OpenClaw Skill: Obsidian Markdown to Cloudflare Pages

Publish selected Obsidian markdown from a vault to a static site and deploy to Cloudflare Pages.

This skill appears to implement the advertised Obsidian→Cloudflare Pages workflow, but review these items before using it: - Provide Cloudflare credentials only via a local .env or shell environment; the skill expects CLOUDFLARE_API_TOKEN and CLOUDFLARE_ACCOUNT_ID but the registry metadata did not declare them — that is a manifest omission. Treat this as intentional: the tool needs a Cloudflare token to deploy. - The wizard can store a basic-auth password directly into config.json (plaintext) unless you explicitly use env-backed credentials; prefer BASIC_AUTH_USERNAME/PASSWORD in your environment and do not commit config.json. - The CLI will attempt to read files in your home directory (it tries to detect Obsidian vaults at a macOS path). If you don't want that, run on a controlled machine or edit the script. - The script can run arbitrary shell commands (rsync, npx quartz, wrangler) and has a fallback that may clear the configured workspace when ALLOW_DESTRUCTIVE=1 is set — only point the workspace to a dedicated path you can safely wipe. - Use --dry-run / DRY_RUN=1 first to preview actions, inspect bin/publishmd-cf.js for any code you are uncomfortable with, and consider running the workflow on a test subdomain before production. If these caveats are acceptable and you verify the code, the skill itself is coherent with its purpose; the main issues are the missing manifest declaration for required envs and the potential for accidental plaintext secret storage and destructive workspace operations.

Type: OpenClaw Skill Name: openclaw-skill-obsidian-cloudflare-pages Version: 1.0.2 The skill is classified as suspicious due to a shell injection vulnerability in the `sh` function within `bin/publishmd-cf.js`, where configuration values (such as project names or branches) are directly interpolated into `execSync` calls without sanitization. The script also performs local data discovery by reading the Obsidian application's internal configuration file (`obsidian.json`) to locate vaults and handles sensitive credentials by writing them into a generated `_middleware.js` file for deployment. While these actions are aligned with the stated purpose of automating Obsidian-to-Cloudflare publishing, the lack of input validation and the handling of secrets represent significant security flaws.