Uploadthing

Uploadthing file hosting — upload, list, and manage files via the Uploadthing API. Simple file uploads with automatic CDN delivery, file metadata, and usage...

This skill appears to be a simple Uploadthing CLI, but there are a few red flags to address before installing or providing secrets: - Confirm the intended API/domain: the SKILL homepage points to agxntsix.ai but the script calls https://uploadthing.com/api. Ask the author which service the secret will be sent to and verify the domain. - Only provide UPLOADTHING_SECRET, and ensure that key is scoped and revocable. Avoid using a high-privilege or long-lived secret if possible. - The script will try to read a local .env in ~/.openclaw/workspace (or a path from WORKSPACE) to find UPLOADTHING_SECRET if the env var is absent. If you keep other secrets in that .env, consider moving them or setting UPLOADTHING_SECRET explicitly instead of allowing the skill to read your workspace file. - The included script is functionally incomplete (upload command doesn't read file args) — treat the code as untrusted and review it yourself or run it in an isolated/test environment before using with real secrets or important data. If the author can explain the domain mismatch and confirm/clarify the .env/WORKSPACE behavior (and ideally remove undeclared workspace file reads), the skill would be much more straightforward to trust.

Type: OpenClaw Skill Name: uploadthing Version: 1.0.0 The skill bundle is classified as suspicious due to a significant discrepancy between the documentation (SKILL.md) and the actual implementation in scripts/uploadthing.py. While the documentation describes a functional CLI for file management, the Python script is a non-functional skeleton that fails to process command-line arguments (such as filenames or keys) and lacks the logic to perform the described actions (e.g., cmd_upload does not actually upload file data). This misleading implementation could cause an AI agent to report false success for critical operations while still accessing the sensitive UPLOADTHING_SECRET from the environment or .env files.