk-Q4_K_M.gguf	1.7 GB	llama.cpp llama-server, /v1/systemone
d1-3b-cli-command-risk-BF16.gguf	5.4 GB	llama.cpp llama-server, /v1/systemone
ollama/d1-3b-cli-command-risk-Q4_K_M.gguf + ollama/Modelfile	1.7 GB	Ollama, with ollama/ollama_d1.py
ollama/d1-3b-cli-command-risk-Q8_0.gguf + ollama/Modelfile.Q8_0	2.9 GB	Ollama, with ollama/ollama_d1.py
questions.json	7 KB	The 19 questions the model was trained on

Use Q8_0. It matches the PyTorch model on 99.9% of top answers in the CPU benchmark below. Q4_K_M changes 0.8% of top answers, so use it only when memory is tight.

SHA-256 checksums:

dc96162403f773fa07bab7abe78c5ae0b6b64693085ce841a25ca9ee4565e16d  d1-3b-cli-command-risk-Q8_0.gguf
f7e7a9fc954ee21c25f1cf47690954706562fa688a9ef643f8decb8127676181  d1-3b-cli-command-risk-Q4_K_M.gguf
564cf0462d2d9246207089f46e03e63c2a26be122e10ea4427e0a74e49ad792d  d1-3b-cli-command-risk-BF16.gguf
40f8f71f17842295f50a03187c4a9b733c253f8fa86614428d736acb0dc6cda5  ollama/d1-3b-cli-command-risk-Q4_K_M.gguf
ec4e56f5624bfb436b0b42024ea1864497a1741f7c768ac0bd31904021ba983e  ollama/d1-3b-cli-command-risk-Q8_0.gguf
4554ac38b3159b69eed64e0001ac8e942314a0325010ff0e1aec2bdca0607722  questions.json

Questions

questions.json holds the 19 questions in the System One schema:

• risk_level: a score from 0 (safe) to 4 (critical). Each level's definition is in the question's criteria.
• risky: a yes/no question (noul). Yes when running the command as written can destroy data, change permissions or privileges, expose secrets, or disrupt the system.
• 14 category nouls: data_destruction, device_overwrite, overbroad_permissions, privilege_escalation, remote_code_execution, unsafe_download_exec, resource_exhaustion, credential_exposure, irreversible_config, history_log_tampering, network_disruption, signal_kill, package_removal, shell_footgun.
• reversible and requires_root: nouls for undoing the effect without backups and for needing root to do the harm.
• needs_review: a noul for whether a person should review the command before it runs. Yes for risk level moderate, high or critical.

The state is {"shell": ..., "command": ...}, with shell one of bash, zsh, sh, dash, or fish. The model accepts other questions in the same schema, but it was trained and evaluated only on these 19.

llama.cpp

llama-server serves the model through its /v1/systemone endpoint. It reads the command once and answers all 19 questions from that prefix.

hf download yannelli/cli-command-risk-v1.5-GGUF d1-3b-cli-command-risk-Q8_0.gguf questions.json --local-dir .
llama-server -m d1-3b-cli-command-risk-Q8_0.gguf -c 4096

import json
import urllib.request

questions = json.load(open("questions.json"))["questions"]
state = {"shell": "bash", "command": "dd if=/dev/zero of=/dev/sda"}

body = json.dumps({"state": state, "questions": questions}).encode()
request = urllib.request.Request("http://127.0.0.1:8080/v1/systemone", body, {"Content-Type": "application/json"})
answers = json.load(urllib.request.urlopen(request))["answers"]
print(json.dumps(answers, indent=1))

The answers use the System One shape: a noul answer is P(yes), and a score answer has score (the expected level), probabilities over the levels, and the legend. Read probabilities for each level's probability.

On two test-split commands (bash), Q8_0 on CPU gives:

Question	dd if=/dev/zero of=/dev/sda	Gold	printf '%s\n' 'deploy ALL=(ALL) NOPASSWD: ALL' | sudo tee -a /etc/sudoers	Gold
risk_level	critical (0.999)	critical	critical (0.991)	critical
risky	P(yes) 1.00	yes	P(yes) 1.00	yes
Categories above 0.5	device_overwrite 1.00, data_destruction 1.00	the same two	privilege_escalation 0.99	the same one
Other categories	P(yes) 0.001 or less	no	P(yes) 0.04 or less	no
reversible	P(yes) 0.0005	no	P(yes) 0.991	yes
requires_root	P(yes) 1.00	yes	P(yes) 1.00	yes
needs_review	P(yes) 1.00	yes	P(yes) 1.00	yes

Tested with llama.cpp at commit f2cc728 (2026-10-11). The GGUF files carry lfm2.decision.type and a systemone chat template, so a llama.cpp build with decision-model support serves them without extra flags.

Ollama

The files in ollama/ hold the same weights with the lfm2.decision.type key removed, because Ollama (tested with v0.40.3) refuses completion for a GGUF that carries it and its /v1/systemone endpoint does not support d1. ollama_d1.py sends d1's prompt for each question through /api/generate and reads the log-probabilities of the answer tokens. It uses the Python standard library only.

cd ollama
ollama create d1-3b-cli-command-risk -f Modelfile.Q8_0
python3 ollama_d1.py --model d1-3b-cli-command-risk request.json    # {"state": ..., "questions": {...}}

Ollama sends one request per question and cannot reuse the command's prompt cache on this hybrid convolution and attention model, so on the CPU benchmark below it takes 9.3 s per command, against 5.4 s for llama-server.

Benchmarks

Answers are compared with the PyTorch model's answers (bf16, on an RTX 4090). A decision agrees when its top answer is the same (P(yes) on the same side of 0.5 for nouls). The difference is the largest absolute probability gap within a decision. Latency is wall-clock time for one command with all 19 questions, one request at a time.

CPU (16 Neoverse-V3 cores, 14 threads)

56 commands of the rebuild-6 test split, 1,064 decisions. They are all the commands of 5 template families picked at random (seed 0).

Build	Runtime	Commands	Top answer agreement	Median diff	p95 diff	Max diff	p50 s/command
d1-3B Q8_0	llama-server /v1/systemone	56	99.9%	0.0000	0.0068	0.0801	5.4
d1-3B Q4_K_M	llama-server /v1/systemone	56	99.2%	0.0000	0.0433	0.4142	5.7
d1-3B BF16	llama-server /v1/systemone	5	100%	0.0000	0.0001	0.0002	158.0
d1-3B Q8_0	Ollama 0.40.3 + ollama_d1.py	56	100%	0.0000	0.0061	0.1035	9.3

No build changed a risky answer. Q8_0 changed 1 of 1,064 top answers, and Q4_K_M changed 8, all on 3 commands. BF16 takes about 158 s per command on this CPU, so it ran on the 5 commands of one of the 5 families. For reference, the PyTorch model takes 54.9 ms per command on an RTX 4090.

The CPU times are indicative only. The host is a shared 16-vCPU machine that ran other jobs during the benchmark (load average 11 to 18).

Limitations

Quantization adds the differences shown in Benchmarks; Q4_K_M can change answers that Q8_0 keeps. The CPU benchmark covers 5 template families only. The low risk level is the weakest (test F1 0.139). The source model card covers the model's own limitations.

License

These files are derivatives of LiquidAI/d1-3B and are released under the base model's LFM Open License v1.0, included as LICENSE. The license allows commercial use only for entities with less than $10M in annual revenue; read LICENSE for the full terms.

The training data, CLI Command Risk, is CC BY 4.0.

Citation

@misc{yannelli2026d13bclicommandriskv15gguf,
  title        = {CLI Command Risk v1.5 GGUF},
  author       = {Ryan Yannelli},
  year         = {2026},
  publisher    = {Hugging Face},
  howpublished = {\url{https://huggingface.co/yannelli/cli-command-risk-v1.5-GGUF}}
}

@misc{yannelli2026clicommandrisk,
  title        = {CLI Command Risk},
  author       = {Ryan Yannelli},
  year         = {2026},
  publisher    = {Hugging Face},
  howpublished = {\url{https://huggingface.co/datasets/yannelli/cli-command-risk}}
}

Maintainer

Ryan Yannelli | 10/21/2026 | GitHub: @yannelli | Hugging Face: yannelli