I think CloudFiles' use of finfo opens up a broad attack surface for security vulnerabilities. MediaWiki should specify a content type, using the same algorithm as that used by StreamFile.php.
Note: reported upstream in https://github.com/rackspace/php-cloudfiles/issues/59.
Gah, that was the md5sum problem actually.
CF_Object::compute_md5sum() acts as a single entry point for hashing both files (by path) and strings. It does is_file() to decide which action to take. So if the file is missing for some reason, the result will be counterintuitive, and if you use it to hash a string, it will attempt to do syscalls to check if huge bogus paths exist.
define()s at the top of cloudfiles.php and cloudfiles_http.php may conflict with other extensions, especially USER_AGENT, DESTINATION, AUTH_TOKEN. Suggest a CF_ prefix on all. The author does not appear to be aware of the global scope of constants in PHP, as opposed to the file scope of such constants in C.
The require() statements should also use dirname( __FILE__ ) to avoid the "current directory" pitfall.
Also the tests directory might be slightly scary if the .php files can be executed from the web. Otherwise OK.