PrivateBin Upload Skill

Upload content to a PrivateBin instance and return a shareable link. Use when the user wants to share text, code, reports, or files via paste URL with option...

This skill appears to do what it says: it relies on your local privatebin CLI and your PrivateBin config to upload content and return a link. Before using it, verify: (1) the privatebin CLI you install comes from the official project or repository, (2) the configured PrivateBin host (~/.config/privatebin/config.json or the --host flag) is trusted — uploads go to that host and may be visible to the host operator, (3) you should not upload secrets or private data unless you intend that recipient/host to have access, and (4) if you want tighter privacy use password protection or burn-after-reading and confirm the paste URL before sharing. The skill itself requests no unrelated credentials and does not perform unexpected actions.

Type: OpenClaw Skill Name: privatebin-upload Version: 1.0.0 The skill's instructions in SKILL.md for executing `privatebin-cli` commands (specifically in 'Step 4. Run upload') involve constructing shell commands using user-provided or inferred content (e.g., `<content>`, `/path/to/file`, `--password=secret`). This direct substitution without explicit sanitization instructions creates a high risk of shell injection if the AI agent does not properly escape shell metacharacters in user-controlled input. This is a critical vulnerability that could lead to arbitrary command execution, but there is no clear evidence of intentional malicious behavior by the skill author.