Defuddle

Defuddle

Treat Defuddle as an optional external extractor, not an internal capability. Cleaning, raw capture, and wiki ingestion are separate operations.

Resolve the installed product root from this skill's own location, never from the selected vault or process working directory:

PRODUCT_ROOT=/absolute/path/to/installed/claude-obsidian
CORE="$PRODUCT_ROOT/scripts/claude-obsidian.py"
test -f "$CORE"

Every ../wiki/references/ link in this file resolves the same way, relative to this skill's own directory under $PRODUCT_ROOT, never relative to the selected vault's wiki/ directory.

If a separately installed kepano/obsidian-skills defuddle skill is available, prefer it for current CLI flags. Retain the privacy, consent, and transaction rules in this skill.

Safety contract

• Accept remote inputs only as HTTPS URLs.
• Reject credentials in URLs, fragments, private or local hosts, non-public IP addresses, control characters, and sensitive query parameters.
• Never interpolate a URL into a shell string. Pass it as one argv element.
• Treat redirects to a different host as denied until that host is explicitly approved.
• State that the URL and request metadata will leave the machine. Network access requires explicit consent in the current request or a separate confirmation.
• Do not install a cleaner, execute a placeholder runner, or silently switch to another network fetcher.
• Do not claim a fixed token reduction or extraction quality. Inspect the actual output.

Plan first