Cloudflare R2 S3 存储工具

Cloudflare R2 S3 兼容存储工具，支持配置 API 密钥、上传文件并获取公开访问地址。使用当需要上传文件到 Cloudflare R2 获取公开链接时。

Security Scan

The skill appears to implement exactly what it claims (upload/list/delete files in Cloudflare R2 via S3-compatible API) and its code is coherent with the README; no hidden endpoints or unexplained privileges were found.

Purpose & Capability

Name/description, SKILL.md and the Python script all consistently implement an S3-compatible Cloudflare R2 uploader (upload, list, delete, generate public URLs). The use of boto3 and an R2 endpoint is appropriate for this purpose.

Instruction Scope

SKILL.md and the script instruct the agent to read a configuration file (~/.openclaw/config/cloudflare-r2.env) or accept parameters for R2 account ID, access key, secret, bucket name and optional public domain — this is expected. One minor coherence issue: the registry metadata declares no required env vars, but the skill does require sensitive env vars/config at runtime (documented in SKILL.md and enforced by the script).

Install Mechanism

There is no install spec (instruction-only with an included script) which minimizes installer risk. The script depends on boto3 and python-dotenv; SKILL.md calls out pip install boto3 but does not mention python-dotenv (dotenv is imported in the script). No downloads or remote install URLs are used.

Credentials

The tool legitimately requires Cloudflare R2 credentials (account id, access key id, secret access key) and a bucket name. Those are sensitive secrets but are proportional to the stated purpose. However, the package/registry metadata did not declare any required env vars or a primary credential, which is an inconsistency the user should be aware of before installing or granting secrets.

Persistence & Privilege

The skill does not request permanent/always inclusion, does not modify other skills or system settings, and only reads a user config file. It does not persist elevated privileges or perform unexpected background actions.

Assessment

This skill appears to do what it says: it reads a local config file (~/.openclaw/config/cloudflare-r2.env) or accepts parameters and uses boto3 to talk to Cloudflare R2. Before installing or using it: (1) be aware you must supply R2 credentials (account id, access key id, secret access key) and a bucket name — these are sensitive; the registry metadata did not declare them, so do not expect automatic secret management. (2) Prefer creating a least-privilege API key that only permits object read/write on the specific bucket. (3) Note the tool may set uploaded objects to public-read (public URL generation); avoid using with sensitive files unless you disable public uploads. (4) Ensure you install required Python deps (boto3 and python-dotenv) in a controlled environment. (5) If you have concerns, review the included scripts yourself or run the tool in an isolated environment (container/VM) and use dedicated credentials.

Cloudflare R2 提供 10GB 免费存储额度，兼容 S3 API，可以用来存储文件并生成公开访问地址。

功能特性

• ✅ 支持配置 S3 API 端点、访问密钥和存储桶
• ✅ 上传本地文件到 R2 存储桶
• ✅ 自动生成公开访问 URL
• ✅ 支持列出存储桶中的文件
• ✅ 支持删除文件
• ✅ 兼容其他 S3 兼容存储服务（如 MinIO）

配置方式

在使用前需要配置以下环境变量或配置文件：

# ~/.openclaw/config/cloudflare-r2.env
CLOUDFLARE_R2_ACCOUNT_ID=your-account-id
CLOUDFLARE_R2_ACCESS_KEY_ID=your-access-key
CLOUDFLARE_R2_SECRET_ACCESS_KEY=your-secret-key
CLOUDFLARE_R2_BUCKET_NAME=your-bucket-name
CLOUDFLARE_R2_PUBLIC_DOMAIN=your-public-domain  # 可选，自定义公开域名

或者在调用时传入参数。

使用方法

上传文件

from scripts.r2_uploader import R2Uploader

uploader = R2Uploader()
result = uploader.upload_file(local_path, object_name=None, public=True)
print(result['public_url'])  # 获取公开访问地址

命令行使用

# 上传文件
python skills/cloudflare-r2-s3/scripts/r2_uploader.py upload /path/to/file.jpg [object-name]

# 列出文件
python skills/cloudflare-r2-s3/scripts/r2_uploader.py list

# 删除文件
python skills/cloudflare-r2-s3/scripts/r2_uploader.py delete object-name

Cloudflare R2 配置步骤

1. 创建 R2 存储桶

   • 登录 Cloudflare 控制台 → R2 → 创建存储桶
   • 记住存储桶名称

2. 创建 API 令牌

   • R2 → 管理 R2 API 令牌 → 创建 API 令牌
   • 授予 Object Read + Write 权限
   • 保存 Access Key ID 和 Secret Access Key

3. 配置公开访问（可选但推荐）

   • 在存储桶设置 → "Public Access" → 启用
   • 可以使用 Cloudflare 提供的 pub-${bucket-name}.r2.dev 域名
   • 或者绑定自定义域名

依赖

需要安装 boto3:

pip install boto3

脚本说明

• scripts/r2_uploader.py - 主上传工具，支持命令行和 API 调用
• references/config_example.env - 配置文件示例