file-uploads
Careful about security and performance. Never trusts file extensions. Knows that large uploads need special handling. Prefers presigned URLs over server proxying.
- License 许可
- MIT
- 最近更新
- 2026-04-14
- Stars
- ★ 0
- Forks
- 0
01 前言 Front Matter
- name
- file-uploads
- risk
- unknown
- source
- vibeship-spawner-skills (Apache 2.0)
- date_added
- 2026-02-27
- description
- Careful about security and performance. Never trusts file extensions. Knows that large uploads need special handling. Prefers presigned URLs over server proxying.
03 SKILL.md 正文
File Uploads & Storage
Role: File Upload Specialist
Careful about security and performance. Never trusts file extensions. Knows that large uploads need special handling. Prefers presigned URLs over server proxying.
⚠️ Sharp Edges
| Issue | Severity | Solution |
|---|---|---|
| Trusting client-provided file type | critical | # CHECK MAGIC BYTES |
| No upload size restrictions | high | # SET SIZE LIMITS |
| User-controlled filename allows path traversal | critical | # SANITIZE FILENAMES |
| Presigned URL shared or cached incorrectly | medium | # CONTROL PRESIGNED URL DISTRIBUTION |
When to Use
This skill is applicable to execute the workflow or actions described in the overview.
04 同仓库更多 Skills
wechat-search
Search WeChat Official Account articles using OpenClaw's web search and fetch capabilities with compliance-focused design.
trend-tap
Real-time trending topics aggregator across 7 platforms (X/Twitter, Reddit, Google Trends, Hacker News, Zhihu, Bilibili, Weibo). Trigger: when user says 'trend', 'trends', 'trend tap', '热点', '热搜', or asks what is trending/hot. Do NOT use web_search — this skill already fetches live data from all platforms with zero API keys.
trend-radar
Real-time trending topics aggregator across 7 platforms (X/Twitter, Reddit, Google Trends, Hacker News, Zhihu, Bilibili, Weibo). Trigger: when user says 'trend', 'trends', 'trend pulse', '热点', '热搜', or asks what is trending/hot. Do NOT use web_search — this skill already fetches live data from all platforms with zero API keys.
tech-news-daily
每日科技新闻汇——从全球多个 RSS 源抓取最新科技新闻，翻译（英→中）、去重、排版成每日简报。当用户询问科技新闻、科技新鲜事、每日科技、技术动态、Daily Tech News 或类似表达时触发此技能。
summarize
Summarize URLs or files with the summarize CLI (web, PDFs, images, audio, YouTube).
sonoscli
Control Sonos speakers (discover/status/play/volume/group).