diff --git a/TODO.md b/TODO.md
new file mode 100644
index 0000000..e1a46a0
--- /dev/null
+++ b/TODO.md
@@ -0,0 +1,28 @@
+# TODO
+
+## high value
+
+- [ ] surface Zipline error bodies on failed uploads
+  - right now `curl -fsS` drops the JSON body on HTTP 4xx/5xx, which makes auth/quota/debugging annoyingly blind.
+  - keep non-zero exits, but capture the response body and print the server message when available.
+
+- [ ] validate the response shape before printing success output
+  - the script currently assumes the API returns `.files`; if Zipline returns a different success/error shape, users can get empty output with little context.
+  - fail clearly when `.files` is missing or empty.
+
+- [ ] add a `--no-env` / `--env-file <path>` flag
+  - auto-loading `/root/.openclaw/.env` is handy here, but it makes the helper less portable and harder to use in CI or on another machine.
+  - explicit env loading would keep the default convenience while making behavior predictable.
+
+## reliability / test gaps
+
+- [ ] add tests for the unhappy paths that matter most
+  - missing file
+  - missing token
+  - missing `jq` in normal mode
+  - server-side upload failure
+  - this script is tiny, so covering the sharp edges will buy more confidence than adding features.
+
+- [ ] add a mock assertion that the upload request is formed correctly
+  - current smoke test only checks the printed output.
+  - also assert that `curl` was called with the auth header and multipart `file=@...` field so refactors do not silently break real uploads.