百度网盘文件上传，支持分片上传、断点续传和进度监控。触发词：百度网盘上传、baidu pan upload、上传文件到网盘、upload to baidu pan、断点续传。适用场景：(1)上传本地文件到百度网盘指定目录 (2)大文件自动分片上传 (>4MB) (3)中断后断点续传 (4)自动创建远程目录。

This skill appears to implement the advertised Baidu Netdisk upload features, but review and caution are advised before use: (1) The registry metadata fails to declare the required credentials (AppKey/access_token) and the SKILL.md expects a .env path — confirm you provide only a valid token and store the .env securely. (2) The script calls curl with the access_token in the full URL passed to subprocess.run; on multi-user systems this can leak the token via process listings (ps). Consider running in a single-user or isolated environment or modify the script to avoid embedding secrets in process arguments (use HTTP headers or a library-based multipart upload). (3) The Python code contains sloppy bugs (e.g., precreate uses md5_of_file(remote_path) instead of the source file, an undefined variable 'res' appears later) — run tests with small non-sensitive files first and consider fixing these bugs or asking the author for a corrected release. (4) The script writes .upload_state.json alongside source files; ensure correct file permissions and delete it if it contains sensitive metadata you don't want to keep. If you are not comfortable auditing/fixing the script yourself, prefer an official or well-reviewed client.

Type: OpenClaw Skill Name: baidu-pan-upload-skill Version: 1.1.0 The skill provides a legitimate utility for uploading files to Baidu Pan, supporting large file chunking and resume functionality. The core logic in `scripts/upload.py` implements the standard Baidu Pan API flow (precreate, upload chunks via curl, and merge) and manages upload states locally in a `.upload_state.json` file. While there is a minor coding error in the `precreate_file` function (attempting to MD5 a remote path string), it is immediately deleted and does not impact security. The script uses system `curl` safely via subprocess list arguments, and no evidence of data exfiltration to unauthorized endpoints or malicious prompt injection was found.