Cloudflare R2 CLI

Minimal Python CLI for secure upload, download, list, and delete operations on Cloudflare R2 storage using AWS Signature V4 authentication.

This skill appears to be a straightforward R2 CLI, but be careful: the registry metadata claims no required env vars while the SKILL.md and r2.py require five sensitive environment variables (account ID, access key ID, secret, bucket, region). Before installing or enabling this skill: - Treat CF_R2_ACCESS_KEY_ID and CF_R2_SECRET_ACCESS_KEY as sensitive credentials and provide them via a secure secret manager or ephemeral environment, not in persistent config or code. - Confirm the platform/registry entry is updated to declare required env vars so secrets aren't accidentally omitted or exposed by automation. - Test the script in a non-production environment first (it reads env vars at import and will exit if they are missing). - Review that the ACCOUNT_ID you supply will result in requests to *.r2.cloudflarestorage.com (the code enforces this host). - If you need least-privilege, create an access key limited to the specific bucket and operations required. If the metadata mismatch was intentional or you cannot confirm origin/trustworthiness of the skill source, do not provide production credentials.

Type: OpenClaw Skill Name: r2-cli Version: 1.0.6 The OpenClaw R2 CLI skill is classified as benign. Both the `SKILL.md` documentation and the `r2.py` source code demonstrate a strong focus on security. The skill explicitly uses environment variables for sensitive credentials, employs `defusedxml` for safe XML parsing, and critically, the `_validate_url` function in `r2.py` strictly enforces HTTPS and restricts network communication to only `cloudflarestorage.com` domains. There is no evidence of malicious intent such as data exfiltration, unauthorized execution, persistence mechanisms, or prompt injection attempts against the agent in the markdown instructions. The code is well-structured and adheres to security best practices for interacting with cloud storage.