Cos_Uploader_Qcloud_lh

通过微信接收照片，自动上传到腾讯云 COS 低频存储，按年月归档管理

This skill appears to do what it says (upload WeChat-received photos to Tencent COS), but consider the following before installing: - Risk of local-file exfiltration: the skill will upload any file path it is given (via the OpenClaw message or the --file debug flag). Ensure OpenClaw only passes legitimate media cache paths and that untrusted inputs cannot supply arbitrary filesystem paths. - Limit COS credentials: use a scoped subaccount (least privilege) that only has the minimal COS permissions (bucket write) the skill needs; do not use root or high-privilege keys. - Protect the host and skill directory: the encrypted config and the encryption key are stored on the same host under scripts/conf/. If an attacker gains filesystem access they can decrypt secrets. Restrict access (file permissions and OS-level controls) to the skill directory and logs. - Review and test: inspect the scripts locally, run install in a controlled environment, and test uploads with non-sensitive test files first. - Consider invocation policy: if your platform allows it, restrict autonomous invocation of this skill or add additional validation (e.g., only accept files from a verified OpenClaw channel) to reduce the attack surface. If you want, I can point out exact lines to change to add a path whitelist, stricter mime checks, or to avoid storing the Fernet key on disk in the same folder.

Type: OpenClaw Skill Name: cos-uploader-qcloud-lh Version: 1.0.0 The skill bundle provides a utility for uploading images from WeChat to Tencent Cloud COS, featuring a robust setup process that encrypts API credentials locally using the Fernet (cryptography) library. However, it is classified as suspicious due to a path traversal vulnerability in `scripts/skill_handler.py`. The script extracts file paths from incoming message text via a regular expression and proceeds to upload them without validating that the paths are restricted to the intended OpenClaw media directory. This could allow an attacker to exfiltrate sensitive local files (e.g., configuration files or SSH keys) to the user's COS bucket by sending a crafted message. No evidence of intentional malice or unauthorized remote exfiltration was detected.