Minio Share

Upload files to MinIO object storage and generate shareable links with Markdown formatting. Use when users ask to send files, share files, upload files, down...

This skill performs MinIO uploads and needs MINIO_* credentials — make sure you only provide scoped, short-lived credentials for the specific bucket. Note the registry metadata omits the required environment variables; confirm and correct that before installing. The README promises rich Markdown previews and automatic download-from-URL behavior, but the bundled script only uploads a local file and prints a presigned URL (or a small JSON blob) — if you need the promised Markdown/preview behavior you should inspect/modify the script. Avoid using the --insecure option in production (it disables SSL verification). Because the publisher and homepage are unknown, review the script yourself, test in an isolated environment, and prefer least-privilege credentials (write-limited to the intended bucket) and key rotation.

Type: OpenClaw Skill Name: minio-share Version: 0.1.3 The `SKILL.md` file contains instructions for the AI agent to "Download the file (if it's a URL) to a temporary location." This instruction, without specifying safety measures or URL validation, poses a significant prompt injection risk, potentially allowing an attacker to trick the agent into downloading and processing malicious content from an arbitrary URL. Additionally, the `scripts/minio_upload.py` script includes an `--insecure` flag that disables SSL certificate verification, introducing a Man-in-the-Middle (MITM) vulnerability if used, although it is noted as 'not recommended for production' in the documentation. There is no clear evidence of intentional data exfiltration or other malicious code within the Python script itself.