ClawHub
Back to skill

Security audit

Cloudflare Dns

Security checks for vulnerabilities and agentic risk

Overview

This looks like a real Cloudflare DNS management skill, but it can change or delete live DNS records with an API token and lacks built-in confirmation or clear safety scoping.

Install only if you are comfortable letting the agent operate on Cloudflare DNS records. Use a Cloudflare token restricted to the needed zone and DNS permissions, keep the token out of logs and files, and require the agent to show the current record and exact planned change before any create, update, delete, or DDNS action.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (7)

Tool Parameter Abuse

High
Category
Tool Misuse
Content
local record_id="$2"
    
    local result
    result=$(cf_api DELETE "/zones/$zone_id/dns_records/$record_id")
    
    if echo "$result" | jq -e '.success' >/dev/null 2>&1; then
        info "Record deleted successfully"
Confidence
90% confidence
Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Lp3

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding
The skill documents and relies on shell-based operations but does not declare any tool scope, permissions, or allowed-tools metadata. That creates an authorization ambiguity where an agent may invoke shell capabilities more broadly than intended, increasing the chance of unsafe command execution in a DNS-management context.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The skill includes delete and update DNS operations without warning about service disruption, domain hijacking risk, or the need for explicit user confirmation. In practice, destructive DNS changes can break websites, email delivery, or redirect traffic, especially if an agent executes them without a safety checkpoint.

External Transmission

Medium
Category
Data Exfiltration
Content
set -euo pipefail

API_BASE="https://api.cloudflare.com/client/v4"

# Colors for output
RED='\033[0;31m'
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The delete command issues a Cloudflare DELETE request and only prints a success message after the record has already been removed. There is no confirmation prompt, dry-run notice, or prior user-facing warning in the script comments or usage text that this operation is destructive.

Missing User Warnings

Low
Confidence
89% confidence
Finding
The setup instructions tell users to export a Cloudflare API token but do not warn that the token is sensitive, should be minimally scoped, and must not be logged, committed, or exposed in shell history. Mishandling these credentials could allow unauthorized DNS modification across the associated zone.

Missing User Warnings

Low
Confidence
83% confidence
Finding
The script reads CF_API_TOKEN from the environment and sends it in an Authorization header for all API calls. Although the header use is technically necessary, the file does not include a warning or explanatory note that the skill will use the token to make authenticated external requests to Cloudflare.

Static analysis

No suspicious patterns detected.