Cloudflare API

• Outcome: Review
• Latest audit: Sep 10, 2026 · 4:48 AM UTC
• Version: 1.0.0

Overview

This appears to be a legitimate Cloudflare management skill, but it can change live DNS/tunnel resources and handles sensitive tokens in ways users should review carefully.

Install only if you intend to let the agent manage Cloudflare DNS and tunnels. Use a narrowly scoped Cloudflare API token limited to the needed account and zones, avoid running token-printing commands in CI or transcript-recorded sessions, verify resource names and IDs before mutations, and treat tunnel run tokens as secrets.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/_lib.sh:58

Finding

Unencoded User Input Permits Cloudflare API Query-Parameter Injection

Content

View full analysis

Remediation

View remediation

&2 exit 1 } RETURNED_NAME=$(echo "$RECORDS" | jq -r '.result[0].name') RETURNED_TYPE=$(echo "$RECORDS" | jq -r '.result[0].type') [ "$RETURNED_NAME" = "$FULL_NAME" ] && [ "$RETURNED_TYPE" = "$TYPE" ] || { echo "API result does not exactly match the requested record" >&2 exit 1 } ``` 5. Prefer immutable resource IDs for destructive operations when practical, and display all verified identifying fields before requesting confirmation. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/_lib.sh:18

Finding

Cloudflare API and Tunnel Tokens Are Exposed Through Process Arguments and Standard Output

Content

View full analysis

&2 exit 1 fi if [ -n "$TUNNEL_TOKEN" ]; then echo "$TUNNEL_TOKEN" else # Token might be in credentials_file CREDS=$(echo "$TUNNELS" | jq -r '.result[0].credentials_file // empty') if [ -n "$CREDS" ] && [ "$CREDS" != "null" ]; then # Build token from credentials echo "$TUNNELS" | jq -r '.result[0].token // .result[0].id' ``` ```bash # SKILL.md:133-135 TOKEN=$(./scripts/tunnels/token.sh ...[truncated 2536 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (15)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill clearly instructs use of shell scripts that can modify DNS, create tunnels, and delete resources, but it does not declare any explicit tool scope or permissions boundary. That increases the chance an agent can invoke powerful shell capabilities without transparent guardrails, making accidental or unauthorized infrastructure changes more likely.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: cloudflare
description: Connect to Cloudflare API for DNS management, tunnels, and zone administration. Use when user needs to manage domains, DNS records, or create tunnels.
read_when:
  - User asks about Cloudflare DNS or domains
  - User wants to create or manage DNS records

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 34)May include surrounding context.

bash

# Option A: Store in file (recommended)
echo "YOUR_API_TOKEN" > ~/.cloudflare_token
chmod 600 ~/.cloudflare_token

# Option B: Environment variable
export CLOUDFLARE_API_TOKEN="YOUR_API_TOKEN"

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The documentation includes destructive operations such as deleting DNS records and tunnels, but it does not warn that these actions can break production traffic, disable services, or be difficult to recover quickly. In an agent context, omission of impact warnings increases the risk of unsafe execution from a casual user request.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · examples/config-snippet.json (reported line 5)May include surrounding context.

json

"_comment": "Store your Cloudflare API token",
  
  "_option_1": "Save to file (recommended):",
  "_command": "echo 'YOUR_TOKEN' > ~/.cloudflare_token && chmod 600 ~/.cloudflare_token",
  
  "_option_2": "Or set environment variable:",
  "_env": "export CLOUDFLARE_API_TOKEN='YOUR_TOKEN'",

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/setup.sh (reported line 16)May include surrounding context.

sh

"_comment": "Store your Cloudflare API token",
  
  "_option_1": "Save to file (recommended):",
  "_command": "echo 'YOUR_TOKEN' > ~/.cloudflare_token && chmod 600 ~/.cloudflare_token",
  
  "_option_2": "Or set environment variable:",
  "_env": "export CLOUDFLARE_API_TOKEN='YOUR_TOKEN'",

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/_lib.sh (reported line 4)May include surrounding context.

sh

#!/bin/bash
# Cloudflare API helper functions

CF_API="https://api.cloudflare.com/client/v4"

# Get API token
get_token() {

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This shell library reads sensitive credentials from the CLOUDFLARE_API_TOKEN environment variable or a local token file, then uses that token in outbound curl requests to the Cloudflare API. While the file has brief technical comments, it lacks any user-facing warning, confirmation, or disclosure about accessing credentials and sending authenticated network requests.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/_lib.sh (reported line 21)May include surrounding context.

sh

cf_get() {
    local endpoint="$1"
    local token=$(get_token)
    curl -s -H "Authorization: Bearer $token" "${CF_API}${endpoint}"
}

# API POST request

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This shell script modifies a live DNS record via an API call, which can affect service availability or traffic routing. Although it prints a status message, there is no confirmation prompt or stronger user-facing warning immediately before performing the update.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · scripts/dns/delete.sh (reported line 25)May include surrounding context.

sh

echo "Usage: tunnels/delete.sh <tunnel-name> [options]"
            echo ""
            echo "Options:"
            echo "  --force, -f  Skip confirmation"
            exit 0
            ;;
        *)

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · scripts/tunnels/delete.sh (reported line 17)May include surrounding context.

sh

echo "Usage: tunnels/delete.sh <tunnel-name> [options]"
            echo ""
            echo "Options:"
            echo "  --force, -f  Skip confirmation"
            exit 0
            ;;
        *)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The script retrieves a Cloudflare tunnel run token and prints it directly to stdout, which can expose a sensitive credential through terminal history, shell logs, CI logs, or calling-agent transcripts. In this skill context, the token grants the ability to run or impersonate a tunnel, so exposing it is materially risky even if the script's operational purpose is legitimate.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The setup section tells users to store a Cloudflare API token locally or export it in the environment, but it does not explicitly identify the token as a highly sensitive credential with account-changing power. That can lead to poor handling, accidental exposure in shell history, logs, screenshots, backups, or multi-user systems.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

The script calls get_token and get_account_id and then uses those values to create a remote Cloudflare tunnel via cf_post. While the script prints that it is creating a tunnel, it does not explicitly disclose that it will access stored API credentials and make an authenticated network request to the Cloudflare API.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.