Cloudflare Tunnel Manager

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:36 AM UTC
• Version: 1.0.0

Overview

The skill matches its Cloudflare Tunnel purpose, but its examples can create long-lived public exposure and install persistent tunnel services without enough safeguards.

Review this skill carefully before installing or using it. Run tunnels interactively first, require Cloudflare Access and application authentication before exposing admin, API, SSH, or development services, avoid noTLSVerify except for tightly controlled local testing, verify or package-install cloudflared rather than using an unpinned latest binary, and secure any ~/.cloudflared credential backups. Do not enable the systemd or LaunchAgent persistence examples until you have a rollback plan and have validated every ingress route.

A.I.G

Vulnerability Patterns

• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (4)

T06 · System Persistence

Warning

• Location: SKILL.md:250

Finding

<![CDATA[Persistent Cloudflare Tunnel Services Are Enabled Across Sessions]]>

Content

View full analysis

... RunAtLoad KeepAlive ... ``` ```bash # Load and start LaunchAgent launchctl load ~/Library/LaunchAgents/com.cloudflare.tunnel.plist launchctl start com.cloudflare.tunnel ``` ``` ### Technical Analysis The instructions register Cloudflare Tunnel as a persistent service: - On Linux, `systemctl enable` configures a system-level service to start automatically at boot. Creating the unit under `/etc/systemd/system` and enabling it require root privileges. - On macOS, `RunAtLoad` and `KeepAlive` cause the tunnel to start with the user session and be restarted after termination. - `Restart=always` on Linux similarly causes continuous restart behavior. Persistence is related to the declared functionality of operating a production tunnel, and the examples are explicit rather than covert. The Linux unit also mitigates privilege exposure by running the process as `User=cloudflared`. Nevertheless, automatic startup is not required merely to create, configure, test, or interactively run a tunnel. It therefore exceeds the minimum privileges and lifetime needed for basic skill operation and should only be an explicit, informed deployment choice. A persistent tunnel materially ...[truncated 1783 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:24

Finding

<![CDATA[Unpinned Cloudflared Binary Is Downloaded and Installed into a Privileged Executable Path]]>

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Note

• Location: SKILL.md:168

Finding

<![CDATA[Example Disables TLS Certificate Verification for Origin Connections]]>

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Note

• Location: SKILL.md:382

Finding

<![CDATA[Tunnel Credential Files Are Copied Without Backup-Specific Protection Guidance]]>

Content

View full analysis

~/backup/tunnel-list.txt ``` ``` ### Technical Analysis Cloudflared tunnel JSON files contain tunnel-scoped credentials used by connectors to authenticate and run a tunnel. The instructions copy these sensitive files into a generic backup directory without requiring encryption, checking directory ownership and permissions, or defining secure retention. A local `cp` commonly preserves the source file's permission bits subject to platform behavior and options, so this snippet does not prove that the copied files become world-readable. The confirmed weakness is that the procedure provides no assurance that the destination directory and resulting files remain private. The risk is therefore conditional and lower than direct secret disclosure. The later migration example uses `scp`, which protects credentials in transit through SSH, but endpoint storage still needs restrictive permissions. ### Attack Path 1. The user creates or uses `~/backup` with permissions that allow another local account, backup agent, synchronization service, or unintended application to read its contents. 2. The user follows the instructions and copies tunnel credential JSON files into that directory. 3. The directory is indexed, synchronized, archived without encryption, or read by an unauthorized local principal. 4. The attacker obtains a tunnel credential file. 5. The attacker uses the credential to run a connector for the associated tunnel or otherwise interfere with tunnel routing and availability, subject to Cloudflare's controls and the credential's scope. ### Impact Assessment Exposur ...[truncated 568 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (16)

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: cloudflare-tunnel
description: Create and manage secure Cloudflare Tunnels using cloudflared. Expose local services to the internet safely, configure DNS routing, set up zero-trust access controls, and manage tunnel authentication without opening firewall ports.
---

# Cloudflare Tunnel

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill’s core purpose is to expose local services to the internet, and it also includes noTLSVerify: true examples without strong warnings or compensating controls. This can lead users to publish sensitive internal apps or accept insecure upstream TLS, increasing risk of unauthorized access or man-in-the-middle attacks if copied into production.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 29)May include surrounding context.

Download latest release

wget https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-linux-amd64 chmod +x cloudflared-linux-amd64 sudo mv cloudflared-linux-amd64 /usr/local/bin/cloudflared

text

### Windows

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 272)May include surrounding context.

Download latest release

wget https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-linux-amd64 chmod +x cloudflared-linux-amd64 sudo mv cloudflared-linux-amd64 /usr/local/bin/cloudflared

text

### Windows

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 273)May include surrounding context.

Download latest release

wget https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-linux-amd64 chmod +x cloudflared-linux-amd64 sudo mv cloudflared-linux-amd64 /usr/local/bin/cloudflared

text

### Windows

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 274)May include surrounding context.

Download latest release

wget https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-linux-amd64 chmod +x cloudflared-linux-amd64 sudo mv cloudflared-linux-amd64 /usr/local/bin/cloudflared

text

### Windows

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 247)May include surrounding context.

Use service token in requests

curl -H "CF-Access-Client-Id: TOKEN_ID"
-H "CF-Access-Client-Secret: TOKEN_SECRET"
https://api.yourdomain.com/data

text

### System Service Setup

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 80% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 272)May include surrounding context.

bash

# Enable and start service
sudo systemctl enable cloudflared-tunnel
sudo systemctl start cloudflared-tunnel
sudo systemctl status cloudflared-tunnel

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 279)May include surrounding context.

macOS LaunchAgent:

xml

<!-- ~/Library/LaunchAgents/com.cloudflare.tunnel.plist -->
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 281)May include surrounding context.

macOS LaunchAgent:

xml

<!-- ~/Library/LaunchAgents/com.cloudflare.tunnel.plist -->
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 282)May include surrounding context.

macOS LaunchAgent:

xml

<!-- ~/Library/LaunchAgents/com.cloudflare.tunnel.plist -->
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 298)May include surrounding context.

macOS LaunchAgent:

xml

<!-- ~/Library/LaunchAgents/com.cloudflare.tunnel.plist -->
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 303)May include surrounding context.

macOS LaunchAgent:

xml

<!-- ~/Library/LaunchAgents/com.cloudflare.tunnel.plist -->
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 281)May include surrounding context.

xml

<!-- ~/Library/LaunchAgents/com.cloudflare.tunnel.plist -->
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>Label</key>

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 303)May include surrounding context.

bash

# Load and start LaunchAgent
launchctl load ~/Library/LaunchAgents/com.cloudflare.tunnel.plist
launchctl start com.cloudflare.tunnel

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 78% confidence

Finding

The production setup script creates DNS routes and a persistent tunnel config that can continuously expose local services under public hostnames. While this is the intended use of Cloudflare Tunnel, the example does so for both main and API endpoints without built-in access restrictions or warnings, which may cause accidental long-term exposure of internal services.

Content

Scanner excerpt · SKILL.md (reported line 357)May include surrounding context.

md

# Get tunnel ID
TUNNEL_ID=$(cloudflared tunnel list | grep $TUNNEL_NAME | awk '{print $1}')

# Create DNS records
cloudflared tunnel route dns $TUNNEL_NAME $DOMAIN
cloudflared tunnel route dns $TUNNEL_NAME api.$DOMAIN

Static analysis

No suspicious patterns detected.