将本地最多5个文件发送到当前Kimi对话中供用户下载，支持任意类型文件。

This skill appears to do what it says (upload local files to the Kimi conversation) but the runtime instructions allow the agent to read and upload any local path you specify — including possibly sensitive internal files (agent memory, credentials, logs). Before installing or using it, verify: (1) what the kimi_upload_file tool does and who can access the uploaded files on the server, (2) that the agent will prompt for explicit confirmation before uploading sensitive paths, and (3) you avoid naming or auto-sending files that contain secrets (API keys, ~/.ssh, agent memory or database files). If you need stricter safety, request that the skill author add explicit confirmation steps, a whitelist of allowed directories, or a preview of files to be uploaded.

Type: OpenClaw Skill Name: kimi-file-transfer Version: 1.0.0 The 'kimi-file-transfer' skill is designed to send local files to the Kimi conversation for user download. While its stated purpose is benign, the `SKILL.md` instructions imply that the AI agent will use a `kimi_upload_file` tool with paths directly provided by the user. This creates a significant vulnerability where a malicious user could exploit prompt injection to request sensitive local files (e.g., `/etc/passwd`, `~/.ssh/id_rsa`, configuration files) from the agent's host system, leading to unauthorized data exfiltration. The skill itself does not exhibit malicious intent, but it enables a high-risk capability that can be easily abused.