by 安全扫描
OpenClaw
安全
high confidenceThe skill's requests and instructions are consistent with its stated purpose (upload files to tmpfiles.org and share links), but it has a few practical and privacy notes you should consider before use.
评估建议
This skill appears to do what it claims: take screenshots or read files, upload them to tmpfiles.org, and share the resulting link. Before installing, consider: (1) Privacy — tmpfiles.org links are public and files expire quickly (~1 hour), so avoid uploading sensitive content. (2) Platform differences — the SKILL.md shows macOS 'screencapture' and Python+requests usage; ensure your agent runtime supports those or provide alternative commands. (3) Dependencies — the examples use the 'requests' P...详细分析 ▾
✓ 用途与能力
Name/description (temporary file uploads and link sharing) matches the runtime instructions which POST files to tmpfiles.org and return a download link. There are no unrelated credentials, binaries, or install steps requested.
ℹ 指令范围
Instructions explicitly tell the agent to capture screenshots (macOS /usr/sbin/screencapture) and upload arbitrary files to an external public service. Capturing the screen and uploading user files is within the stated purpose, but it may expose sensitive on-screen content and assumes the agent/environment should be allowed to run a screencapture command. The SKILL.md also shows sending the link via a Feishu message but does not document how Feishu auth is obtained (this is likely handled by the agent platform).
ℹ 安装机制
This is an instruction-only skill with no install spec (lower risk). It uses python3 and the requests library in examples but does not provide installation steps for requests; the environment may not have requests installed. No external download URLs or archive extraction are used.
✓ 凭证需求
No environment variables or credentials are requested by the skill, which is proportionate. The main privacy/credential consideration is that files are POSTed to a public third-party service (tmpfiles.org) and links are publicly accessible while active—so do not use for sensitive data.
✓ 持久化与权限
The skill does not request persistent presence (always=false) and does not modify other skills or system-wide settings. Autonomous invocation is permitted by platform default but not combined with other concerning privileges.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/3/18
Initial release
● 无害
安装命令
点击复制官方npx clawhub@latest install tmpfiles-upload
镜像加速npx clawhub@latest install tmpfiles-upload --registry https://cn.longxiaskill.com