T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/crawl.sh:23- Finding
Credential Environment File Is Executed as Arbitrary Shell Code
- Content
View full analysis
- Remediation
View remediation
Security audit
cf-crawl
Security checks for vulnerabilities and agentic risk
Overview
This Cloudflare crawler is mostly purpose-aligned, but it unsafely executes its local credential file as shell code and handles a powerful API token in a way users should review before installing.
Install only if you are comfortable giving the skill a Cloudflare token with Browser Rendering read and edit access and sending crawl targets, page contents, prompts, schemas, and results to Cloudflare services. Store the token in a tightly protected file, do not generate that file from untrusted input, prefer a dedicated least-privilege token, and avoid crawling sensitive or regulated content unless Cloudflare's data handling is acceptable for that data.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Note
- Location
scripts/crawl.sh:126- Finding
Cloudflare API Token Is Exposed in Process Command-Line Arguments
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Rogue AgentSelf-Modification, Session Persistence
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (12)
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 94% confidence
- Finding
The skill invokes shell scripts but does not declare any tool scope or allowed-tools boundary, so an agent may use shell capabilities without an explicit permission contract. In an agent environment, this increases the chance of overbroad command execution and makes it harder for reviewers or policy engines to constrain what the skill can do.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill encourages crawling and AI extraction through Cloudflare services but does not clearly warn that crawled page content, prompts, and extracted results may be transmitted to third-party infrastructure. Users may unknowingly send proprietary, regulated, or otherwise sensitive data off-platform, creating confidentiality and compliance risk.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
sh # --json-schema F Path to JSON schema file (requires --format json) # --poll-interval Seconds between polls (default 5) # --timeout SEC Max seconds to wait (default 300) # --output FILE Write results to file (default stdout) # --raw Output raw API response (no formatting) # --start-only Start job, print ID, don't poll
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 70% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
sh fi # Start crawl RESPONSE=$(curl -s -X POST "$BASE" \ -H "Authorization: Bearer $CF_CRAWL_API_TOKEN" \ -H "Content-Type: application/json" \ -d "$BODY")
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 79% confidence
- Finding
This shell script performs a file write when
--outputis provided, usingecho "$FINAL" > "$OUTPUT". Although it prints a message after writing, there is no pre-write warning, confirmation, or descriptive comment near the operation about overwriting user files, and the header only states that results are written to a file.- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md : "${CF_ACCOUNT_ID:?Set CF_ACCOUNT_ID}" : "${CF_CRAWL_API_TOKEN:?Set CF_CRAWL_API_TOKEN}" BASE="https://api.cloudflare.com/client/v4/accounts/${CF_ACCOUNT_ID}/browser-rendering/crawl" JOB_ID="${1:?Usage: poll.sh <job-id>}" shift RAW=false
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md : "${CF_ACCOUNT_ID:?Set CF_ACCOUNT_ID}" : "${CF_CRAWL_API_TOKEN:?Set CF_CRAWL_API_TOKEN}" BASE="https://api.cloudflare.com/client/v4/accounts/${CF_ACCOUNT_ID}/browser-rendering/crawl" JOB_ID="${1:?Usage: poll.sh <job-id>}" shift RAW=false
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md : "${CF_ACCOUNT_ID:?Set CF_ACCOUNT_ID}" : "${CF_CRAWL_API_TOKEN:?Set CF_CRAWL_API_TOKEN}" BASE="https://api.cloudflare.com/client/v4/accounts/${CF_ACCOUNT_ID}/browser-rendering/crawl" JOB_ID="${1:?Usage: poll.sh <job-id>}" shift RAW=false
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
sh : "${CF_ACCOUNT_ID:?Set CF_ACCOUNT_ID}" : "${CF_CRAWL_API_TOKEN:?Set CF_CRAWL_API_TOKEN}" BASE="https://api.cloudflare.com/client/v4/accounts/${CF_ACCOUNT_ID}/browser-rendering/crawl" JOB_ID="${1:?Usage: poll.sh <job-id>}" shift RAW=false
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
sh : "${CF_ACCOUNT_ID:?Set CF_ACCOUNT_ID}" : "${CF_CRAWL_API_TOKEN:?Set CF_CRAWL_API_TOKEN}" BASE="https://api.cloudflare.com/client/v4/accounts/${CF_ACCOUNT_ID}/browser-rendering/crawl" JOB_ID="${1:?Usage: poll.sh <job-id>}" shift RAW=false
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The documentation instructs users to store a token with read and edit privileges but does not warn about the sensitivity of that credential or recommend least-privilege handling. This can lead to unsafe storage, accidental disclosure, or unnecessary blast radius if the token is exposed.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The script sends a request to an external Cloudflare API using a bearer token sourced from the environment, but it provides no user-facing notice beyond terse usage comments. There is no confirmation, logging, or explicit warning in the file that job identifiers and retrieved crawl data will be transmitted to and fetched from a remote service.
- Content