OneDrive Integration

Copy large/long files to OneDrive for sharing when the user is on Telegram or WhatsApp and wants to view a full document or long file. Use to place files int...

This skill is internally coherent and the scripts are small and readable, but review the following before installing/using: (1) Understand that files you copy will land in your OneDrive folder and will be synced to Microsoft cloud — do not copy sensitive data you don't want uploaded. (2) The skill requires a local config file (config.env with ONEDRIVE_ROOT) though the registry metadata doesn't declare it; confirm ONEDRIVE_ROOT points to the correct OneDrive folder on your machine. (3) Inspect the bundled scripts (copy_to_onedrive.py and onboard.sh) — they only touch local paths and do not contact external endpoints, but you should run onboard.sh interactively (it will list /mnt/c/Users/*/OneDrive* and prompt) rather than running it blindly. (4) Prefer invoking the script manually or via explicit user approval; avoid globally symlinking into PATH unless you trust the skill and want that convenience. If you want higher assurance, run the scripts in a controlled environment or test with non-sensitive files first.

Type: OpenClaw Skill Name: onedrive-integration Version: 0.1.0 The skill is designed for legitimate file copying to OneDrive. The `SKILL.md` instructions are clear and guide the agent to ask for user confirmation for sensitive configuration, showing no signs of prompt injection. The `copy_to_onedrive.py` script is well-written, includes robust filename sanitization, and safely parses its configuration file using a custom Python function, mitigating shell injection risks from config values. However, the `scripts/onboard.sh` script is suspicious because it writes user-provided input directly into `config.env` using a heredoc without proper escaping for shell contexts. While the `copy_to_onedrive.py` script's Python parser would not execute shell commands embedded in these values, this practice creates a shell injection vulnerability if `config.env` were ever sourced by another shell script, which is a common pattern for `.env` files.