ClawHub
Back to skill

Security audit

Cloudflare Developer Skill

Security checks for vulnerabilities and agentic risk

Overview

This is a documentation-only Cloudflare development skill with expected deployment examples, but users should review commands before running them against a real account.

Install is reasonable if you want Cloudflare development guidance. Before running any `wrangler deploy`, `create`, or `migrations apply` command from the skill, confirm you are in the intended Cloudflare account and environment, preferably test first, and understand that those commands can create or modify live resources.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The README includes direct deployment and resource-creation commands such as `wrangler deploy`, `wrangler d1 create`, and `wrangler r2 bucket create` without any warning that they modify live Cloudflare infrastructure, may incur cost, or should be run only after review. In an agent-skill context, concise operational snippets can be copied or surfaced automatically, increasing the chance that a user or agent executes them against production by mistake.

Static analysis

No suspicious patterns detected.