Drive Tools

This skill appears coherent for managing SMB/FTP/WebDAV drives, but take these precautions before installing or using it: - Understand that you will be asked to enter drive usernames/passwords which the skill stores in plaintext at skills/drive-tools/config.json — prefer app-specific or limited-access accounts and avoid reusing high-privilege credentials. - Review the config.json and scripts yourself; the FTP TLS context in the code disables certificate verification (context.verify_mode = CERT_NONE), which can allow man-in-the-middle attacks. If you care about TLS authenticity, modify the code to validate certs. - Keep base path (path) restricted in config.json to limit the skill's access scope, and use the recommended whitelisted downloads directory (e.g., ~/.openclaw/media/downloads) so files the skill writes are constrained. - Ensure the runtime environment has the required Python packages (requests, pysmb, ftplib standard library, etc.) and that you trust network connectivity to the configured servers. - If you are not comfortable storing credentials on disk, do not add them or consider encrypting the config file or using ephemeral credentials. Remove the skill when not needed. If you want, I can point out the exact lines where TLS verification is disabled and suggest code changes to force certificate validation and safer credential handling.