T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
SKILL.md:19- Finding
Overbroad access to persistent memory for plaintext API credentials
- Content
View full analysis
- Remediation
View remediation
Security audit
cloudflare-media
Security checks for vulnerabilities and agentic risk
Overview
This skill appears to do what it says, but it asks for broad local authority and reads credentials from general agent memory before sending user content to Cloudflare.
Review before installing. Use only a narrowly scoped Cloudflare Workers AI token, avoid storing it in MEMORY.md, and do not submit sensitive prompts, private images, or confidential text unless you are comfortable sending them to Cloudflare. The publisher should narrow the allowed tools and add an explicit confirmation or disclosure step before external requests.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (17)
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger phrases include broad everyday language such as '帮我画' and '读出来', which can cause accidental activation in ordinary conversation. In this skill, accidental activation matters because it may lead to credential lookup and external transmission of user content to Cloudflare without clear intent.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill requests Exec even though its documented purpose is only to call remote media-generation APIs and return images/audio. Unnecessary command-execution capability increases the blast radius if the skill is misused or prompt-injected, enabling shell access unrelated to its function.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill does not clearly warn users that prompts, text, optional images, and authentication tokens will be used in requests to an external Cloudflare service. This undermines informed consent and can result in unexpected disclosure of sensitive user content to a third party.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
| steps | ❌ | — | 步数（参考值25）|
bash curl -X POST "https://api.cloudflare.com/client/v4/accounts/{ACCOUNT}/ai/run/@cf/black-forest-labs/flux-2-klein-4b" \ -H "Authorization: Bearer {TOKEN}" \ -F "prompt=a sunset over the ocean" \ -F "width=1024" -F "height=1024"
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 90% confidence
- Finding
This skill sends user-supplied prompts and bearer-authenticated requests to Cloudflare's external API, which is an intentional but security-relevant data egress path. In context this is expected functionality, yet it remains a real exposure because prompts or generated-content parameters may contain sensitive data and the transfer is not transparently disclosed at point of use.
- Content
| steps | ❌ | 4 | 步数（1~8，越高越慢）|
bash curl -X POST "https://api.cloudflare.com/client/v4/accounts/{ACCOUNT}/ai/run/@cf/black-forest-labs/flux-1-schnell" \ -H "Authorization: Bearer {TOKEN}" \ -H "Content-Type: application/json" \ -d '{"prompt":"a cyberpunk cat","steps":4}'
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 90% confidence
- Finding
This skill sends user-supplied prompts and bearer-authenticated requests to Cloudflare's external API, which is an intentional but security-relevant data egress path. In context this is expected functionality, yet it remains a real exposure because prompts or generated-content parameters may contain sensitive data and the transfer is not transparently disclosed at point of use.
- Content
| steps | ❌ | 4 | 步数（1~8，越高越慢）|
bash curl -X POST "https://api.cloudflare.com/client/v4/accounts/{ACCOUNT}/ai/run/@cf/black-forest-labs/flux-1-schnell" \ -H "Authorization: Bearer {TOKEN}" \ -H "Content-Type: application/json" \ -d '{"prompt":"a cyberpunk cat","steps":4}'
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 90% confidence
- Finding
The SDXL-Lightning flow transmits prompts and potentially img2img or mask data to an external provider through Cloudflare. Because image and mask inputs can contain sensitive visual data, this egress path is materially security-relevant even though it is core to the feature.
- Content
| mask / mask_b64 | ❌ | — | inpainting mask |
bash curl -X POST "https://api.cloudflare.com/client/v4/accounts/{ACCOUNT}/ai/run/@cf/bytedance/stable-diffusion-xl-lightning" \ -H "Authorization: Bearer {TOKEN}" \ -H "Content-Type: application/json" \ -d '{"prompt":"a cyberpunk cat","num_steps":10}'
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 90% confidence
- Finding
The SDXL-Lightning flow transmits prompts and potentially img2img or mask data to an external provider through Cloudflare. Because image and mask inputs can contain sensitive visual data, this egress path is materially security-relevant even though it is core to the feature.
- Content
| mask / mask_b64 | ❌ | — | inpainting mask |
bash curl -X POST "https://api.cloudflare.com/client/v4/accounts/{ACCOUNT}/ai/run/@cf/bytedance/stable-diffusion-xl-lightning" \ -H "Authorization: Bearer {TOKEN}" \ -H "Content-Type: application/json" \ -d '{"prompt":"a cyberpunk cat","num_steps":10}'
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 90% confidence
- Finding
The DreamShaper flow also sends user prompts and optional image/mask material to Cloudflare's API, creating a third-party disclosure path. Given the skill's broad triggers and memory-based credential lookup, accidental or unintended egress becomes more plausible in context.
- Content
| mask / mask_b64 | ❌ | — | inpainting mask |
bash curl -X POST "https://api.cloudflare.com/client/v4/accounts/{ACCOUNT}/ai/run/@cf/lykon/dreamshaper-8-lcm" \ -H "Authorization: Bearer {TOKEN}" \ -H "Content-Type: application/json" \ -d '{"prompt":"a realistic photo of a cat","num_steps":8}'
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 90% confidence
- Finding
The DreamShaper flow also sends user prompts and optional image/mask material to Cloudflare's API, creating a third-party disclosure path. Given the skill's broad triggers and memory-based credential lookup, accidental or unintended egress becomes more plausible in context.
- Content
| mask / mask_b64 | ❌ | — | inpainting mask |
bash curl -X POST "https://api.cloudflare.com/client/v4/accounts/{ACCOUNT}/ai/run/@cf/lykon/dreamshaper-8-lcm" \ -H "Authorization: Bearer {TOKEN}" \ -H "Content-Type: application/json" \ -d '{"prompt":"a realistic photo of a cat","num_steps":8}'
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 89% confidence
- Finding
The TTS flow transmits arbitrary user text to an external API, which may include private, regulated, or proprietary content if users ask the agent to read sensitive material aloud. This is expected behavior for TTS, but without explicit disclosure and consent it remains a genuine confidentiality concern.
- Content
| bit_rate | ❌ | — | 比特率（bps）|
bash curl -X POST "https://api.cloudflare.com/client/v4/accounts/{ACCOUNT}/ai/run/@cf/deepgram/aura-2-en" \ -H "Authorization: Bearer {TOKEN}" \ -H "Content-Type: application/json" \ -d '{"text":"Hello world","speaker":"luna"}'
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 89% confidence
- Finding
The TTS flow transmits arbitrary user text to an external API, which may include private, regulated, or proprietary content if users ask the agent to read sensitive material aloud. This is expected behavior for TTS, but without explicit disclosure and consent it remains a genuine confidentiality concern.
- Content
| bit_rate | ❌ | — | 比特率（bps）|
bash curl -X POST "https://api.cloudflare.com/client/v4/accounts/{ACCOUNT}/ai/run/@cf/deepgram/aura-2-en" \ -H "Authorization: Bearer {TOKEN}" \ -H "Content-Type: application/json" \ -d '{"text":"Hello world","speaker":"luna"}'
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 89% confidence
- Finding
The MeloTTS endpoint similarly sends user text off-platform to Cloudflare, creating external data exposure. Since the skill is designed for convenience and broad activation, users may not realize their text leaves the local environment for synthesis.
- Content
| lang | ❌ | en | 语言：en/es/fr/zh/ja/ko |
bash curl -X POST "https://api.cloudflare.com/client/v4/accounts/{ACCOUNT}/ai/run/@cf/myshell-ai/melotts" \ -H "Authorization: Bearer {TOKEN}" \ -H "Content-Type: application/json" \ -d '{"prompt":"Hello world","lang":"en"}'
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 89% confidence
- Finding
The MeloTTS endpoint similarly sends user text off-platform to Cloudflare, creating external data exposure. Since the skill is designed for convenience and broad activation, users may not realize their text leaves the local environment for synthesis.
- Content
| lang | ❌ | en | 语言：en/es/fr/zh/ja/ko |
bash curl -X POST "https://api.cloudflare.com/client/v4/accounts/{ACCOUNT}/ai/run/@cf/myshell-ai/melotts" \ -H "Authorization: Bearer {TOKEN}" \ -H "Content-Type: application/json" \ -d '{"prompt":"Hello world","lang":"en"}'
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
L276-L289 的 TTS 交互流程将“Deepgram Aura-2 英语”设为默认模型 1，并要求用户仅提供模型编号、文本和声音，未明确先询问用户语言偏好。对于文本转语音场景，默认落到英语模型可能导致在未经用户选择的情况下强制使用特定语言/locale。
- Content
Context-Inappropriate Capability
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
Write and Edit permissions are broader than necessary for a skill whose purpose is generating media via Cloudflare APIs. Excess file-modification privileges could be abused to alter unrelated workspace files, plant data, or overwrite outputs outside the intended media flow.
- Content
Context-Inappropriate Capability
Low
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill explicitly instructs reading MEMORY.md for credentials, which expands access beyond the minimum needed for media generation and can expose unrelated secrets stored in shared memory. Because MEMORY.md often contains broader agent context or other service tokens, this creates an avoidable secret-scoping and over-collection risk.
- Content