Send Me My Files - R2 upload with short lived signed urls

Upload files to Cloudflare R2, AWS S3, or any S3-compatible storage and generate secure presigned download links with configurable expiration.

This skill appears to do what it claims, but be aware of the practical security implications before installing: - You must provide access keys (Access Key ID + Secret) for buckets; prefer creating bucket-scoped tokens with minimal permissions (Object Read/Write only) and avoid account-wide/admin tokens. - The onboarding script writes ~/.r2-upload.yml containing your credentials (the script sets file mode 0600). Keep that file private and do not commit it to source control. - The skill can read any local file path you instruct it to upload. Only upload files you intend to share and avoid giving the agent paths to sensitive system files. - The code currently documents missing protections (no file-size limit, no file-type allowlist, minimal key sanitization). Consider using short presigned expirations (default 5m), rotate credentials if compromised, and review bucket contents regularly. - If you need stricter controls, consider adding the recommended security checks (file size limits, key sanitization, allowed extensions) before using in a production environment. Overall: coherent for its stated use. Use least-privilege tokens and cautious operational practices.

Type: OpenClaw Skill Name: r2-upload Version: 1.0.4 The skill is classified as suspicious due to its inherent powerful capabilities, specifically the ability to read and upload any local file path specified by the agent (`file_path` argument in `r2_upload` in `src/index.ts`), combined with the explicit acknowledgment in `README.md` and `SECURITY.md` of missing security controls such as file size limits, file type restrictions, and comprehensive path sanitization. While these capabilities are necessary for the skill's stated purpose of uploading files to cloud storage, their lack of internal safeguards presents a higher risk profile, as a compromised or malicious agent could exploit them for data exfiltration or denial of service without the skill itself having malicious intent.