Cloudflare Workers Ai Images

• Outcome: Review
• Latest audit: Sep 16, 2026 · 3:31 AM UTC
• Version: 1.1.1

Overview

The skill is coherent for Cloudflare image generation, but its setup documentation includes unsafe credential-handling guidance that can expose the Cloudflare API token.

Install only if you are comfortable sending prompts and any selected source image to Cloudflare Workers AI. Before use, replace the documented verification command with a presence-only check that does not print token values, keep CF_API_TOKEN out of logs and source control, and use a least-privilege Cloudflare token that can only perform the needed Workers AI inference.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: references/docker-compose-env-example.md:24

Finding

Cloudflare API Token Disclosure Through Verification Command

Content

View full analysis

Vulnerability Details

File Location: references/docker-compose-env-example.md, lines 24–26
Vulnerability Type: Credential exposure through insecure operational guidance
Risk Level: Medium

Vulnerable Code Snippet

bash

docker compose exec openclaw env | grep '^CF_'

text

Expected output should include both variables.

Technical Analysis

The documented verification command prints the complete values of every environment variable whose name begins with CF_, including CF_API_TOKEN. Verifying that credentials are configured does not require disclosing their values.

Because the command writes secrets to standard output, the API token may be captured in terminal history or scrollback, CI/CD logs, screen recordings, support transcripts, or an agent conversation context. Although the Python scripts do not print the token, this documentation instructs users to expose it through an avoidable diagnostic step.

Attack Path

1. An operator configures CF_ACCOUNT_ID and CF_API_TOKEN in the OpenClaw container.
2. The operator follows the documented verification command.
3. The container prints the complete Cloudflare account identifier and bearer token.
4. The output is retained in a CI log, terminal recording, support transcript, or conversation context.
5. An unauthorized party with access to that output extracts the token.
6. The party submits authenticated requests to Cloudflare using the permissions granted to the exposed token.

Impact Assessment

An attacker could consume Workers AI resources and perform actions authorized by the exposed token. The exact scope is bounded by the token's Cloudflare account permissions; impact increases if the token was not restricted to the minimum Workers AI inference permission. The issue does not itself grant local system privileges or permissions beyond those already assigned to the token.

The separately flagged base64 encoding in ` ...[truncated 237 chars]

Remediation

View remediation

Remediation Suggestions

Replace the value-printing command with a presence-only check that never emits credential contents:

bash

docker compose exec openclaw sh -c '
  for name in CF_ACCOUNT_ID CF_API_TOKEN; do
    eval "value=\${$name:-}"
    if [ -n "$value" ]; then
      echo "$name=set"
    else
      echo "$name=missing"
    fi
  done
'

Additionally:

• Explicitly warn users not to print, paste, or log CF_API_TOKEN.
• Use a Cloudflare API token restricted to the target account and the minimum Workers AI inference permission.
• Mask secret environment variables in CI/CD systems.
• Revoke and rotate any token that may already have appeared in logs or transcripts.
• Review retained logs and support records for accidental exposure and restrict or remove them where possible.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (8)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill instructs the agent to use shell execution, environment variables, file reads/writes, and network access, but it does not declare any explicit tool scope or permissions boundaries. This increases the chance of overbroad execution in runtimes that rely on manifest-level restrictions, making misuse or accidental abuse harder to contain.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The documentation instructs users to pass a Cloudflare API token and account ID into a container via environment variables, but it does not warn that API tokens are sensitive secrets or discuss safer handling practices. Environment variables can be exposed through process inspection, container debugging, logs, misconfigured tooling, or accidental inclusion in committed compose files, making credential leakage more likely.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/cf_workers_ai_image.py (reported line 13)May include surrounding context.

python

import urllib.request
from pathlib import Path

BASE_URL_TEMPLATE = "https://api.cloudflare.com/client/v4/accounts/{account_id}/ai/run/{model}"
DEFAULT_TEXT2IMG_MODEL = "@cf/stabilityai/stable-diffusion-xl-base-1.0"
DEFAULT_IMG2IMG_MODEL = "@cf/runwayml/stable-diffusion-v1-5-img2img"

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This code performs an HTTP POST to Cloudflare Workers AI and includes user-supplied prompt data and, in img2img mode, a base64-encoded local image in the request body. While the script's purpose is image generation, there is no visible confirmation prompt or explicit disclosure in code comments/logging that local content is transmitted off-box to a third-party service.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/smoke_test.py (reported line 51)May include surrounding context.

python

def run_case(label: str, cmd: list[str]) -> dict:
    print(f"\n=== {label} ===")
    print("$", " ".join(cmd))
    proc = subprocess.run(cmd, capture_output=True, text=True)
    stdout = proc.stdout.strip()
    result = {
        "label": label,

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The trigger examples and recommended captions are written only in Chinese, and the skill does not indicate that language should follow the user's preference or be configurable. This can violate a language/locale policy when used in sessions where the user has not opted into Chinese output.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The code accesses CF_ACCOUNT_ID and CF_API_TOKEN and uses them to authenticate a remote request, but there is no docstring, comment, or user-facing notice explaining this credential use. This can matter in audited environments where users should be clearly informed that account-scoped credentials are required and will be used for outbound API calls.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The manifest describes a skill for generating and editing images and mentions saving temporary files for chat handoff, but it does not declare reading local environment variables as part of its purpose. In this smoke test, the code explicitly inspects CF_ACCOUNT_ID and CF_API_TOKEN from the process environment before proceeding, which is a separate credential-access capability.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.