luci-upload

PassAudited by ClawScan on May 7, 2026.

Overview

This skill appears to do what it says—upload user-selected media to memories.ai—but users should notice it uses an API key and sends media plus time/location data to external services.

Before installing, be comfortable with selected media and associated time/location data being uploaded to memories.ai. Keep MEMORIES_AI_KEY secure, confirm the exact file path before upload, and review the full scripts/run.py source if available because the supplied source excerpt was truncated.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI02: Tool Misuse and Exploitation

What this means

A video or image chosen by the agent/user will be sent to memories.ai.

Why it was flagged

The script reads the user-specified local file and uploads it to the memories.ai API. This matches the skill purpose, but the selected file contents leave the local environment.

Skill content

with open(filepath, "rb") as f:
        file_data = f.read()
...
req = urllib.request.Request(url, data=body, method="POST"

Recommendation

Use the probe-first workflow and confirm the exact file path before uploading sensitive media.

Low

#ASI03: Identity and Privilege Abuse

What this means

The skill can upload media under the account associated with the provided Memories.ai key.

Why it was flagged

The skill uses MEMORIES_AI_KEY from the environment or a local .env file as the authorization header for memories.ai. This is declared and expected for the service integration.

Skill content

api_key = os.environ.get("MEMORIES_AI_KEY", "").strip() or _load_env()
...
"authorization": api_key

Recommendation

Provide only the intended API key, keep the .env file private, and revoke or rotate the key if the skill or environment is no longer trusted.

Low

#ASI07: Insecure Inter-Agent Communication

What this means

A typed place name may be shared with the external geocoding provider in addition to memories.ai receiving the final coordinates.

Why it was flagged

When --location is used, the location text is sent to OpenStreetMap Nominatim for geocoding. The SKILL.md discloses automatic geocoding, but users may not realize a third-party geocoder receives the location query.

Skill content

url = f"https://nominatim.openstreetmap.org/search?{params}"

Recommendation

Avoid using --location for sensitive places, or provide explicit latitude/longitude if you do not want the location name sent to a geocoding service.