📦

xdrop

Name: xdrop
Author: xixu-me

Content revision r1 Safe ⚙️ External commands🌐 Network access📁 Filesystem access🔑 Env variables

Transfer Encrypted Files with Xdrop

Manual Xdrop transfers can be slow when links, keys, and output paths must be handled carefully. This skill guides Claude, Codex, and Claude Code through the bundled upload and download scripts.

Supports: Claude Codex Code(CC)

📊 74 Adequate

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "xdrop" from https://skillstore.io/skills/xixu-me-xdrop.md and its manifest at https://skillstore.io/api/skills/xixu-me-xdrop/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/xixu-me-xdrop.md Signed manifest GET /api/skills/xixu-me-xdrop/manifest Signed lockfile GET /api/skills/xixu-me-xdrop/lockfile

Test it

Using "xdrop". Upload a local archive to an Xdrop server.

Expected outcome:

Returns a share link that includes the transfer identifier and decryption key fragment.

Using "xdrop". Download a full Xdrop link into a downloads folder.

Expected outcome:

Creates the output folder, saves decrypted files, and reports the saved paths.

Using "xdrop". Run an upload in quiet structured mode.

Expected outcome:

Provides machine-readable transfer details without progress text in standard output.

Security Audit

Safe

v5 • 7/8/2026 Open versioned report

Most static findings are false positives from Markdown backticks or JavaScript template literals, and I found no prompt injection attempt. The remaining confirmed risks are the intended Xdrop network transfers and local file writes performed during downloads.

Files scanned

1,210

Lines analyzed

Review items

False positives ignored

Capability review items (17)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Medium

scripts/download.mjs:199

Python file write/append

const fileHandle = await open(destination, 'w')

The downloader opens destination files for writing and saves decrypted remote content to disk. Paths are sanitized, but the behavior can create or overwrite local files under the selected output directory.

Low

scripts/download.mjs:50

Fetch API call

const manifestResponse = await fetch(descriptor.manifestUrl)

This is a real HTTP request or API wrapper used to fetch transfer metadata, manifests, and chunk URLs from remote endpoints. Network access is expected, but it retrieves untrusted remote transfer content.

Low

scripts/download.mjs:208

Fetch API call

const response = await fetch(url)

Low

scripts/download.mjs:362

Fetch API call

const response = await fetch(`${this.baseUrl}${path}`, {

Low

scripts/download.mjs:350

HTTP client library

return this.request(`/public/transfers/${transferId}`)

Low

scripts/download.mjs:354

HTTP client library

const response = await this.request(`/public/transfers/${transferId}/download-urls`, {

Low

scripts/download.mjs:361

HTTP client library

async request(path, options = { method: 'GET' }) {

Low

scripts/upload.mjs:425

Fetch API call

const response = await fetch(uploadUrl, {

This is a real HTTP request or API wrapper used to create transfers and upload encrypted chunks to a user-selected Xdrop endpoint. Network access is expected, but it can transmit file metadata and ciphertext externally.

Low

scripts/upload.mjs:687

Fetch API call

const response = await fetch(`${this.baseUrl}${path}`, {

Low

scripts/upload.mjs:626

HTTP client library

return this.request('/transfers', {

Low

scripts/upload.mjs:633

HTTP client library

await this.request(`/transfers/${transferId}/files`, {

Low

scripts/upload.mjs:641

HTTP client library

const response = await this.request(`/transfers/${transferId}/upload-urls`, {

Low

scripts/upload.mjs:650

HTTP client library

await this.request(`/transfers/${transferId}/chunks/complete`, {

Low

scripts/upload.mjs:658

HTTP client library

await this.request(`/transfers/${transferId}/manifest`, {

Low

scripts/upload.mjs:672

HTTP client library

await this.request(`/transfers/${transferId}/finalize`, {

Low

scripts/upload.mjs:680

HTTP client library

await this.request(`/transfers/${transferId}`, {

Low

scripts/upload.mjs:686

HTTP client library

async request(path, options) {

Risk Factors

⚙️ External commands (82)

🌐 Network access (27)

📁 Filesystem access (1)

scripts/download.mjs:199

🔑 Env variables (6)

scripts/download.mjs:102 scripts/download.mjs:102 scripts/upload.mjs:191 scripts/upload.mjs:192 scripts/upload.mjs:191 scripts/upload.mjs:192

Audited by: codex View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/xixu-me-xdrop/audits/5?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/xixu-me-xdrop/security.svg)](https://skillstore.io/skills/xixu-me-xdrop?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/xixu-me-xdrop?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/xixu-me-xdrop/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/xixu-me-xdrop.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

xixu-me. (2026). xdrop security audit report (audit version 5) [Author version unspecified]. Skillstore. https://skillstore.io/skills/xixu-me-xdrop/audits/5

BibTeX citation

@techreport{xixu-me-xixu-me-xdrop-2026,
  author = {xixu-me},
  title = {xdrop security audit report (audit version 5)},
  institution = {Skillstore},
  year = {2026},
  number = {5},
  url = {https://skillstore.io/skills/xixu-me-xdrop/audits/5},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "xdrop security audit report (audit version 5)"
version: "unspecified"
type: report
authors:
  - name: "xixu-me"
date-released: "2026-07-08"
url: "https://skillstore.io/skills/xixu-me-xdrop/audits/5"
identifiers:
  - type: other
    value: "skillstore:xixu-me-xdrop:audit:5"
    description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: High

Architecture

Maintainability

Content

Community

Spec Compliance

What You Can Build

Share Build Artifacts

Upload release files or build outputs to an Xdrop server and return a share link.

Fetch Received Transfers

Download a complete Xdrop link, decrypt the files locally, and save them to a chosen folder.

Automate Transfer Scripts

Use quiet or JSON output for shell workflows that need stable script output.

Try These Prompts

Upload One File

Upload this file to my Xdrop server and give me the share link: <file path> using <server URL>.

Download a Share Link

Download and decrypt this full Xdrop share link into <output folder>: <share URL with fragment key>.

Create Automation Output

Upload <paths> to <server URL> with quiet JSON output and an expiry of <seconds> seconds.

Use a Custom API Endpoint

Use this Xdrop API endpoint <api URL> to transfer <paths>, set the display name to <name>, and limit concurrency to <n>.

Best Practices

Confirm the target Xdrop server before uploading files.
Keep the full share link fragment intact for downloads.
Use quiet or structured output when another process consumes results.

Avoid

Do not upload sensitive files to an untrusted or unexpected server.
Do not remove the fragment key from a share link before downloading.
Do not bypass the bundled path sanitization with manual file writes.

Frequently Asked Questions

What does this skill do?

It runs bundled Bun scripts for Xdrop upload and download workflows.

Does it encrypt files?

The upload script encrypts file chunks and the manifest before finalizing the transfer.

Can it download without the key fragment?

No. The full link must include the fragment key because the downloader needs it for decryption.

Can I use a self-hosted Xdrop server?

Yes. The scripts accept custom server and API URL options.

Does it write files locally?

Yes. Downloads are decrypted and written under the selected output directory.

Which AI tools can use it?

It is documented for Claude, Codex, and Claude Code workflows.

Developer Details

Author

xixu-me

License

MIT

Skillstore revision

Version notice

The author did not declare a version.

Repository

https://github.com/xixu-me/skills/tree/main/skills/xdrop/

Ref

64ca8af0f54a325752f08bd54e52151061ea659a

Maintenance freshness

7/20/2026

Usage

7 downloads · 91 views

File structure

📁 scripts/

📄 download.mjs

📄 upload.mjs

📄 SKILL.md