T03 · Remote Payload Retrieval and Execution
Error
- Location
references/sandbox/patterns.md:40- Finding
Unverified Remote Installation Script Is Piped Directly to a Shell
- Content
View full analysis
- Remediation
View remediation
Security audit
Cloudflare Deploy
Security checks for vulnerabilities and agentic risk
Overview
This Cloudflare deployment skill is not clearly malicious, but it bundles broad infrastructure-changing and code-execution guidance with weak guardrails, so it should be reviewed before use.
Install only if you are comfortable with a broad Cloudflare infrastructure assistant. Use least-privilege Cloudflare tokens, pin Wrangler locally, and require explicit approval before destructive API calls, secret changes, sandbox code execution, public port exposure, or persistent tunnel service installation.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Findings (4)
T06 · System Persistence
Error
- Location
references/tunnel/patterns.md:181- Finding
Cloudflare Tunnel Is Installed as a Persistent Privileged Host Service
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
SKILL.md:20- Finding
Unpinned Wrangler Execution Introduces a Mutable Package Supply Chain
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
references/pages-functions/api.md:115- Finding
Pages Function Example Returns an API Key in an HTTP Response
- Content
View full analysis
= async (ctx) => { // Service binding: forward to another Worker return ctx.env.AUTH.fetch(ctx.request); // Environment variable return Response.json({ key: ctx.env.API_KEY }); }; ``` ### Technical Analysis The example serializes `ctx.env.API_KEY` into an HTTP response. In the exact snippet, the disclosure statement is unreachable because it follows an unconditional `return`. Nevertheless, it is presented as the example for using an environment variable. A developer who extracts or rearranges that portion as intended would return the secret directly to the requester. Environment bindings commonly contain bearer tokens or other reusable credentials. They should be consumed only by trusted server-side operations and must not be reflected in responses, logs, error messages, or client-side bundles. ### Attack Path 1. A developer follows the Pages Functions environment-variable example. 2. The developer removes the preceding service-binding return or copies the environment-variable portion into a separate handler. 3. The resulting endpoint is deployed and becomes externally reachable. 4. An unauthenticated or insufficiently privileged requester invokes the endpoint. 5. The response contains the API key in JSON. 6. The requester reuses the key against the associated external or Cloudflare service. ### Impact Assessment Exploitation discloses the complete API key to any party able to reach the endpoint. The resulting privileges equal those granted to the key and may include access to third-party APIs, Cloudflare resources, protected data, or billable operations. The key remains exploitable until it is revoked or rotated. ]]>- Remediation
View remediation
= async (ctx) => { return Response.json({ configured: Boolean(ctx.env.API_KEY) }); }; ``` - For outbound authentication, apply the secret only to a fixed, trusted destination. - Add documentation stating that environment secrets must never be returned to clients or logged. - Separate the service-binding and environment-variable examples into independently valid handlers to avoid unreachable code and unsafe copy-and-paste behavior. - Rotate any credential that may already have been exposed using this pattern. ]]>
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Findings (720)
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The sample logs the raw x-api-key header value into the analytics index field. API keys are secrets; storing them in analytics creates credential exposure risk through logs, dashboards, exports, query APIs, and broader operator access, potentially enabling unauthorized use if the data is disclosed.
- Content
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 80% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
GET /operations/{op_id} # Get single POST /operations/item # Create: {endpoint,host,method} POST /operations # Bulk: {operations:[{endpoint,host,method}]} DELETE /operations/{op_id} # Delete DELETE /operations # Bulk delete: {operation_ids:[...]}
text
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 80% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
POST /operations/item # Create: {endpoint,host,method} POST /operations # Bulk: {operations:[{endpoint,host,method}]} DELETE /operations/{op_id} # Delete DELETE /operations # Bulk delete: {operation_ids:[...]}
text ## Discovery
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md - dev: Uses `preview_id` or local bindings, secrets not available - deploy: Uses production `id`, secrets available **Access secrets in dev:** `npx wrangler dev --remote` **Persist local data:** `npx wrangler dev --persist` ## Performance Gotchas
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 80% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
bash GET /accounts/{account_id}/images/v1/{image_id} # Get details DELETE /accounts/{account_id}/images/v1/{image_id} # Delete GET /accounts/{account_id}/images/v1?page=1 # List
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 88% confidence
- Finding
The documentation exposes a destructive DELETE interconnect endpoint with no indication that callers should require strong validation or explicit user confirmation before use. In an agent skill context, this materially increases the risk of parameter abuse or accidental deletion of production network connectivity if an LLM constructs or forwards a request using attacker-influenced identifiers.
- Content
GET /accounts/{account_id}/cni/interconnects/{icon} GET /accounts/{account_id}/cni/interconnects/{icon}/status GET /accounts/{account_id}/cni/interconnects/{icon}/loa # Returns PDF DELETE /accounts/{account_id}/cni/interconnects/{icon}
text **Create Body:** `account`, `slot_id`, `type`, `facility`, `speed`, `name`, `description`
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 88% confidence
- Finding
The DELETE CNI endpoint can remove BGP configuration objects that underpin connectivity, yet the reference provides no guardrails around parameter validation, authorization scope, or confirmation. In a deployment skill, such undocumented destructive capability is dangerous because an agent may be induced to target the wrong CNI object, causing outages or routing disruption.
- Content
POST /accounts/{account_id}/cni/cnis GET /accounts/{account_id}/cni/cnis/{cni} PUT /accounts/{account_id}/cni/cnis/{cni} DELETE /accounts/{account_id}/cni/cnis/{cni}
text Body: `account`, `cust_ip`, `cf_ip`, `bgp_asn`, `bgp_password`, `vlan`
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
typescript // ❌ DANGEROUS: Path traversal const key = url.pathname.slice(1); // Could be ../../../etc/passwd await env.MY_BUCKET.get(key); // ✅ SAFE: Validate keys
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 80% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
GET /meetings/{meeting_id}/participants/{participant_id} # Get details POST /meetings/{meeting_id}/participants # Add: {"name": "...", "preset_name": "...", "custom_participant_id": "..."} PATCH /meetings/{meeting_id}/participants/{participant_id} # Update: {"name": "...", "preset_name": "..."} DELETE /meetings/{meeting_id}/participants/{participant_id} # Delete POST /meetings/{meeting_id}/participants/{participant_id}/token # Refresh token
text
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 80% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
GET /webhooks # List all POST /webhooks # Create: {"url": "https://...", "events": ["session.started", "session.ended"]} PATCH /webhooks/{webhook_id} # Update DELETE /webhooks/{webhook_id} # Delete
text ## Session Lifecycle
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
This reference introduces a sandbox product centered on isolated code execution, including running untrusted code and agent-integrated execution, which is materially broader than a Cloudflare deployment skill. In a deployment-focused skill, bundling guidance for sandboxed execution expands the agent's operational scope toward remote code execution and increases the chance the agent will select or justify dangerous actions unrelated to simple deploy/publish tasks.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
Including unjustified remote code execution and interactive sandbox use cases in a deployment-focused skill creates a dangerous mismatch between declared purpose and actual capabilities. Because the skill is supposed to help deploy to Cloudflare, this context makes the presence of untrusted-code execution more suspicious and more likely to be abused or accidentally invoked under the guise of deployment assistance.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The documented APIs explicitly support command execution, file read/write, background process control, port exposure, WebSocket proxying, and storage mounting. Those capabilities exceed normal deployment semantics and could enable an agent to execute arbitrary code, modify files, run persistent services, or expose internal applications if the reference is used as part of the skill's available action surface.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The reference file documents multiple high-risk capabilities—arbitrary code execution, interactive IDE exposure, CI/CD execution, writable bucket mounting, WebSocket proxying, and Git operations—that substantially exceed the declared scope of a Cloudflare deployment skill. In a skill package, such references can normalize or encourage implementation of dangerous behaviors unrelated to the manifest, increasing the chance the agent is granted or develops broader execution and data-handling capabilities than intended.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
This example accepts arbitrary code from a request and executes it in a sandbox, then returns rich outputs including HTML. Even if sandboxed, this creates a generic code-execution service that is unrelated to deployment tasks and can be abused for untrusted computation, payload staging, or generation of unsafe rendered content.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The example installs code-server via a remote shell script and exposes a browser-accessible IDE, effectively provisioning remote administrative access inside the sandbox. That is far beyond Cloudflare deployment scope and introduces a large attack surface including remote code execution, persistence, package installation, and possible lateral movement through connected credentials or mounted resources.
- Content
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 99% confidence
- Finding
Using 'curl ... | sh' fetches and executes a remote script without integrity verification, making the environment trust whatever content is served at runtime. This creates a direct supply-chain execution path and is especially dangerous in a skill reference because it models unsafe behavior for provisioning a remotely exposed IDE.
- Content
md const sandbox = getSandbox(env.Sandbox, 'ide', { normalizeId: true }); if (request.url.endsWith('/start')) { await sandbox.exec('curl -fsSL https://code-server.dev/install.sh | sh'); await sandbox.startProcess('code-server --bind-addr 0.0.0.0:8080', { processId: 'vscode' });
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This CI/CD example clones arbitrary repositories, installs dependencies, and runs tests, which effectively turns the skill into a build-execution system rather than a deployment helper. Executing repository contents and package install scripts is a well-known route to arbitrary command execution, secret exposure, and supply-chain compromise.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
This multi-tenant pattern constructs a command from user-supplied code and executes it per user session, creating a direct arbitrary command-execution interface. In addition to being unrelated to Cloudflare deployment, multi-tenant execution amplifies risk through tenant isolation failures, abuse at scale, and command injection concerns.
- Content
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 80% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
{"name": "my-store"}
Delete
DELETE /accounts/{account_id}/secrets_store/stores/{store_id}
text ### Secret Operations
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 80% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md {"value": "new_value", "comment": "Updated"} # Delete (single) DELETE /accounts/{account_id}/secrets_store/stores/{store_id}/secrets/{secret_id} # Delete (batch) DELETE /accounts/{account_id}/secrets_store/stores/{store_id}/secrets
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 80% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md DELETE /accounts/{account_id}/secrets_store/stores/{store_id}/secrets/{secret_id} # Delete (batch) DELETE /accounts/{account_id}/secrets_store/stores/{store_id}/secrets {"secret_ids": ["id-1", "id-2"]} # Duplicate
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md --name MY_SECRET --scopes workers --remote # Create (piped) cat secret.txt | wrangler secrets-store secret create <store-id> \ --name MY_SECRET --scopes workers --remote # List/get/update/delete
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md ### "Module-Level Secret Access" **Cause:** Attempting to access secrets during module initialization before env is available **Solution:** Cache secrets in request scope only, not at module level ### "Secret not found in store"
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
}
text ### "Cannot access secret in local dev" **Cause:** Attempting to access production secrets in local development environment **Solution:** Create local-only secrets (without `--remote` flag) for development: `wrangler secrets-store secret create <store-id> --name API_KEY --scopes workers`
Static analysis
Detected: suspicious.exposed_secret_literal, suspicious.prompt_injection_instructions
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- references/agents-sdk/api.md:134
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- references/api/gotchas.md:111
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- references/cache-reserve/configuration.md:94
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- references/hyperdrive/api.md:70
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- references/pages/configuration.md:43
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- references/pulumi/api.md:133
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- references/realtimekit/patterns.md:194
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- references/secrets-store/api.md:163
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- references/snippets/configuration.md:72
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- references/stream/api-live.md:12
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- references/stream/api.md:13
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- references/stream/patterns.md:26
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- references/terraform/configuration.md:188
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- references/terraform/README.md:39
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- references/waf/configuration.md:74
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- references/workers-ai/configuration.md:64
Prompt-injection style instruction pattern detected.
Warn
- Code
- suspicious.prompt_injection_instructions
- Location
- references/ai-search/patterns.md:51