LMfiles.com file hosting
v1.0.2Upload files to lmfiles.com and return public download links via API. Use when a user wants CLI-based file hosting, quick share links, bot-accessible file up...
⭐ 0· 539·2 current·2 all-time
byS. Rob Beck@setdemos
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
high confidencePurpose & Capability
SKILL.md and the helper scripts clearly require an API key (LMFILES_API_KEY) and optionally a bootstrap token to register an account; that is coherent with a file-hosting skill. However the registry metadata above states 'Required env vars: none' and 'Primary credential: none', which contradicts the actual instructions and scripts. This metadata mismatch is a meaningful incoherence: either the metadata is stale/incorrect or the skill was published without declaring needed credentials.
Instruction Scope
Runtime instructions and the four helper scripts only call lmfiles.com endpoints via curl for register, upload, list, and delete operations andread only the declared env vars. They do not attempt to read unrelated files, system config, or call other external endpoints. The SKILL.md also contains reasonable safety guidance (don't upload secrets).
Install Mechanism
There is no install spec — this is instruction-only plus small bash helpers included in the package. No external downloads, archives, or package manager installs are performed by the skill itself. The included scripts are short and transparent.
Credentials
The skill legitimately needs LMFILES_API_KEY and optionally LMFILES_BOOTSTRAP_TOKEN as described in SKILL.md and enforced in scripts, which is proportionate to the described functionality. However the registry metadata's omission of those required env vars is a discrepancy that could lead to confusing install-time behavior (platform might not prompt for the API key). The requested secrets themselves are limited to the service's API keys and are not overly broad.
Persistence & Privilege
No special persistence or elevated privileges are requested. Flags show always:false and model invocation is allowed (normal). The skill does not modify other skills or system-wide configs.
What to consider before installing
This skill appears to be a simple CLI wrapper for lmfiles.com and its scripts are short and only call lmfiles.com. However: (1) the registry metadata incorrectly says no env vars are required while the SKILL.md and scripts require LMFILES_API_KEY (and a bootstrap token for registration). That mismatch is the primary concern — confirm with the publisher or registry before installing. (2) Because the package source/homepage is missing, verify you trust lmfiles.com and the publisher ID before supplying API keys. (3) Don't store LMFILES_API_KEY as a broadly accessible global environment variable on shared systems; prefer a per-agent or per-session secret and rotate keys if exposed. (4) Do not upload secrets or credentials to the service. If you need to proceed, inspect the included scripts (they are small) and consider creating a dedicated lmfiles account with limited scope for this skill.Like a lobster shell, security has layers — review code before you run it.
apivk973kpgk8pe9efk3qt7yv7c5ss81qf28downloadvk9779w7825prxqgtavnmtt8tk981pkmmfilehostingvk9779w7825prxqgtavnmtt8tk981pkmmfilesvk973kpgk8pe9efk3qt7yv7c5ss81qf28hostvk9779w7825prxqgtavnmtt8tk981pkmmlatestvk973kpgk8pe9efk3qt7yv7c5ss81qf28openclawvk973kpgk8pe9efk3qt7yv7c5ss81qf28sharingvk9779w7825prxqgtavnmtt8tk981pkmmuploadvk9779w7825prxqgtavnmtt8tk981pkmmverifiedvk973kpgk8pe9efk3qt7yv7c5ss81qf28
License
MIT-0
Free to use, modify, and redistribute. No attribution required.