us3-uploader-encrypted

Upload files to UCloud US3 (UFile) object storage and generate download URLs. 当用户需要：上传文件、发送文件、分享文件、生成文件链接、把文件发给用户、导出文件、 生成PDF/图片/文档后发送、任何文件产出需要给用户时，必须使用此 ski...

This skill appears to implement a legitimate US3 uploader, but there are concerning inconsistencies and privilege choices you should address before installing: (1) Fix the metadata: declare required environment variables and the primary credential so the platform can surface what secrets the skill needs. (2) Remove or justify always:true — prefer user-invoked only unless you have a clear reason to force inclusion. (3) If you must provide keys, create a dedicated, least-privilege API key and a single bucket used only for this purpose; do not provide high-privilege account keys. (4) Review and, if desired, vendor-lock the runtime dependency (replace runtime pip install with a declared install spec or bundle a pinned dependency) to avoid unexpected downloads. (5) Test in an isolated environment and verify the script only uploads intended files and the signed URLs behave as expected. If you cannot or will not correct the metadata and remove always:true, treat the skill as high-risk and avoid supplying production credentials.

Type: OpenClaw Skill Name: us3-uploader-encrypted Version: 1.0.0 The skill bundle provides a utility to exfiltrate files from the local sandbox to UCloud US3 storage. While this aligns with its stated purpose, `SKILL.md` contains aggressive, imperative instructions forcing the AI agent to upload all file outputs, which could be leveraged to exfiltrate sensitive data. Furthermore, `scripts/upload_to_us3.py` uses `os.system` to install the `ufile` SDK at runtime, which is a risky execution pattern that could be exploited if the package name were manipulated.