OCFT - OpenClaw File Transfer
PassAudited by ClawScan on May 1, 2026.
Overview
This is a coherent file-transfer skill, but users should review its external npm CLI, peer-secret model, auto-accept behavior, and optional IPFS sharing before use.
Before installing, verify the ocft npm package and source repository. If you use it, keep peer secrets private, use TTLs instead of non-expiring trust where possible, choose a safe download directory and file-size limit, and avoid sending sensitive files through public chats or IPFS unless you intend that exposure.
Findings (4)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Installing the CLI gives code from the npm package the ability to run locally outside the reviewed skill artifacts.
The skill directs users to install an external global npm package even though the supplied skill artifacts are instruction-only and contain no code for review.
npm install -g ocft
Verify the npm package and GitHub source, consider pinning a trusted version, and install only if you trust that package.
A trusted peer, or anyone who obtains the relevant secret, may be able to cause files to be accepted automatically into the configured download location.
The documented auto-accept mode can receive files without a per-transfer human approval step after a trust relationship is established.
When the sender knows the receiver's secret, files are automatically accepted without manual approval
Use short TTLs, keep trusted-peer lists small, set a safe download directory and max file size, and avoid enabling auto-accept for peers you do not fully trust.
If the local config or shared secrets are exposed, another party may be able to impersonate a trusted peer or trigger trusted transfer behavior.
The skill uses persistent local secrets and trusted-peer secrets as authorization material for file transfers.
Config is stored at `~/.ocft/config.json` ... "secret": "your-secret-key", ... "trustedPeers": [ { "id": "peer-id", "secret": "peer-secret" } ]Protect ~/.ocft/config.json, do not paste secrets into untrusted chats, rotate secrets if exposed, and prefer expiring trust relationships.
File contents or transfer metadata may be visible in channel history or to channel providers/participants, and Base64 encoding is not encryption.
The transfer protocol is explicitly designed to move files through third-party text channels using Base64-encoded messages.
Sending files through Telegram, Discord, Slack, or any text-based channel ... OCFT messages use a `🔗OCFT:` prefix with Base64-encoded JSON
Use only trusted private channels, avoid sending sensitive files over public or logged channels, and use IPFS fallback only when long-lived external availability is acceptable.