Security audit

r2-uploader

Security checks for vulnerabilities and agentic risk

Overview

This Cloudflare R2 upload skill is not malicious, but it needs review because its instructions can publish local or URL-fetched content with too little scoping and include unsafe shell examples.

Install only if you are comfortable with an agent using your Wrangler login to write to R2. Before any upload, confirm the exact local path, destination bucket/path, and whether the object will be public; avoid home-directory searches, broad globs, and URL imports from untrusted sources. Do not use the concurrent xargs example as written.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Error

Location: references/advanced.md:40
Finding: Shell Command Injection Through Attacker-Controlled Filenames
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:48
Finding: Server-Side Request Forgery and Data Disclosure Through Unrestricted URL Uploads
Content: View full analysis
" | wrangler r2 object put "$R2_BUCKET/$R2_PATH" --file - --remote ``` ``` The operative command is: ```bash curl -sL "" | wrangler r2 object put "$R2_BUCKET/$R2_PATH" --file - --remote ``` ### Technical Analysis The Skill permits a user-controlled URL to be retrieved using `curl` without validating the protocol, hostname, resolved IP address, port, or redirect destination. The `-L` option automatically follows redirects, allowing an initially benign-looking external URL to redirect to loopback, link-local, private-network, or cloud metadata addresses. The fetched response is streamed directly into Cloudflare R2. Consequently, content reachable from the agent's network environment can be copied into object storage without being inspected or restricted. If the resulting object is publicly accessible, this behavior can turn SSRF into direct disclosure of internal data. ### Attack Path 1. An attacker asks the agent to upload content from a URL controlled by the attacker. 2. The supplied URL either directly targets an internal address or redirects to one. 3. `curl -L` follows the redirect and retrieves a service available only from the agent's network environment. 4. The response body is streamed into the configured R2 bucket. 5. The generated object URL is returned or otherwise exposed. 6. The attacker retrieves the uploaded internal content from R2. Potential targets include loopback services, private network applications, link-local endpoints, and cloud instance metadata services, subject to the agent's network access. ### Impact Assessment Exploitation may disclose internal service responses, metadata, credentials, configuration data, or other content reachable from the agent. It can also be used to probe inter ...[truncated 205 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: references/error-handling.md:61
Finding: Predictable Temporary File Permits Symlink Attacks
Content: View full analysis
" "$TMP_FILE" wrangler r2 object put "$R2_BUCKET/$R2_PATH" --file "$TMP_FILE" --remote rm "$TMP_FILE" ``` ### Technical Analysis The temporary pathname is derived solely from the current Unix timestamp and is therefore predictable. The file is placed in the shared `/tmp` directory without atomic exclusive creation or validation that the path is a regular file owned by the current user. A local attacker can predict the timestamp and pre-create the path as a symbolic link. The subsequent `cp` can follow that link and overwrite another file writable by the executing user. Depending on the target and timing, the upload command may also read and upload unintended content through the attacker-controlled path. The cleanup is not protected by a trap, so interruptions can leave temporary content behind. ### Attack Path 1. A local attacker predicts when the documented upload workflow will run. 2. The attacker creates `/tmp/r2-upload-` as a symbolic link to a chosen target. 3. The agent executes `cp "" "$TMP_FILE"`. 4. `cp` follows or otherwise interacts with the attacker-controlled destination path. 5. A file writable by the agent may be overwritten, or unintended content may be selected for upload. 6. The final `rm` removes the temporary directory entry but does not reverse any overwrite or disclosure that already occurred. ### Impact Assessment The issue can result in overwriting files accessible to the agent account, uploading unintended local data to R2, and leaving sensitive temporary copies on disk after abnormal termination. It does not independently grant privileges beyond those of the executing user, but it allows another local user to abuse those privileges and file-access righ ...[truncated 7 chars]
Remediation: View remediation
" "$TMP_FILE" || exit 1 wrangler r2 object put \ "$R2_BUCKET/$R2_PATH" \ --file "$TMP_FILE" \ --remote ``` Additional hardening measures: - Set a restrictive `umask`, such as `umask 077`, before creating temporary files. - Check all command exit statuses. - Do not construct temporary paths from timestamps, process IDs, or other predictable values. - Prefer avoiding the temporary copy entirely when the original path can be passed safely using proper quoting. ]]>

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: SKILL.md:21
Finding: Overbroad Home-Directory Search Can Select and Upload Unintended Sensitive Files
Content: View full analysis
" -type f 2>/dev/null | head -5 # 验证文件存在 ls -la "" ``` ### Technical Analysis The documented workflow recursively searches the user's entire home directory when only a filename is supplied. This scope may include credentials, private documents, application data, hidden directories, and unrelated project files. If multiple files share the requested name, the first five filesystem-order matches are returned without a requirement that the user verify the intended file before upload. Suppressing error output with `2>/dev/null` also hides access and traversal problems that could otherwise reveal unsafe assumptions. This does not bypass operating-system permissions, but it violates least-privilege principles by searching substantially more data than is necessary for the upload task. ### Attack Path 1. An attacker or mistaken user supplies an ambiguous filename rather than an exact path. 2. The agent recursively searches the entire home directory. 3. The search discovers an unrelated sensitive file with the same name. 4. The agent selects that match without obtaining confirmation of its full path. 5. The file is uploaded to R2 and may become available through the generated object URL. ### Impact Assessment The issue may expose private file locations and cause accidental upload of sensitive files accessible to the agent account. The affected scope includes the user's home directory and any traversable locations beneath it. If R2 objects are public or broadly shared, accidental selection can become external data disclosure. ]]>
Remediation: View remediation
" -print ``` The selected canonical path should still be shown to the user and explicitly confirmed before uploading. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The trigger phrases include generic terms like '上传' and '存储', which can match ordinary file-handling requests not specifically meant for Cloudflare R2. This raises the risk of accidental activation, causing unintended remote upload of local files or disclosure of public URLs when the user only asked for local handling or another storage target.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill centers on uploading local files to remote R2 storage and returning a public URL, but it provides no user-facing warning about off-device transmission or public exposure. In an agent setting, this can lead to inadvertent exfiltration of sensitive local data or publication of files the user did not intend to expose.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The direct-from-URL flow fetches third-party content with curl and immediately writes it into the user's R2 bucket, without warning about relaying external content into their storage. This can result in storage abuse, ingestion of malicious or illegal content, or unexpected cost and compliance issues if a user supplies or is tricked into supplying an untrusted URL.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill is described as upload-focused, but it also documents bucket enumeration and object deletion commands. Expanding capability beyond the declared purpose increases the chance an agent could perform destructive or discovery actions a user did not intend, especially if invoked under a broad upload-related trigger context.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The examples perform bulk uploads of local files to a remote Cloudflare R2 bucket using broad file globs and directory iteration, but provide no warning that all matched files will be transmitted off-host. In an agent skill context focused on uploading, this increases the chance of accidental exfiltration of unintended files, especially if users or downstream agents run the snippets with an overbroad directory or bucket variable.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The concurrent upload example discovers files automatically with find and uploads them in parallel to a remote bucket, which can rapidly exfiltrate a large set of local files if run from the wrong directory or with a broader pattern than intended. The lack of any caution, dry-run step, or scope validation makes accidental bulk transfer more dangerous in this skill because the surrounding purpose is to automate remote file upload.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The title and all operational guidance are written in Chinese, with no indication that the user can choose another language or that the document is intentionally limited to a Chinese-speaking audience. Under the stated policy, forcing a specific language without opt-in is a natural-language policy issue.
Content: No source excerpt is available for this finding.