Test

AList file management API for OpenClaw. Supports upload, download, list, mkdir, rm, mv, search, and offline download. Trigger: User asks about file managemen...

Security Scan

The SKILL.md describes an AList CLI that needs ALIST credentials and a local Python script, but the skill metadata declares no required environment variables or code files and provides no install — these inconsistencies warrant caution.

Purpose & Capability

The skill's stated purpose (AList file management) matches the commands described in SKILL.md, but the skill metadata declares no required env vars or binaries while the instructions clearly expect ALIST_URL/ALIST_USERNAME/ALIST_PASSWORD and a local Python CLI. Either the metadata is incomplete or the runtime will fail or prompt for credentials unexpectedly.

Instruction Scope

SKILL.md instructs the agent to run `python scripts/alist_cli.py` and references `references/openapi.json` and environment variables. None of those files or env variables are declared in the skill manifest. The instructions therefore direct the agent to access local files and secrets that are not provably provided by the skill.

Install Mechanism

There is no install spec (instruction-only), which is lower risk in itself. However, the instructions assume a local Python script and possibly a preinstalled CLI; because those files are not bundled or installed, the agent may try to fetch them or fail. No external downloads are declared.

Credentials

SKILL.md asks for ALIST_URL, ALIST_USERNAME, and ALIST_PASSWORD — credentials that are reasonable for an AList integration — but the skill's manifest lists no required environment variables. This mismatch increases the risk of unexpected credential prompts or manual entry without clear provenance.

Persistence & Privilege

The skill does not request always: true and has no install steps that write to system config. It does not ask for system-level privileges in the manifest.

What to consider before installing

This skill's README looks like a wrapper for an AList CLI, but the package doesn't include the Python script or declare the environment variables it needs. Before installing or enabling it: 1) Ask the publisher for the missing files (scripts/alist_cli.py and references/openapi.json) or for a documented install procedure. 2) Confirm how and where you'd supply ALIST_URL/ALIST_USERNAME/ALIST_PASSWORD (manifest should declare required env vars). 3) Only provide credentials to trusted, verifiable source code — review the CLI code or run it in an isolated environment. 4) If the skill attempts to download code at runtime or prompts for credentials without an authoritative source, do not proceed. Providing the missing code and aligning the manifest with SKILL.md would raise confidence; as-is, the inconsistencies are suspicious.

AList CLI

• Author: LeeShunEE
• Organization: KinemaClawWorkspace

File management tool for AList API.

Environment Variables

ALIST_URL="https://your_alist_server"
ALIST_USERNAME="your_username"
ALIST_PASSWORD="your_password"

Commands

Command	Description
alist login	Authenticate
alist ls [path]	List files
alist get <path>	Get file info
alist mkdir <path>	Create folder
alist upload <local> <remote>	Upload file
alist rm <path>	Delete file
alist mv <src> <dst>	Move file
alist search <keyword> [path]	Search files
alist whoami	Current user

Script

python scripts/alist_cli.py <command> [args]

References

• references/openapi.json - AList API specification