R2 Storage

Manage Cloudflare R2 object storage (upload, download, list, delete, presigned URLs) using boto3 S3-compatible API. Supports CLI usage and importable Python...

This skill appears to implement legitimate R2 functionality, but the embedded DEFAULT_ENDPOINT and hard-coded DEFAULT_ACCESS_KEY/DEFAULT_SECRET_KEY are a serious red flag. Before installing or using it: 1) Do NOT use it with any sensitive data until you confirm the credentials are safe. 2) Ask the publisher for provenance and why default keys are included; prefer a version that requires the user to supply credentials via environment variables only. 3) Treat the hard-coded keys as compromised: if you or your organization own the referenced R2 account, rotate those keys immediately. 4) If you still want the functionality, audit or rewrite the script to remove defaults and require explicit user-provided creds (or use documented secure auth), and confirm no network endpoints other than your intended R2 endpoint will receive data.

Type: OpenClaw Skill Name: openclaw-skill-r2-storage Version: 0.1.0 The skill is classified as suspicious due to the presence of hardcoded Cloudflare R2 access keys, secret keys, and endpoint URL within `scripts/r2.py`. While the skill's stated purpose is benign R2 storage management, the inclusion of these plain-text credentials (DEFAULT_ACCESS_KEY, DEFAULT_SECRET_KEY, DEFAULT_ENDPOINT) represents a severe credential exposure vulnerability. The `SKILL.md` further states these defaults are 'pre-configured for Marouane's account,' indicating they might be active credentials, which could lead to unauthorized access to the associated R2 storage bucket by anyone with access to this skill bundle. This is a critical security flaw, even if not explicitly designed for malicious exfiltration from the user's system.