Send Me My Files - R2 upload with short lived signed urls

• Outcome: Pass
• Latest audit: Jul 10, 2026 · 2:30 AM UTC
• Version: 1.0.4

Overview

The skill is a disclosed R2/S3 file-sharing tool, but users should use scoped credentials because it can upload chosen local files and delete specified bucket objects.

Install only if you trust the agent that will call it with your local files and cloud bucket. Use bucket-scoped least-privilege R2/S3 keys, keep ~/.r2-upload.yml private, avoid public URLs unless intended, watch file sizes and storage costs, and double-check delete requests because the tool deletes the specified remote object immediately.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (11)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill documentation declares no permissions, yet it clearly relies on environment-variable and local configuration access to obtain storage credentials and defaults. This creates a transparency and consent problem: users may authorize or install the skill without understanding that it can read sensitive configuration paths or environment-provided secrets.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The stated purpose focuses on uploading files and generating presigned links, but the skill also exposes listing, deletion, credential onboarding, and connection-testing behavior. That mismatch is dangerous because users may grant trust for a narrow file-sharing tool while the actual capability set includes broader read/write/destructive access to storage and local credential handling.

Description-Behavior Mismatch

Medium

• Confidence: 97% confidence
• Finding: The skill metadata says it uploads files and generates presigned links, but the implementation also exposes bucket listing and object deletion capabilities. This is dangerous because callers or reviewers may grant trust based on the narrower description while the tool can perform broader storage reconnaissance and destructive actions.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The skill exposes a destructive `r2_delete` capability and its documentation presents deletion as a normal operation without any caution, confirmation guidance, or mention of irreversibility/versioning. In an agentic context, this increases the chance of accidental or over-broad object deletion from cloud storage, especially when users issue ambiguous natural-language requests.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The skill advertises upload and delete operations but does not prominently warn users that these actions modify or remove remote data. In a storage-management context, that omission increases the risk of accidental data loss or unintended writes, especially if an agent invokes tools on a user's behalf.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The delete tool performs object deletion immediately for any provided key without any confirmation, dry-run mode, or safeguard against accidental invocation. In an agent context, this increases the chance of unintended data loss from prompt confusion, tool misuse, or malicious instruction chaining.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The onboarding flow prompts for access keys and secret keys, then serializes them into a YAML file under the user's home directory without clearly warning the user that long-lived cloud credentials will be stored locally. Although the file is written with restrictive permissions (0600), local plaintext storage still increases exposure through backups, endpoint compromise, accidental disclosure, or later permission changes.

Unbounded Output

Medium

• Category: Output Handling

Content

- ✅ Credential exposure in code (external config)

### What we don't protect against:
- ⚠️ Large file uploads (no size limits)
- ⚠️ Malicious file types (no validation)
- ⚠️ Path traversal in custom keys
- ⚠️ Rate limiting / abuse

• Confidence: 92% confidence
• Finding: no size limit

Session Persistence

Medium

• Category: Rogue Agent

Content

- Install dependencies
- Guide you through credential setup
- Test your connection
- Create the config file

### Manual Setup

• Confidence: 71% confidence
• Finding: Create the config file ### Manual Setup 1. Install dependencies: ```bash pnpm install ``` 2. Create config file: ```bash cp example-config.yml ~/.r2-upload.yml # Edit ~/.r

Known Vulnerable Dependency: @modelcontextprotocol/sdk==1.0.4 — 2 advisory(ies): CVE-2026-0621 (Anthropic's MCP TypeScript SDK has a ReDoS vulnerability); CVE-2025-66414 (Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protec)

High

• Category: Supply Chain
• Confidence: 94% confidence
• Finding: @modelcontextprotocol/sdk==1.0.4

Known Vulnerable Dependency: js-yaml==4.1.0 — 2 advisory(ies): CVE-2026-53550 (JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases); CVE-2025-64718 (js-yaml has prototype pollution in merge (<<))

Low

• Category: Supply Chain
• Confidence: 83% confidence
• Finding: js-yaml==4.1.0

VirusTotal

66/66 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.