Security audit
Security checks for vulnerabilities and agentic risk
This skill does what it says: it uploads user-requested local files into a Kimi conversation, but users should be careful because those files leave the local machine.
Install only if you intend to upload local files into Kimi chats. Review each requested path before use, avoid secrets or private documents unless you want them shared in the conversation, and prefer asking the agent to confirm the exact files before upload.
The description states that local files will be sent into the Kimi conversation, but it does not present this as a clear user warning about data leaving the local environment and becoming available in-chat for download. Without an explicit warning, users may not understand the privacy and confidentiality implications of using the skill.
The trigger phrases are broad, generic requests about sending or uploading files, which can overlap with ordinary conversation and cause the skill to activate when the user did not clearly intend a local-file upload action. In this skill’s context, accidental activation is risky because it can lead to unintended disclosure of local files into a chat for download.
All user-facing instructions and examples are presented only in Chinese, which can amount to a language policy issue when no user opt-in or locale justification is provided. The file does not indicate that the skill is region-specific or that alternative languages are available.
No suspicious patterns detected.
