OCFT - OpenClaw File Transfer

P2P file transfer between AI agents via message channels. Supports chunked transfer, IPFS fallback for large files, and trusted peer management.

This skill is a coherent P2P file-transfer design, but exercise caution before installing or running it: - Audit the npm package first: the SKILL.md tells you to run `npm install -g ocft`, which will download and run third-party code. Inspect the package and its GitHub repo (commits, maintainers, recent activity) before installing. - Prefer installing/running the CLI in an isolated environment (container, VM) rather than installing globally on a production machine. - Be aware the tool creates and stores secrets and trusted-peer data at ~/.ocft/config.json and exposes commands like `show-secret` and `export` — treat those secrets like any API key and avoid sharing them with untrusted peers. - Understand the risk of file exfiltration: the skill is designed to send arbitrary files over chat channels. Only add trusted peers and verify URIs before importing peers. - If you plan to use IPFS fallback, verify provider credentials and limit keys scope; don't reuse high-privilege keys. If you want a safer install path, request the maintainer provide a pinned install spec (e.g., exact npm package version and checksum) or bundle audited code rather than only an instruction to install from npm.

Type: OpenClaw Skill Name: ocft Version: 1.1.2 This skill is classified as suspicious due to its inherent handling of sensitive information (node secrets, IPFS API keys) and its extensive file system and network access, which, while plausible for its stated purpose of P2P file transfer, introduces significant risk. Specifically, commands like `ocft show-secret` and `ocft set-ipfs-key` (documented in SKILL.md) directly manage credentials, and the skill stores configuration including secrets in `~/.ocft/config.json` (mentioned in README.md). The reliance on an external `npm` package (`npm install -g ocft`) also presents a supply chain risk.