ClawHub
Back to skill

Security audit

Cloudflare

Security checks for vulnerabilities and agentic risk

Overview

This Cloudflare management skill is transparent and purpose-aligned, but it can change live Cloudflare configuration so users should use a least-privilege token and confirm destructive actions.

Install only if you intend to let the agent manage Cloudflare. Create a narrowly scoped Cloudflare API token for the specific account/zones and permissions needed, avoid broad account-wide edit tokens, and require explicit confirmation before delete, import, SSL/settings, tunnel, or full cache-purge commands.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/cf.sh:13
Finding

Cloudflare API Token Exposed Through Process Arguments

Content
View full analysis
`. 3. An attacker with sufficient local process-inspection access monitors running processes or obtains command-line telemetry collected by system monitoring software. 4. The attacker captures the `curl` argument while the API request is in progress and extracts the bearer token. 5. The attacker submits requests directly to the Cloudflare API using the stolen token. 6. Successful actions are limited by the token's configured Cloudflare scopes and resource restrictions. ### Impact Assessment A stolen token grants access to every Cloudflare API capability authorized by that token. Depending on ...[truncated 606 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (14)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 9)May include surrounding context.

md
Manage Cloudflare zones, DNS, SSL, tunnels, and settings via the bundled `scripts/cf.sh` bash script.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 17)May include surrounding context.

md
Manage Cloudflare zones, DNS, SSL, tunnels, and settings via the bundled `scripts/cf.sh` bash script.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 19)May include surrounding context.

md
Manage Cloudflare zones, DNS, SSL, tunnels, and settings via the bundled `scripts/cf.sh` bash script.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 23)May include surrounding context.

md
Manage Cloudflare zones, DNS, SSL, tunnels, and settings via the bundled `scripts/cf.sh` bash script.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding

The skill exposes shell-based operational capabilities via a bundled bash script, but it does not declare an explicit tool scope such as permissions or allowed-tools. That increases the risk that an agent runtime may grant broader execution authority than intended, especially for commands that can modify DNS, SSL, firewall, cache, and tunnel configuration in a live Cloudflare account using a privileged API token.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/cf.sh (reported line 10)May include surrounding context.

sh
set -euo pipefail

CF_API="https://api.cloudflare.com/client/v4"
TOKEN="${CLOUDFLARE_API_TOKEN:?Set CLOUDFLARE_API_TOKEN}"

# --- helpers ---

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/cf.sh (reported line 16)May include surrounding context.

sh
# --- helpers ---

_curl() {
  curl -sS -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" "$@"
}

_get()    { _curl "$CF_API$1"; }

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The script exposes a command that deletes DNS records via the Cloudflare API, but the function performs the irreversible action immediately without any confirmation prompt or warning message. Although the help text names the command, there is no explicit disclosure at the point of execution that this operation is destructive.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

This command reads records from a local file and creates DNS records remotely in a loop, which can materially alter a zone's configuration. The function only reports the import count afterward and does not warn the user beforehand about the scope of the write operation or validate intent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The function updates arbitrary Cloudflare zone settings over the network, potentially affecting availability, security, or traffic handling, but it executes silently. There is no confirmation prompt, cautionary message, or inline warning describing the impact of modifying production settings.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

Changing SSL mode can affect site reachability and security posture, but the command delegates directly to the setting update without any user-facing caution. The help text lists accepted values, yet it does not warn that this change impacts live traffic handling.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

When invoked without URLs, this command sends purge_everything=true, which can invalidate all cached content for a zone. The code performs this action immediately and provides no confirmation or warning that omitting URLs triggers a full purge.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The function deletes a Cloudflare tunnel through the API without any confirmation prompt or user-facing warning. Because deletion is destructive and may disrupt service connectivity, the current implementation does not provide sufficient disclosure at execution time.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
81% confidence
Finding

This is a markdown file, so SQP-2 applies to omissions in user-facing warnings. The guide instructs users to create and use Cloudflare API tokens with edit-capable scopes, but it does not warn that these tokens are sensitive credentials that should not be exposed, shared, or stored insecurely.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.