# Transfer Encrypted Files with Xdrop

Manual Xdrop transfers can be slow when links, keys, and output paths must be handled carefully. This skill guides Claude, Codex, and Claude Code through the bundled upload and download scripts.

## Install

```bash
npx skillstore add xixu-me/xdrop
```

## Metadata

- Status: approved
- Slug: xixu-me-xdrop
- Skillstore revision: r1
- Version status: missing
- Tree hash: 2026a494adacf4813704b1f71c17b83990b066ac5aaa0ff5b5537a6d9d579c61
- Author: xixu-me
- GitHub username: xixu-me
- License: MIT
- Repository: https://github.com/xixu-me/skills/tree/main/skills/xdrop/
- Ref: 64ca8af0f54a325752f08bd54e52151061ea659a
- Supported tools: Claude, Codex, Claude Code
- Audit status: complete
- Agent install advisory: allowed
- Manual install advisory: allowed
- Artifact signature: available
- Audit attestation: unavailable
- Human verification: not\_verified
- Risk factors: external\_commands, network, filesystem, env\_access
- Quality score: 74
- Public page: https://skillstore.pages.dev/skills/xixu-me-xdrop
- Manifest: https://skillstore.pages.dev/api/skills/xixu-me-xdrop/manifest

## Capabilities

- Uploads files or directories to an Xdrop server with a generated share link.
- Downloads a full Xdrop share link and decrypts files locally.
- Supports quiet and JSON output modes for automation workflows.
- Accepts custom server and API URLs for self-hosted Xdrop deployments.
- Preserves relative paths while sanitizing downloaded manifest paths.
- Lets users set expiry, display name, output directory, and upload concurrency.

## Use Cases

- Share Build Artifacts: Upload release files or build outputs to an Xdrop server and return a share link.
- Fetch Received Transfers: Download a complete Xdrop link, decrypt the files locally, and save them to a chosen folder.
- Automate Transfer Scripts: Use quiet or JSON output for shell workflows that need stable script output.

## Prompt Templates

### Upload One File

```
Upload this file to my Xdrop server and give me the share link: <file path> using <server URL>.
```

### Download a Share Link

```
Download and decrypt this full Xdrop share link into <output folder>: <share URL with fragment key>.
```

### Create Automation Output

```
Upload <paths> to <server URL> with quiet JSON output and an expiry of <seconds> seconds.
```

### Use a Custom API Endpoint

```
Use this Xdrop API endpoint <api URL> to transfer <paths>, set the display name to <name>, and limit concurrency to <n>.
```

## Limitations

- Requires Bun and local filesystem access on the machine running the scripts.
- Requires network access to the selected Xdrop server and generated file URLs.
- Cannot decrypt downloads when the share link fragment key is missing.
- Does not independently verify that a user-selected server is trustworthy.

## Best Practices

- Confirm the target Xdrop server before uploading files.
- Keep the full share link fragment intact for downloads.
- Use quiet or structured output when another process consumes results.

## Anti Patterns

- Do not upload sensitive files to an untrusted or unexpected server.
- Do not remove the fragment key from a share link before downloading.
- Do not bypass the bundled path sanitization with manual file writes.

## Security Audit

- Audited at: 2026-07-08T10:13:31.225\+00:00
- Summary: Most static findings are false positives from Markdown backticks or JavaScript template literals, and I found no prompt injection attempt. The remaining confirmed risks are the intended Xdrop network transfers and local file writes performed during downloads.

## Stats

- Views: 91
- Downloads: 9
- Favorites: 0
- Popularity score: 0