Yunjia File Transfer

当用户请求文件时（如"把文件发给我"、"发个文件给我"、"把 xxx 发给我"），调用此 skill 将文件发送给用户。支持发送本地文件到当前聊天频道。

This skill appears to do what it says: when asked it will search local directories for absolute file paths and output a JSON instruction that the platform will use to attach/send the file in chat. Before installing or enabling it, consider: 1) It will run filesystem searches (find or PowerShell) and may access many user files when invoked — ensure you only call it when you intend to share files. 2) The included script logs file paths and file-size metadata to /tmp/yunjia-file-transfer.log and stderr; if you have concerns about local log exposure, review or modify the script's logging. 3) The skill does not itself read file contents, but the platform action 'sendFileToChat' will transmit the file to the chat — confirm that sending sensitive files is allowed. 4) Confirm python3 is available in the agent runtime and that the agent process has the necessary filesystem permissions. 5) If you want higher assurance, review the assemble_send_instruction.py code and remove or harden logging before use.

Type: OpenClaw Skill Name: yunjia-file-transfer Version: 1.0.0 The skill provides a mechanism for the AI agent to search the local filesystem and exfiltrate files to the chat interface. While the stated purpose is 'file transfer,' the instructions in SKILL.md explicitly command the agent to perform broad, recursive searches (e.g., using PowerShell's Get-ChildItem or find) and to suppress all conversational output in favor of a raw JSON payload. This 'silent' execution mode, combined with instructions to actively search for files rather than waiting for specific paths, creates a significant risk for unauthorized data access and exfiltration via prompt injection. The helper script assemble_send_instruction.py (and its log file /tmp/yunjia-file-transfer.log) facilitates the formatting of these transfer commands.