Qiniu Upload

Upload local files to Qiniu Cloud and return a publicly accessible URL (or signed private URL). Use when the user wants to upload a local file path to Qiniu,...

This skill appears coherent and implements exactly what it claims (upload a local file to Qiniu and return a URL). Before installing or running: 1) Only provide QINIU_ACCESS_KEY/QINIU_SECRET_KEY to agents you trust — the secret key can be used to create signed URLs and should be protected. 2) Test with a non-sensitive file first to confirm the runtime environment (Node version) supports global fetch/FormData/Blob APIs (modern Node >=18 is typically required). 3) Be aware that private signed URLs are bearer tokens: treat them as secrets and limit expiry when appropriate. 4) Confirm QINIU_DOMAIN points to the intended CDN/public domain to avoid accidental public sharing. 5) If you need stricter isolation, run the script locally yourself rather than giving credentials to an agent.

Type: OpenClaw Skill Name: qiniu-upload Version: 0.1.0 The skill is a legitimate utility for uploading local files to Qiniu Cloud storage. The implementation in `scripts/upload.js` correctly uses environment variables for credentials, generates standard Qiniu upload tokens using HMAC-SHA1, and communicates only with official Qiniu API endpoints (e.g., upload.qiniup.com). No evidence of data exfiltration, malicious execution, or prompt injection was found.