Security audit
Security checks for vulnerabilities and agentic risk
This skill does what it says: it helps upload a user-specified local file to a user-specified web page, with no hidden persistence or unrelated behavior found.
Before installing or using this skill, confirm both the website URL and the exact file path before any upload. Avoid using it with secrets, credentials, private workspace files, or unknown sites unless you intend to share that file with the site.
The skill explicitly instructs an agent to upload local files to arbitrary external web pages, including examples using absolute paths and workspace files, but provides no warning, consent gate, or guidance about sensitive-data disclosure. In an agent setting, this can cause unintended exfiltration of local or workspace data to third-party sites if the wrong file path or destination is used.
The fallback element search uses the literal text "选择文件", which assumes a Chinese-language interface and may fail or behave inconsistently in other locales. This is a natural-language locale constraint embedded in code without user opt-in or documentation justifying the language restriction.
No suspicious patterns detected.
