Olares Dashboard (olares-cli dashboard)

PassAudited by ClawScan on May 10, 2026.

Overview

This instruction-only skill is coherently focused on authenticated Olares dashboard CLI use, with no code or install-time execution shown, but users should notice its credential/profile dependency and local CLI/shared-skill reliance.

This looks like a documentation/instruction skill for Olares dashboard CLI workflows rather than runnable code. Install it only if you intend an agent to help with authenticated `olares-cli dashboard` operations, and verify the local CLI plus referenced shared skill before using admin or profile-dependent commands.

Findings (2)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Note

ASI03: Identity and Privilege Abuse

What this means

The agent may use your Olares login/profile to read dashboard, system, application, or admin-scoped information when you invoke this skill.

Why it was flagged

The skill explicitly depends on authenticated Olares profile/login handling for dashboard commands. This is expected for the stated dashboard purpose, but it means the agent may operate with the user's authenticated account context.

Skill content

MUST Read [`../olares-shared/SKILL.md`](../olares-shared/SKILL.md) for profile selection, login, factory-injected `*http.Client`, and HTTP 401/403 recovery rules. Every dashboard verb depends on that foundation.

Recommendation

Use a least-privileged Olares profile where possible, review requests involving `--user` or admin-only commands, and confirm you intend the agent to access authenticated dashboard data.

Note

ASI04: Agentic Supply Chain Vulnerabilities

What this means

Actual behavior depends on the installed local CLI and the referenced shared skill guidance, which were not included as code artifacts in this review.

Why it was flagged

The skill is instruction-only but relies on a local `olares-cli` binary and a sibling shared skill file for core profile/login rules. This reliance is disclosed and purpose-aligned, but those external components are outside the provided artifact.

Skill content

metadata:
  requires:
    bins: ["olares-cli"] ... MUST Read [`../olares-shared/SKILL.md`](../olares-shared/SKILL.md)

Recommendation

Verify that `olares-cli` and the referenced `olares-shared` skill come from trusted sources before relying on this skill for authenticated dashboard operations.