Cloudflare Wrangler & Pages

• Analyzed: May 16, 2026, 5:41 AM
• Findings: 1
• Version: 1.1.0
• Hash: 67657c170a04a3f8af76c786dd3f74efa419f92f2a78c6d280e6bf81867ae2c8
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle contains a hardcoded 'CLOUDFLARE_ACCOUNT_ID' (b4c7ead049e93e5c5d1c4f4415864c8a) in the SKILL.md file, which an AI agent is instructed to use for Pages deployments. While this ID is a common placeholder in official Cloudflare documentation, hardcoding it in instructions for an automated agent is a significant configuration flaw that could lead to failed operations or attempts to deploy data to an incorrect account. The skill also includes scripts for managing secrets and setting data deletion policies (R2 lifecycle rules), which are functional but increase the risk profile if the agent follows the hardcoded account instructions literally.