Resilient File Delivery

Deliver files via multi-channel fallback (Telegram, Discord, Google Drive, S3, IPFS) with automatic retries, chunking, integrity checks, and delivery tracking.

This skill raises multiple red flags. Before installing or using it: (1) Do not run the suggested npm/pip install on a production host — the bundle provides no code and would force you to fetch external packages. (2) Ask the publisher for the actual source code or verify the GitHub repo and confirm the package contents match the docs (look for index.js and implementation). (3) Be wary of the phrase 'bypass sandbox restrictions' — that indicates evasive behavior and possible misuse for exfiltration. (4) If you need this capability, run any tests in an isolated environment, and only provide API keys/tokens with least privilege and temporary credentials. (5) Require the author to list precisely which credentials are needed and how they are used; if they cannot justify them, do not install.

Type: OpenClaw Skill Name: resilient-file-delivery Version: 1.0.0 This skill is classified as suspicious due to its powerful capabilities that, while potentially legitimate, present a significant risk for data exfiltration and unauthorized file transfer if misused. The skill explicitly allows reading arbitrary local files (e.g., `file: '/path/to/file.zip'`) and sending them via multiple external channels (Telegram, Discord, Google Drive, S3, IPFS), as detailed in `SKILL.md` and `README.md`. The repeated claim of 'Bypass sandbox restrictions' further highlights its potential to circumvent security controls. While there's no direct evidence of malicious intent by the developer, the combination of arbitrary file access and multi-channel exfiltration capability makes it a high-risk tool that could be exploited for sensitive data theft if an attacker can control the input to the skill.