Uploadthing

Uploadthing file hosting — upload, list, and manage files via the Uploadthing API. Simple file uploads with automatic CDN delivery, file metadata, and usage...

Security Scan

The skill mostly matches an Uploadthing client but contains a few incoherent or unexplained behaviors (homepage vs API domain mismatch, implicit .env file reading, undeclared WORKSPACE use) that warrant caution before installing.

Purpose & Capability

Name/description and the provided CLI script align with a file-hosting client (list, upload, delete, usage). Requesting UPLOADTHING_SECRET is appropriate. However, the SKILL metadata/homepage points to agxntsix.ai while the script calls API_BASE at https://uploadthing.com/api — this domain mismatch is unexpected and should be explained by the author.

Instruction Scope

SKILL.md claims 'Python stdlib only' and 'never stores data locally' which is mostly true, but the runtime script will attempt to read a local .env file at ~/.openclaw/workspace/.env (or a path defined by WORKSPACE) to find UPLOADTHING_SECRET if the environment variable is not set. That behavior (reading user workspace .env) is not declared in SKILL.md and expands scope beyond just calling the remote API.

Install Mechanism

No install spec; this is an instruction-only skill with one Python stdlib script. Nothing is downloaded or written by an installer, which keeps install risk low.

Credentials

The only declared required credential is UPLOADTHING_SECRET (appropriate). The code, however, also reads the WORKSPACE environment variable (if present) to locate a .env file and will parse that file for UPLOADTHING_SECRET — reading workspace files is not declared. This indirect access to local configuration increases the surface for accidental exposure of other secrets and is disproportionate unless justified.

Persistence & Privilege

Skill does not request always:true, does not modify other skills, and uses no special persistent privileges. Autonomous invocation is allowed (platform default) but not combined with other high-risk flags.

What to consider before installing

This skill appears to be a simple Uploadthing CLI, but there are a few red flags to address before installing or providing secrets: - Confirm the intended API/domain: the SKILL homepage points to agxntsix.ai but the script calls https://uploadthing.com/api. Ask the author which service the secret will be sent to and verify the domain. - Only provide UPLOADTHING_SECRET, and ensure that key is scoped and revocable. Avoid using a high-privilege or long-lived secret if possible. - The script will try to read a local .env in ~/.openclaw/workspace (or a path from WORKSPACE) to find UPLOADTHING_SECRET if the env var is absent. If you keep other secrets in that .env, consider moving them or setting UPLOADTHING_SECRET explicitly instead of allowing the skill to read your workspace file. - The included script is functionally incomplete (upload command doesn't read file args) — treat the code as untrusted and review it yourself or run it in an isolated/test environment before using with real secrets or important data. If the author can explain the domain mismatch and confirm/clarify the .env/WORKSPACE behavior (and ideally remove undeclared workspace file reads), the skill would be much more straightforward to trust.

Uploadthing file hosting — upload, list, and manage files via the Uploadthing API.

Features

• File upload — upload files with metadata
• File listing — list uploaded files with filtering
• File deletion — remove files by key
• URL generation — get CDN URLs for files
• Usage tracking — storage and bandwidth usage
• File metadata — name, size, type, upload date
• Bulk operations — delete multiple files
• App info — application configuration

Requirements

Variable	Required	Description
UPLOADTHING_SECRET	✅	API key/token for Uploadthing

Quick Start

# List uploaded files
python3 {baseDir}/scripts/uploadthing.py files --limit 50

# Upload a file
python3 {baseDir}/scripts/uploadthing.py upload document.pdf

# Delete files
python3 {baseDir}/scripts/uploadthing.py delete --keys file_key1,file_key2

# Get usage stats
python3 {baseDir}/scripts/uploadthing.py usage

Commands

files

List uploaded files.

python3 {baseDir}/scripts/uploadthing.py files --limit 50

upload

Upload a file.

python3 {baseDir}/scripts/uploadthing.py upload document.pdf

delete

Delete files.

python3 {baseDir}/scripts/uploadthing.py delete --keys file_key1,file_key2

usage

Get usage stats.

python3 {baseDir}/scripts/uploadthing.py usage

app-info

Get app configuration.

python3 {baseDir}/scripts/uploadthing.py app-info

url

Get file URL.

python3 {baseDir}/scripts/uploadthing.py url file_key

rename

Rename a file.

python3 {baseDir}/scripts/uploadthing.py rename file_key "new-name.pdf"

Output Format

All commands output JSON by default. Add --human for readable formatted output.

# JSON (default, for programmatic use)
python3 {baseDir}/scripts/uploadthing.py files --limit 5

# Human-readable
python3 {baseDir}/scripts/uploadthing.py files --limit 5 --human

Script Reference

Script	Description
{baseDir}/scripts/uploadthing.py	Main CLI — all Uploadthing operations

Data Policy

This skill never stores data locally. All requests go directly to the Uploadthing API and results are returned to stdout. Your data stays on Uploadthing servers.

Credits

---

Built by M. Abidi | agxntsix.ai YouTube | GitHub Part of the AgxntSix Skill Suite for OpenClaw agents.

📅 Need help setting up OpenClaw for your business? Book a free consultation