put.io (kaput CLI)

Manage a put.io account via the kaput CLI (transfers, files, search) — hoist the mainsail, add magnets/URLs, and check transfer status; best paired with the chill-institute skill.

This skill is a thin, coherent wrapper around the kaput CLI and appears low-risk, but take these precautions before installing/using it: - Verify the kaput-cli package/source before running 'cargo install' (crates.io packages are arbitrary code that will be compiled/run on your machine). Prefer installing from a trusted repository or review its source. The SKILL.md calls kaput 'unofficial'. - Use the kaput device-code login flow as instructed; do not paste credentials into chat. Treat the CLI's token file as sensitive and keep it private (the CLI stores it locally). - Be aware that any command that adds transfers will cause put.io to fetch content specified by URLs/magnets you supply; only add URLs you trust. The skill can run these commands autonomously if the agent is allowed to invoke skills, so restrict agent autonomy if you don't want it creating transfers without your review. - If you want stronger isolation, run kaput in a controlled environment (local user account or container) rather than on a shared machine. Overall, the skill's behavior and requirements match its stated purpose; the remaining risk is the normal risk of installing and running an external CLI (verify the CLI itself).

Type: OpenClaw Skill Name: putio Version: 1.0.0 The skill bundle is benign. It clearly defines its purpose to manage put.io via the `kaput-cli` tool. All scripts directly invoke the `kaput` CLI with arguments, without any evidence of data exfiltration, malicious execution (e.g., `curl|bash`, `eval`), persistence mechanisms, or obfuscation. The `SKILL.md` instructions are straightforward, do not contain prompt injection attempts, and even include security notes advising against pasting passwords or sharing debug logs. The installation of `kaput-cli` via `cargo install` is a standard method for Rust tools and is explicitly stated.