Security Audit
Send Me My Files - R2 upload with short lived signed urls
github.com/openclaw/skillsTrust Assessment
Send Me My Files - R2 upload with short lived signed urls received a trust score of 66/100, placing it in the Caution category. This skill has some security considerations that users should review before deployment.
SkillShield's automated analysis identified 3 findings: 0 critical, 2 high, 1 medium, and 0 low severity. Key findings include Unpinned npm dependency version, Skill can exfiltrate arbitrary local files via r2_upload, Skill can delete arbitrary objects in configured buckets via r2_delete.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 14, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings3
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Skill can exfiltrate arbitrary local files via r2_upload The `r2_upload` tool allows the AI agent to specify a `file_path` on the local filesystem. The skill then reads the content of this file using `fs/promises.readFile` and uploads it to a configured S3-compatible bucket. A malicious prompt could instruct the AI to upload sensitive files (e.g., `/etc/passwd`, `~/.ssh/id_rsa`, `~/.r2-upload.yml`), leading to data exfiltration. Implement strict validation or an allowlist for `file_path` arguments. Require explicit user confirmation for uploads of sensitive paths or files outside a designated upload directory. Consider sandboxing the skill's filesystem access to prevent access to arbitrary paths. | LLM | src/index.ts:204 | |
| HIGH | Skill can delete arbitrary objects in configured buckets via r2_delete The `r2_delete` tool allows the AI agent to specify an S3 `key` for deletion. This grants the AI the ability to delete any object within the configured S3-compatible buckets. A malicious prompt could instruct the AI to delete critical data, potentially leading to significant data loss or service disruption. Implement user confirmation for all delete operations. Restrict the AI's ability to call `r2_delete` without explicit human approval. Consider using more granular S3 permissions (e.g., object lifecycle policies, or IAM policies that restrict deletion to specific prefixes) if the use case allows. | LLM | src/index.ts:240 | |
| MEDIUM | Unpinned npm dependency version Dependency '@aws-sdk/client-s3' is not pinned to an exact version ('^3.699.0'). Pin dependencies to exact versions to reduce drift and supply-chain risk. | Dependencies | skills/julianengel/r2-upload/package.json |
Scan History
Embed Code
[](https://skillshield.io/report/cf66b4798c0c4196)
Powered by SkillShield