v1.4.0

Olares Files (olares-cli files)

SuspiciousClawScan verdict for this skill. Analyzed Apr 30, 2026, 1:24 PM.

Analysis

This looks like a real Olares file-management skill, but it delegates to an unprovided shared instruction file and covers credentialed, destructive, and public-sharing file operations without clear permission and approval boundaries.

GuidanceBefore installing, verify the provenance and version of `olares-cli`, review the referenced `../olares-shared/SKILL.md`, and only use a least-privileged Olares profile. Require explicit confirmation before delete, move, recursive, cross-volume, repository, public-link, internal-share, or SMB-share actions, and confirm exact paths and recipients first.

Findings (7)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Abnormal behavior control

Checks for instructions or behavior that redirect the agent, misuse tools, execute unexpected code, cascade across systems, exploit user trust, or continue outside the intended task.

Agent Goal Hijack

SeverityLowConfidenceHighStatusNote

SKILL.md

**CRITICAL — before doing anything, MUST use the Read tool to read [`../olares-shared/SKILL.md`](../olares-shared/SKILL.md)**

The skill forces a prerequisite tool read and makes another instruction file authoritative before normal task handling. This may be legitimate shared setup guidance, but users should notice that it expands the instruction source.

User impactThe agent may follow additional instructions outside this skill before performing the user's file request.

RecommendationReview the referenced shared skill before use and ensure it only contains expected login/profile recovery guidance.

Tool Misuse and Exploitation

SeverityHighConfidenceHighStatusConcern

SKILL.md

list (ls), upload, download, cat, rm, cp, mv, rename (rn), share (internal / public / smb), and Sync-repo CRUD

The skill exposes high-impact remote file and repository operations, including deletion, move, sharing, and repository CRUD. The provided artifacts do not clearly bound approvals, scope, or reversibility for these actions.

User impactA mistaken or overly broad invocation could delete, move, overwrite, or expose remote files and repositories.

RecommendationRequire explicit user confirmation for delete, move, recursive, share, SMB, and repository-changing operations; confirm exact source and destination paths before running them.

Agentic Supply Chain Vulnerabilities

SeverityMediumConfidenceHighStatusConcern

SKILL.md

metadata:
  requires:
    bins: ["olares-cli"]
...
MUST use the Read tool to read [`../olares-shared/SKILL.md`](../olares-shared/SKILL.md)

The skill relies on an external CLI binary and a sibling shared instruction file, but the install spec is absent and the manifest contains only SKILL.md. This leaves dependency provenance and referenced instructions unresolved.

User impactThe behavior depends on local components or instructions that are not fully represented in the reviewed artifact set.

RecommendationVerify the installed `olares-cli` source/version and review the referenced `olares-shared/SKILL.md` before enabling this skill.

Cascading Failures

SeverityHighConfidenceHighStatusConcern

SKILL.md

recursive directory transfer with errgroup parallelism, batch DELETE wire shape, server-side copy/move ... async task_id queue, cross-volume supported

The skill documents recursive, parallel, batch, async, and cross-volume operations. A bad path or mistaken instruction can propagate across many files, directories, or volumes.

User impactOne incorrect command could affect a large tree of files or multiple storage volumes before the user notices.

RecommendationUse dry-run-style previews where available, list targets first, and require extra confirmation for recursive, batch, async, and cross-volume operations.

Human-Agent Trust Exploitation

SeverityLowConfidenceMediumStatusNote

SKILL.md

Server-side quirks (critical, do not work around) ... Teach yourself and the user to respect them; **do not** suggest "workarounds"

The skill uses strong authoritative language that may be intended to prevent known backend mistakes. Users should still be aware that it discourages alternative handling for certain errors.

User impactThe agent may present these backend behaviors as fixed constraints and avoid suggesting alternatives even when a user wants a safer manual check.

RecommendationTreat these instructions as operational guidance, but ask for clarification or manual verification before accepting risky file-operation outcomes.

Permission boundary

Checks whether tool use, credentials, dependencies, identity, account access, or inter-agent boundaries are broader than the stated purpose.

Identity and Privilege Abuse

SeverityHighConfidenceHighStatusConcern

requirements and capability signals

Primary credential: none ... Capability signals: requires-oauth-token; requires-sensitive-credentials

The declared credential contract says no primary credential, but capability signals indicate OAuth tokens and sensitive credentials are required. This under-discloses the account authority needed for remote file and sharing operations.

User impactUsers may not realize the skill depends on privileged account access that can affect their Olares files, shares, cloud-backed storage, or Sync repositories.

RecommendationDocument the exact credential type, account scope, and permissions required; use the least-privileged profile and avoid granting broad account access where possible.

Sensitive data protection

Checks for exposed credentials, poisoned memory or context, unclear communication boundaries, or sensitive data that could leave the user's control.

Insecure Inter-Agent Communication

SeverityMediumConfidenceMediumStatusConcern

SKILL.md

share (internal / public / smb) ... folder-share creation across the three flavors (Internal cross-user, Public link with password+expiration, SMB Samba mount)

The skill can expose folders through internal users, public links, and SMB shares. These are purpose-aligned file-sharing features, but the artifacts do not clearly define recipient validation, data-boundary checks, or confirmation requirements.

User impactFiles could be shared with the wrong user, exposed through a public link, or made available over SMB if commands are misapplied.

RecommendationRequire explicit confirmation of recipients, public-link expiration/password, SMB users, and exact folder paths before creating or modifying shares.