T09 · Insecure Skill Coding Practices
Warning
- Location
WORKFLOW.md:22- Finding
Insufficiently protected local credential materialization and persistent secret-manager access
- Content
View full analysis
- Remediation
View remediation
Security audit
Cloudflare Open WebUI Tunnel Operator
Security checks for vulnerabilities and agentic risk
Overview
The skill is coherent for setting up a Cloudflare tunnel, but it asks users to handle persistent credentials and account changes without enough safety controls.
Review this skill before installing. Use a narrowly scoped Cloudflare API token and a dedicated 1Password service account, avoid broad vault write access, store any runtime env file with owner-only permissions outside source control and backups, rotate/delete tokens when no longer needed, and require confirmation before DNS, tunnel, systemd, or 1Password changes.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T05 · Unauthorized Access and Privilege Escalation
Note
- Location
WORKFLOW.md:28- Finding
Unnecessary write access to the 1Password credential item
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill explicitly instructs operators to write the runtime Cloudflare tunnel token to a local environment file, but it does not require secure storage controls, restrictive file permissions, lifecycle limits, or cleanup guidance. A locally persisted tunnel token can be exposed through backups, shell access, logs, accidental commits, or weak filesystem permissions, enabling unauthorized tunnel use or service impersonation.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The workflow explicitly instructs fetching a tunnel runtime token and writing it to a local env file, but it provides no warning or controls around file permissions, storage location, rotation, cleanup, or exclusion from logs and version control. In a skill specifically handling infrastructure access and secrets, this omission creates a realistic credential exposure path if the env file is world-readable, persisted unnecessarily, or accidentally committed.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 74% confidence
- Finding
The packaging rule says that if the audience is mixed, the docs must be bilingual. This is a natural-language locale policy constraint rather than an offered choice, and no opt-in mechanism or justification is provided in the file.
- Content