olares-settings
Pass
Audited by Gen Agent Trust Hub on Aug 31, 2026
Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTIONPRIVILEGE_ESCALATION
Full Analysis
- [COMMAND_EXECUTION]: The skill leverages the olares-cli binary to perform system-level configuration changes, including application management and network tuning. All commands are executed within the context of the vendor's administrative environment.\n- [DATA_EXFILTRATION]: The skill manages sensitive data such as browser cookies, cloud access keys, and VPN configurations. It incorporates explicit security rules to prevent the leakage of these secrets into chat or logs by mandating the use of environment variables and piped input.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes external inputs which serves as a vulnerability surface for indirect prompt injection.\n
- Ingestion points: Cookie files (olares-settings-cookies.md) and SSL certificate files (olares-settings-apps.md) are loaded via CLI flags.\n
- Boundary markers: Instructions in SKILL.md require confirmation for destructive actions and scope authorization to the current task.\n
- Capability inventory: The skill can modify environment variables, delete users, and update VPN ACLs using the olares-cli tool.\n
- Sanitization: Sanitization and validation are delegated to the olares-cli tool's internal logic.\n- [PRIVILEGE_ESCALATION]: The skill facilitates the creation and management of administrative user accounts and the modification of security policies like VPN ACLs. These capabilities are intended for administrative users but represent a risk if misused.
Audit Metadata