Is s3-uploader safe to install?

SaferSkills independently audited s3-uploader (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.

CategoryWeightCategory scoreContribution

Securityprompt, exec, net, exfil, eval

35%

100

35.0 pts

Supply chainhash, typosquat, maintainer, lockfile

20%

100

20.0 pts

Maintenancestaleness, pinning, CI

15%

100

15.0 pts

TransparencySKILL.md, perms, README

15%

100

15.0 pts

Communityinstalls, verify, response

15%

100

15.0 pts

Findings & checks · 0 flagged

Securityscore 100 · 0 findings

✓—All security checks passedNo findings in this category for the latest scan.pass

Supply chainscore 100 · 0 findings

✓—All supply chain checks passedNo findings in this category for the latest scan.pass

Maintenancescore 100 · 0 findings

✓—All maintenance checks passedNo findings in this category for the latest scan.pass

Transparencyscore 100 · 0 findings

✓—All transparency checks passedNo findings in this category for the latest scan.pass

Communityscore 100 · 0 findings

✓—All community checks passedNo findings in this category for the latest scan.pass

The primary manifest — the file an agent reads to learn what this artifact does.

skills/s3-uploader/SKILL.md · 1 file

skills/s3-uploader/SKILL.md2.3 KB · Markdown

name: s3-uploader

description: "Upload and download run artifacts from S3-compatible storage with BYO bucket and credentials from env. Use when the user asks to store scraper output, archive reports, publish artifacts to object storage, fetch a prior run file, or use MinIO/R2/Spaces/S3 without hardcoding credentials."

version: "1.0.0"

S3 Uploader

Use this skill when an automation run needs durable artifact storage: CSV reports, PDFs, JSON checkpoints, screenshots, model outputs, or logs that should survive outside the local machine. The helper targets generic S3-compatible storage and reads bucket, endpoint, and credentials from environment variables only.

When to invoke

User says: "upload this report to S3", "save artifacts to object storage", "download the last run file", "use MinIO/R2/Spaces".
Code in the conversation writes files locally but needs a portable handoff or archive location.

When NOT to invoke

The artifact is only needed inside the same process; keep it on disk.
The user needs a public website CDN workflow with cache invalidation and signed URLs.

Concrete example

User input:

Upload the generated CSV to my S3-compatible bucket after the scraper finishes.

Output:

# Copy assets/s3.py into your project, then:
from s3 import upload_file

key = upload_file("out/daily_report.csv", key="reports/daily_report.csv")
print("uploaded:", key)

The helper reads S3_BUCKET, S3_ACCESS_KEY_ID, S3_SECRET_ACCESS_KEY, optional S3_ENDPOINT_URL, and optional S3_REGION from the environment. Nothing target-specific or secret is committed.

Pattern to apply

Keep bucket name, endpoint, access key, and secret key in env vars only.
Use deterministic object keys such as reports/YYYY-MM-DD/name.csv so reruns are easy to find.
Upload only after the local file is complete; never stream a half-written artifact.
Support S3-compatible endpoints by passing endpoint_url instead of hardcoding AWS.
Fail with a clear config error when env vars or client libraries are missing.

Reference: assets/s3.py.

Source

Distilled from production use across the author's automation projects. v1.0.0. See also: [[csv-report-writer]], [[playwright-pdf-snapshot]], [[pipeline-orchestrator]].

→ Build the full runnable bot with Trawlkit.

s3-uploader— agent skill

Is s3-uploader safe to install?

S3 Uploader

When to invoke

When NOT to invoke

Concrete example

Pattern to apply

Source

Audit the pieces. Scan the whole. Decide.