Share One-Time Link

Generate public one-shot or time-limited download links for files using a local Express server exposed via Cloudflare Tunnel. Links are tokenized, expire aut...

This skill appears to implement a legitimate one-time sharing server, but review and act on the following before installing/running it: - Treat SHARE_SECRET as mandatory and strong: the server will not run without it (server.js exits if SHARE_SECRET is unset). Do not rely on the registry summary — set a strong secret and SHARE_PUBLIC_URL explicitly. - Be cautious what files you instruct the skill or an agent to share: share-file.js will copy any path you provide into the shared directory and expose it via a public link. Do not share private keys, credentials, or other sensitive files. - Verify the public hostname and Cloudflare Tunnel configuration yourself (cloudflared must be present and you must run the tunnel). Ensure the public URL in SHARE_PUBLIC_URL matches your tunnel's hostname. - The start.sh warning is misleading: it prints a warning when SHARE_SECRET is unset, but server.js will exit if it truly isn't set. Do not assume the server is protected unless you've set and tested SHARE_SECRET. - Run the server in an isolated environment (or sandbox/workspace) if you want to test, and review logs to confirm files are deleted after download/expiry. If you want a cleaner metadata posture, ask the publisher to fix the registry env-vars to match SKILL.md and to correct start.sh behavior so it cannot be misinterpreted as safe when SHARE_SECRET is missing.

Type: OpenClaw Skill Name: share-onetime-link Version: 1.2.0 The skill provides a file-sharing service that exposes a local Express server to the public internet via a Cloudflare Tunnel. While the implementation includes security controls such as mandatory secret-based authentication (SHARE_SECRET), tokenized one-time links, and automatic file deletion in server.js, the inherent capability to create a public tunnel for local file access is a high-risk behavior. The share-file.js script facilitates moving any accessible file into the public-facing directory, which could be leveraged for data exfiltration if the agent is manipulated into sharing sensitive files like SSH keys or configuration data.