Shellbot Website

Build, deploy, and design micro apps and websites on Cloudflare Workers. Scaffolds from templates (React Router + Hono, Next.js, Astro, Remix), deploys, sets...

This skill is coherent for building and deploying Cloudflare Workers, but before installing or running it: 1) Treat the CLOUDFLARE_API_TOKEN as a high-privilege secret — create a narrowly-scoped API token (Workers Script: Edit, D1/KV/R2/Queue edits only as needed, DNS edit only if you need domain setup). 2) Review/manage any template URL you pass (--template-url) before using it — npm create / npm install will execute code from registries or GitHub during scaffolding. 3) Run scripts locally (not on untrusted remote agents) if you need to perform OAuth-based wrangler login (the OAuth flow relies on localhost callbacks). 4) Inspect scripts/manage-secrets.sh and other omitted files to confirm they handle secrets appropriately (they should use wrangler secret put and avoid echoing secrets to logs). 5) For CI use, prefer API tokens over OAuth and store tokens in your secret manager; avoid giving the token wider scopes than required.

Type: OpenClaw Skill Name: shellbot-website Version: 1.1.0 The shellbot-website skill bundle is a legitimate and well-documented tool for scaffolding, deploying, and managing Cloudflare Workers. It includes a suite of scripts (e.g., create-project.sh, deploy.sh, setup-domain.sh) that wrap the Wrangler CLI and Cloudflare API to automate project setup and resource provisioning (D1, KV, R2). While the setup-domain.sh script performs sensitive actions like reading OAuth tokens from the local ~/.wrangler/config/default.toml file and making direct API calls to api.cloudflare.com, these behaviors are strictly aligned with the stated purpose of providing a non-interactive deployment experience. No evidence of data exfiltration, persistence, or malicious prompt injection was found.