ClawHub
Back to skill

Security audit

cftunnel

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it says, but it gives an agent high-impact Cloudflare and host networking powers without enough scoping around public exposure, dependency trust, destructive changes, and persistence.

Install only if you are comfortable giving the tool Cloudflare authority to create, modify, and delete tunnel and DNS resources. Use a narrowly scoped API token instead of a global key, pin and review the cftunnel package version before running it, avoid exposing SSH/databases/Unix sockets unless protected by Cloudflare Access or equivalent controls, and do not use `--install-service` unless you intentionally want a reboot-persistent connector and know how to remove it.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (3)

T06 · System Persistence

Error
Location
SKILL.md:120
Finding

Persistent Cloudflare Connector Service Installation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:120
Vulnerability Type: Persistent system-service installation
Risk Level: High

Vulnerable Code:

markdown
| `npx cftunnel run <tunnel-id> --install-service` | Install cloudflared as a persistent system service (survives reboots). |

Technical Analysis

The skill explicitly instructs the agent to install cloudflared as a system service that survives reboots. This changes persistent operating-system state and extends execution beyond the lifetime of the initiating agent session.

A persistent tunnel connector may continue forwarding public traffic to configured local services without continued agent supervision. The documentation does not require explicit user confirmation, least-privileged service credentials, route expiration, or automatic removal of the installed service.

Attack Path

  1. An agent configures a Cloudflare tunnel and one or more ingress routes.
  2. The agent invokes npx cftunnel run <tunnel-id> --install-service.
  3. cloudflared is registered as a persistent operating-system service.
  4. The service starts independently of the original agent session and may restart after reboot.
  5. Configured local services remain reachable through the tunnel until the service and routes are explicitly removed.

Impact Assessment

Successful use creates a cross-session network service on the host. The connector can preserve external access to local applications after the original task has ended and after system restarts.

The precise operating-system privileges depend on how the command is executed and how cloudflared performs service installation. The resulting exposure includes every local service configured in the tunnel's ingress rules. Compromise of the tunnel credentials, Cloudflare account, or exposed backend could extend the impact to unauthorized remote access.

Remediation
View remediation

Remediation Suggestions

  • Remove the persistent --install-service workflow from the skill.
  • Run the connector in the foreground so its lifetime is bounded by the initiating session.
  • Require explicit, informed user approval before making persistent operating-system changes.
  • If persistence is operationally necessary, use a dedicated unprivileged service account and a narrowly scoped Cloudflare API token.
  • Add documented teardown procedures that stop, disable, and uninstall the service and remove associated ingress and DNS records.
  • Implement route expiration and periodic review of active connectors.
  • Require confirmation of the exact hostnames and local services that will remain accessible after reboot.

T08 · Insecure Dependencies

Error
Location
SKILL.md:16
Finding

Unpinned npm Package Installation and Dynamic Execution

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:16-19
Vulnerability Type: Unpinned third-party executable dependency
Risk Level: High

Vulnerable Code:

yaml
install:
  - kind: node
    package: cftunnel -g
    bins: [cftunnel]

The skill also repeatedly instructs the agent to execute the package through commands such as:

bash
npx cftunnel tunnel list
npx cftunnel quickstart
npx cftunnel run <tunnel-id>

Technical Analysis

The package specification does not pin cftunnel to an audited version and provides no integrity hash or lockfile. Global npm installation therefore resolves package content from the package registry at installation time.

The repeated use of npx cftunnel can also retrieve and execute package code dynamically when the executable is unavailable locally. Consequently, the code executed by the agent may differ from the code reviewed when the skill was published.

npm package installation and CLI execution can run package-controlled JavaScript. Because the skill requires Cloudflare credentials in environment variables, executed dependency code may be able to read those credentials in addition to accessing files and network resources available to the agent process.

Attack Path

  1. An attacker compromises the upstream npm package, maintainer account, publication process, or a future package release.
  2. The agent globally installs cftunnel without an exact version, or npx resolves the package dynamically.
  3. npm downloads the attacker-controlled package version.
  4. Package lifecycle scripts or CLI code execute with the agent process's privileges.
  5. The code can access Cloudflare environment credentials, manipulate tunnel or DNS configuration, read accessible local data, or modify the host within the process's permission boundary.

Impact Assessment

Exploitation could provide arbitrary code execution with the same operating-system pri ...[truncated 442 chars]

Remediation
View remediation

Remediation Suggestions

  • Pin the package to a specific, audited version, such as cftunnel@X.Y.Z.
  • Use a lockfile and verify the registry-provided integrity digest.
  • Avoid global package installation and execute dependencies from a controlled project environment.
  • Avoid runtime package resolution through unqualified npx commands.
  • Use npx --no-install after installing and verifying the dependency through a controlled process.
  • Disable npm lifecycle scripts where compatible with the package and deployment model.
  • Review the package source, publication provenance, maintainers, and transitive dependency tree.
  • Run the package in an isolated, least-privileged environment with narrowly scoped Cloudflare API tokens.
  • Do not expose unrelated credentials or sensitive environment variables to the package process.

T05 · Unauthorized Access and Privilege Escalation

Error
Location
SKILL.md:136
Finding

Unrestricted Public Exposure of Sensitive Local Services

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:136-145
Vulnerability Type: Unsafe exposure of sensitive network services and local sockets
Risk Level: High

Vulnerable Code:

markdown
| Format | Example | Use case |
|---|---|---|
| `http://host:port` | `http://localhost:3000` | HTTP web apps, APIs |
| `https://host:port` | `https://localhost:8443` | HTTPS backends |
| `tcp://host:port` | `tcp://localhost:5432` | Databases, raw TCP |
| `ssh://host:port` | `ssh://localhost:22` | SSH access |
| `unix:///path` | `unix:///tmp/app.sock` | Unix socket apps |
| `http_status:CODE` | `http_status:404` | Static status response (catch-all) |

Technical Analysis

The skill supports creating externally reachable routes to databases, raw TCP services, SSH, and Unix-domain sockets. It does not require Cloudflare Access policies, mutual TLS, source restrictions, service allowlists, or explicit confirmation before exposing these sensitive targets.

A tunnel bypasses the need for an inbound firewall port by creating an outbound connector to Cloudflare. Therefore, a service that was previously reachable only from localhost may become remotely accessible through the configured hostname. The backend's own authentication remains relevant, but localhost-only deployment assumptions may no longer be valid.

Unix sockets are particularly sensitive because they can represent privileged administrative APIs rather than ordinary network applications. The actual impact depends on the selected socket and the permissions of the cloudflared process.

Attack Path

  1. The agent selects a sensitive destination such as tcp://localhost:5432, ssh://localhost:22, or a local Unix socket.
  2. The agent creates a tunnel ingress route pointing to that destination.
  3. The agent creates the corresponding public Cloudflare DNS record.
  4. The agent starts the cloudflared connector.
  5. Remote traffic reaches the previously ...[truncated 868 chars]
Remediation
View remediation

Remediation Suggestions

  • Default-deny SSH, database, raw TCP, and Unix-socket targets.
  • Require explicit user confirmation that identifies the exact hostname, protocol, port, and local destination.
  • Require Cloudflare Access, mutual TLS, or another strong identity-aware access control before creating sensitive routes.
  • Restrict access by identity and source where supported.
  • Validate service destinations against an approved allowlist.
  • Block known privileged sockets, container-engine sockets, and system administration APIs.
  • Use dedicated service accounts and narrowly scoped backend credentials.
  • Add route expiration, audit logging, and an automatic teardown mechanism.
  • Verify backend authentication and authorization rather than relying on localhost-only accessibility.
  • Present a high-risk warning before exposing SSH, databases, or local sockets.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (35)

Rp1

Medium
Category
MCP Rug Pull
Confidence
96% confidence
Finding

The manifest/install metadata references cftunnel without an exact version pin, which means installation may pull whichever release is current when the skill is installed. That undermines reproducibility and introduces a supply-chain path to arbitrary code execution before any operational command is run.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
96% confidence
Finding

The skill repeatedly instructs use of npx cftunnel without pinning an exact package version, which causes execution of whatever package version is current at runtime. That creates a supply-chain risk: a compromised maintainer account, malicious new release, or typo/package takeover could cause arbitrary code execution in the agent environment with access to Cloudflare credentials.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill explains how to expose local services publicly but does not foreground a strong warning that this can make sensitive localhost-only endpoints reachable from the internet. In an agent setting, that omission materially increases the chance of unsafe use, such as publishing admin dashboards, databases, or SSH unintentionally.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
96% confidence
Finding

Using unpinned npx cftunnel at execution time allows arbitrary package updates to change the code being run without review. In this skill, that risk is amplified because the tool is given Cloudflare API credentials and can expose local services to the internet.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
96% confidence
Finding

An unversioned npx package reference means the executed package is not stable or auditable over time. A malicious or compromised release could run attacker-controlled code and misuse the exported Cloudflare secrets present in the environment.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
96% confidence
Finding

This quickstart command executes an unpinned npm package that can change between runs, creating a direct remote code execution and supply-chain exposure. Because the command performs infrastructure changes and consumes privileged environment variables, the blast radius includes DNS, tunnels, and public exposure of internal services.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
94% confidence
Finding

Running npx cftunnel run without a version pin makes the runtime behavior dependent on the latest package state in the registry. If that package is compromised, it could install persistence, steal API tokens, or alter tunnel behavior silently.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

The unpinned tunnel listing command still executes third-party code from npm and therefore carries the same supply-chain risk as state-changing commands. Even read-oriented commands can exfiltrate credentials or system information once executed.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

This example executes an unpinned package to create infrastructure resources, allowing registry-side changes to introduce unreviewed code. Given the authenticated Cloudflare context, a malicious package could create hidden routes or leak tunnel secrets.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

Although this command retrieves tunnel details, it still runs unpinned third-party code with privileged environment variables. That creates a real supply-chain avenue for code execution and secret theft even when the functional purpose is informational.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

Deleting tunnels through an unpinned npx command combines supply-chain risk with destructive capability. A compromised package could delete additional resources, modify routes, or perform unrelated malicious actions under the same credentials.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The documentation includes destructive tunnel and DNS operations without warning about service disruption, record loss, and the need for confirmation. In practice, this can lead agents or users to remove active internet-facing infrastructure or break production routing without understanding the impact.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

Fetching a tunnel token via an unpinned package risks exposing the very credential needed to run the tunnel. A malicious release could capture and exfiltrate that token along with other environment secrets.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

This route-list command still executes registry-resolved code without version control, so the trust boundary is the npm registry rather than the skill author's reviewed content. In an agent environment, that is sufficient for arbitrary code execution and data exfiltration.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
96% confidence
Finding

Adding routes using an unpinned package can let a malicious release create unexpected ingress mappings or alter traffic destinations. Because the skill is specifically about publishing local services externally, misuse can expose sensitive internal endpoints to the public internet.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

Even though the documented action is route removal, the core problem is arbitrary third-party code execution from an unpinned npm package. The command also has the ability to alter internet-facing access paths, increasing operational and security impact.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
96% confidence
Finding

route set is especially sensitive because it replaces all routes, and doing so through an unpinned package gives a compromised release broad control over exposed services. This can be abused to redirect traffic, publish unintended backends, or deny service.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
96% confidence
Finding

Creating DNS records with an unpinned npx package allows unreviewed code to run while holding credentials capable of changing public DNS. A malicious version could create hidden subdomains, repoint traffic, or harvest account secrets.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

Listing DNS records is lower impact functionally, but the supply-chain issue remains because the package is not pinned. The command can still execute arbitrary code and read environment variables or network-accessible metadata.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
96% confidence
Finding

Deleting DNS through an unpinned package combines destructive infrastructure control with supply-chain exposure. This can cause outage, traffic hijacking, or broader account abuse if the invoked package is malicious.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
96% confidence
Finding

Running the connector via unpinned npx gives latest-package code execution on a host that may maintain a long-lived public tunnel. A compromised release could persist, intercept traffic, or expose unintended services.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill documents installation of cloudflared as a persistent system service without clearly warning that this creates host-level persistence that survives reboots. In adversarial or loosely supervised agent contexts, that can leave long-lived public access paths and unauthorized background services on the host.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
97% confidence
Finding

This command combines unpinned third-party code execution with installation of a persistent system service, allowing a malicious package to establish reboot-surviving persistence and long-term external access. In a privileged environment, the impact can extend to host compromise and covert exposure of internal services.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

Even the documented manual recovery path uses unpinned npx, so the same remote package trust issue applies. Because this skill's context centers on public exposure and infrastructure changes, compromise would have immediate network-facing consequences.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
96% confidence
Finding

The example that starts a new public web app relies on an unpinned package to perform the publication step. That makes it possible for a malicious release to tamper with the local process, the Cloudflare account, or the exposed routing during deployment.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.