Wenshushu File Uploader

文叔叔文件上传技能，自动上传文件到文叔叔并生成分享链接和取件码

This skill appears to do what it claims: upload files to wenshushu using the wssf CLI. Before installing or invoking it, consider: (1) do not provide sensitive system paths (e.g., ~/.ssh, /etc/*, credential files) — the skill will happily upload arbitrary files; (2) if you enable 'login' flows, a token is stored at ~/.config/wenshushu/token.txt — treat that token like a secret; (3) install.sh runs a remote installer (astral.sh) and will run pip install wssf — review these steps or run them manually in a sandbox if you have concerns; (4) if you need finer control, run upload.py manually in a constrained environment and inspect outputs before letting the agent invoke it autonomously.

Type: OpenClaw Skill Name: wenshushu-uploader Version: 0.1.1 The skill exhibits high-risk behaviors and a potential path traversal vulnerability. It includes an installation script (`install.sh`) that executes a remote script via `curl | sh` and a Python script (`scripts/upload.py`) that performs runtime package installation using `uv`. Furthermore, the `upload_file` function in `scripts/upload.py` resolves file paths without validating that they reside within the intended workspace, potentially allowing an agent to exfiltrate sensitive system files if prompted. While these capabilities are aligned with the stated purpose of uploading files to Wenshushu, the lack of path sanitization and the automated execution of remote installation logic meet the criteria for a suspicious classification.