ClawHub
Back to skill

Security audit

Olares Shared (olares-cli foundation)

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent Olares authentication helper, but it documents handling long-lived tokens and 2FA codes in ways that can expose them through command-line or terminal logs.

Review before installing. Prefer interactive login where the user enters credentials directly, avoid using refresh-token import or --totp in shared shells, CI, recorded terminals, or monitored systems, and treat any token stored through file fallback as sensitive local credential material.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:43
Finding

Refresh Token Exposed Through Process Command-Line Arguments

Content
View full analysis
--refresh-token "$OLARES_REFRESH_TOKEN" ``` Exchanges the refresh_token for an access_token once via `/api/refresh` and writes both to the keychain. **Read the token from an env var or secret manager — never inline plaintext.** ``` The same unsafe pattern is repeated in the security guidance at `SKILL.md:123`: ```markdown - **Never** echo `access_token` / `refresh_token` to the terminal. When passing a refresh_token to `profile import`, source it from an environment variable: `--refresh-token "$OLARES_REFRESH_TOKEN"`. ``` ### Technical Analysis The documented command expands `OLARES_REFRESH_TOKEN` before starting `olares-cli`. Although the token originates in an environment variable or secret manager, the shell substitutes its value into the `--refresh-token` argument. The resulting plaintext credential may therefore appear in the child process's argument vector. Depending on operating-system permissions and deployment configuration, command-line arguments can be observed through process inspection facilities, process-monitoring agents, audit logs, shell tracing, CI/CD diagnostic output, or wrappers that record invoked commands. Sourcing a secret from an environment variable does not protect it after it is expanded into a command-line argument. A refresh token is a long-lived bearer credential capable of obtaining new access tokens. Its disclosure is consequently more severe than disclosure of a short-lived access token. ### Attack Path 1. A user or automation system follows the documented import command. 2. The shell expands `$OLARES_REFRESH_TOKEN` into the plaintext `--refresh-token` argument. 3. A local process observer, privileged monitoring servi ...[truncated 1263 chars]
Remediation
View remediation
` usage. 4. Replace the documented example with a non-argument transport, for example: ```bash secret_manager_read olares-refresh-token | olares-cli profile import --olares-id "" --refresh-token-stdin ``` 5. Ensure the CLI does not print, log, or include the token in errors, telemetry, crash reports, or debug output. 6. Clear temporary in-memory buffers where practical after the token exchange. 7. Rotate any refresh token suspected of having appeared in process telemetry or build logs. ]]>

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:37
Finding

TOTP Codes Passed Through Process Arguments and Intentionally Echoed

Content
View full analysis
` because there is no second prompt. - **There is no `--password ` flag** — passwords are never accepted on the command line. ``` The recovery table reinforces command-line TOTP use at `SKILL.md:114`: ```markdown | `two-factor authentication required: re-run with --totp <code>` | 2FA on, non-TTY context | Re-run with `--totp <code>`, or run interactively | ``` The security rules explicitly endorse terminal echoing at `SKILL.md:125`: ```markdown - **TOTP is not a password** — it is single-use and short-lived, so the CLI echoes it to make manual entry less error-prone. Never persist a TOTP in a shared script. ``` This guidance conflicts with the safer instruction at `SKILL.md:53`, which says not to pass TOTP as a command-line argument during agent-driven login. ### Technical Analysis Passing a TOTP using `--totp <code>` places the active authentication code in the process argument vector. Intentionally echoing the value also exposes it to terminal recordings, screen sharing, session capture, scrollback, CI logs, and command wrappers. A TOTP is short-lived and normally cannot be reused after its validity window, so its exposure is less severe than refresh-token disclosure. It nevertheless remains an authentication factor during that window. Treating it as non-sensitive because it is temporary weakens defense in depth and can assist an attacker who already possesses the corresponding password. The instructions are internally inconsistent: agent-driven login prohibits command-line TOTP ...[truncated 1525 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 4)May include surrounding context.

md
---
name: olares-shared
version: 4.0.1
description: "Olares profile and authentication foundation for olares-cli — required prerequisite for every other olares-cli skill on Olares (files, market, settings, dashboard, cluster). Covers the Olares profile model (one profile = one Olares instance + one Olares ID, e.g. alice@olares.com), first-time Olares login with password and optional TOTP, importing an existing refresh_token, switching / listing / removing Olares profiles, OS-keychain token storage keyed by Olares ID, automatic access_token refresh on 401/403, and the full Olares auth-error recovery table. Use when the user mentions Olares, Olares ID, olares-cli, OpenClaw on Olares, profile, login, logout, two-factor / 2FA / TOTP, refresh token, keychain, or sees errors like 'server rejected the access token', 'refresh token for X became invalid', 'no access token for X', 'already authenticated', or 'two-factor authentication required'."
metadata:
  requires:
    bins: ["olares-cli"]

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 109)May include surrounding context.

md
---
name: olares-shared
version: 4.0.1
description: "Olares profile and authentication foundation for olares-cli — required prerequisite for every other olares-cli skill on Olares (files, market, settings, dashboard, cluster). Covers the Olares profile model (one profile = one Olares instance + one Olares ID, e.g. alice@olares.com), first-time Olares login with password and optional TOTP, importing an existing refresh_token, switching / listing / removing Olares profiles, OS-keychain token storage keyed by Olares ID, automatic access_token refresh on 401/403, and the full Olares auth-error recovery table. Use when the user mentions Olares, Olares ID, olares-cli, OpenClaw on Olares, profile, login, logout, two-factor / 2FA / TOTP, refresh token, keychain, or sees errors like 'server rejected the access token', 'refresh token for X became invalid', 'no access token for X', 'already authenticated', or 'two-factor authentication required'."
metadata:
  requires:
    bins: ["olares-cli"]

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 110)May include surrounding context.

md
---
name: olares-shared
version: 4.0.1
description: "Olares profile and authentication foundation for olares-cli — required prerequisite for every other olares-cli skill on Olares (files, market, settings, dashboard, cluster). Covers the Olares profile model (one profile = one Olares instance + one Olares ID, e.g. alice@olares.com), first-time Olares login with password and optional TOTP, importing an existing refresh_token, switching / listing / removing Olares profiles, OS-keychain token storage keyed by Olares ID, automatic access_token refresh on 401/403, and the full Olares auth-error recovery table. Use when the user mentions Olares, Olares ID, olares-cli, OpenClaw on Olares, profile, login, logout, two-factor / 2FA / TOTP, refresh token, keychain, or sees errors like 'server rejected the access token', 'refresh token for X became invalid', 'no access token for X', 'already authenticated', or 'two-factor authentication required'."
metadata:
  requires:
    bins: ["olares-cli"]

Static analysis

No suspicious patterns detected.