OpenClaw Cloudflare Secure

Securely expose an OpenClaw Gateway WebUI on a VPS via Cloudflare Zero Trust Access + Cloudflare Tunnel (cloudflared), including DNS cutover for custom hostnames and optional cleanup of Tailscale Serve.

Before installing, be aware of these points: - The SKILL.md and scripts require a CLOUDFLARE_API_TOKEN (and a separate cloudflared tunnel token) even though the registry metadata says none — do not rely solely on the registry summary when deciding to provide credentials. - Provide a token with the least-privilege permissions recommended (Zone:DNS:Edit + Zone:Zone:Read) and rotate/revoke it after use if appropriate. - The dns_point_hostname_to_tunnel.sh script will delete any existing A/AAAA/CNAME records for the hostname — back up DNS records or confirm you want that change before running. - install_cloudflared.sh downloads and installs a .deb from GitHub without checksum verification; consider verifying the release manually or installing cloudflared via your distro's package manager or a signed artifact if you need stronger supply-chain assurance. - The scripts require sudo (systemctl, dpkg) and assume amd64; verify target host architecture and run in a controlled environment first. - If you need higher assurance, review the cf_dns.py and shell scripts line-by-line, and test in a non-production environment. Ask the publisher to update the registry metadata to declare CLOUDFLARE_API_TOKEN as a required env var and to add checksum verification for the downloaded package.

Type: OpenClaw Skill Name: openclaw-cloudflare-secure Version: 1.0.0 This skill is classified as suspicious due to its reliance on high-privilege operations and sensitive API token usage, even though these are necessary for its stated purpose. Specifically, the `scripts/install_cloudflared.sh` script downloads and installs software from an external source using `wget` and `sudo dpkg -i`, and `scripts/tunnel_service_install.sh` installs and enables a system service using `sudo cloudflared service install` and `sudo systemctl enable --now cloudflared`. Furthermore, `scripts/cf_dns.py` and its wrappers (`dns_create_record.sh`, `dns_point_hostname_to_tunnel.sh`) manage Cloudflare DNS records using a `CLOUDFLARE_API_TOKEN`, which grants significant control over DNS. While these actions are directly aligned with the goal of setting up a Cloudflare Tunnel and DNS, the inherent risks associated with `sudo` and API token management warrant a 'suspicious' classification, as per the defined threshold for risky capabilities without clear malicious intent.