file-upload-cli

• Analyzed: May 9, 2026, 8:09 AM
• Findings: 1
• Version: 1.0.0
• Hash: 9471d331cdfde77058c7875b94cbde03f881a089bb7b24486fd46731c56d6456
• Source: palm
• External report: View on VirusTotal

Findings (1)

The tool is designed to upload local files to 'litterbox.catbox.moe', an anonymous public file-sharing service, which is a high-risk capability for an AI agent as it facilitates easy data exfiltration. While the implementation in 'file-upload-cli.js' is technically sound (using 'execFile' to mitigate shell injection and performing basic file validation), the choice of an unauthenticated public hosting service is a common indicator of risk. Furthermore, 'SKILL.md' and 'README.md' contain inconsistent references to a different service ('0x0.st'), suggesting the bundle may be a poorly adapted version of another tool.