file-uploads

SUSPICIOUS: The skill's basic upload behavior matches its purpose, and credential scope is narrow, but it hardcodes uploads to phobos.m6.rs while describing this as the user's private Zipline instance. That mismatch in destination ownership/control and the public file-sharing data flow make the skill medium-high risk even without overt malware indicators.

This module is a dedicated remote file-upload client that exfiltrates arbitrary user-provided local files to a hardcoded external HTTPS endpoint using an environment-supplied Authorization token, then prints a resulting retrieval URL. There are no conventional malware techniques visible in the snippet (no exec/persistence/backdoor), but the implemented functionality is strongly aligned with data exfiltration and should be treated as high-risk if included in an unexpected or untrusted supply-chain context or if the remote host/token are not explicitly authorized.