Security audit

TryCloudflare Proxy Verify

Security checks across malware telemetry and agentic risk

Overview

This skill openly creates temporary public Cloudflare links to local content, but it lacks safeguards to prevent accidentally exposing private folders or local services.

Install only if you deliberately need temporary public links to local content. Use a dedicated export folder containing only the exact files to share, avoid exposing broad folders or authenticated localhost apps, do not share secrets or personal data, and stop the server and tunnel as soon as the link is no longer needed.

SkillSpector

By NVIDIA

Vulnerability Patterns

Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 84% confidence
Finding: The skill explicitly instructs the agent to run shell commands such as local HTTP servers, cloudflared tunnels, and curl verification, but it declares no corresponding permissions or guardrails. This creates a capability/permission mismatch where an agent may expose local content externally without an explicit authorization boundary or user-confirmation step.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The invocation guidance is broad enough to trigger on routine requests for sharing files, screenshots, artifacts, or local web pages, which can cause the agent to publish machine-local resources to the public internet by default. Because the scope is not narrowly limited to user-approved, low-sensitivity content, the skill may be invoked in contexts involving secrets, personal data, internal apps, or other sensitive local resources.

Missing User Warnings

High

Confidence: 96% confidence
Finding: The skill's core behavior is to expose local files, folders, screenshots, and localhost services through a public trycloudflare URL, yet it provides no privacy, data-classification, or least-exposure warnings. In this context, that omission is dangerous because localhost content often includes internal dashboards, tokens, private documents, screenshots with sensitive data, or development services not meant for public access.

Missing User Warnings

High

Confidence: 95% confidence
Finding: The script launches a public trycloudflare tunnel to a local HTTP server rooted at a user-supplied directory, making that directory remotely reachable from the internet. In this skill's context, that exposure is intentional, but it is still dangerous because it is unauthenticated, broad in scope, and performed without any explicit consent prompt, path restriction, or warning about directory listing and accidental overexposure.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The script prints and returns a publicly reachable URL for a path under the served directory without any visible disclosure or secondary confirmation that publication has occurred. Because the skill is specifically designed to share machine-local content externally, silent publication increases the chance of unintentionally exposing sensitive local artifacts or mis-scoped paths.

VirusTotal

61/61 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.