Defuddle

Treat Defuddle as an optional external extractor. This package supports inert URL plans and filesystem capture; it does not ship an enforcing network cleaner. Cleaning, raw capture, and wiki ingestion are separate operations.

Resolve the installed product root from this skill's own location, never from the selected vault or process working directory:

PRODUCT_ROOT=/absolute/path/to/installed/claude-obsidian
CORE="$PRODUCT_ROOT/scripts/claude-obsidian.py"
test -f "$CORE"

Every ../wiki/references/ link in this file resolves the same way, relative to this skill's own directory under $PRODUCT_ROOT, never relative to the selected vault's wiki/ directory. Upstream flags may be checked in a separately installed kepano/obsidian-skills reference, but do not override this package's privacy and transaction boundary.

Inert URL plan

Accept HTTPS URLs only. Reject credentials, fragments, controls, sensitive query parameters, and non-public hosts or IP addresses. Never interpolate a URL into a shell string. Use one argv element when constructing a plan:

python3 "$CORE" capture external-plan url "HTTPS_URL"
python3 "$CORE" contracts --verify --capability defuddle --vault "$VAULT"

The plan executes no network request. Report the normalized host, required network egress, redirect policy, optional dependency, and execute: false. An available state means no executable was found. A configured state means an executable was discovered without a bundled behavioral verifier. Identify the manual executable and its reported reason; never run it merely because it was found. Never relabel configured as verified.

Why execution stops here