Cloudflare Api Shield

• Outcome: Review
• Latest audit: May 29, 2026 at 9:36 PM UTC
• Version:
  1.0.2

Overview

This looks like a legitimate Cloudflare API Shield integration, but it gives broad authenticated Cloudflare API access without enough guardrails for write or delete actions.

Review before installing. Use this only if you are comfortable granting Membrane delegated access to your Cloudflare API Shield environment. Prefer least-privilege Cloudflare permissions, use read-only discovery first, require explicit confirmation before any POST, PUT, PATCH, or DELETE request, and revoke the Membrane connection when finished.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The skill documents how to run arbitrary actions and direct proxy requests, including state-changing HTTP methods, without requiring user confirmation, scoping guidance, or safety checks for destructive operations. In an agent setting, this can enable unintended modification or deletion of Cloudflare configuration if the model acts on ambiguous prompts or chooses raw requests over safer constrained actions.

VirusTotal

65/65 vendors flagged this skill as clean.