cloud-upload-backup

SUSPICIOUS. The core capability—uploading user-selected files to cloud storage—fits the skill's purpose, and there is no malware-like installer, hidden execution, or credential harvesting in the text. However, data flow integrity is weaker than ideal: uploads are funneled through an app-local proxy and produce links on an unverified jsonproxy.3g.qq.com short-link path, and the claimed SDK name does not cleanly match public package evidence. Scope is otherwise fairly proportional because the skill says credentials stay in the host app and uploads require user intent.