OpenClaw Skill: Obsidian Markdown to Cloudflare Pages

• Outcome: Review
• Latest audit: May 29, 2026 at 9:22 PM UTC
• Version:
  1.0.2

Overview

The skill does what it says, but its optional Basic Auth feature can write the chosen password into a generated deployment file, so users should review it before use.

Before installing, use a dedicated workspace, run --dry-run, keep includeFolders narrow, and use a scoped Cloudflare token. Avoid enabling Basic Auth unless you are comfortable with the generated functions/_middleware.js containing the Basic Auth password, and ensure that workspace is not committed or shared if Basic Auth is enabled.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: When basic auth is enabled, the script materializes the username and password directly into functions/_middleware.js, embedding secrets into a file in the deployment workspace. That creates a persistent plaintext copy that can be committed, backed up, exposed through logs/artifacts, or otherwise leaked beyond the intended environment-variable scope.

VirusTotal

66/66 vendors flagged this skill as clean.