cloudflare-workers

• Outcome: Review
• Latest audit: Jul 22, 2026 · 6:59 PM UTC
• Version: 3.1.2

Overview

This Cloudflare Workers skill is coherent, but several examples handle live production resources and sensitive telemetry without enough safety guidance.

Review this skill before installing or using it as an implementation template. If used, avoid running examples against production by default, scope Cloudflare tokens narrowly, verify destructive Wrangler commands before execution, and add redaction/minimization for headers, URLs, cookies, tokens, stack traces, raw emails, and third-party logging payloads.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (12)

Context-Inappropriate Capability

Medium

• Confidence: 85% confidence
• Finding: The custom logging example sends structured log entries to an external endpoint and the surrounding examples encourage inclusion of request URLs, methods, user IDs, stack traces, and arbitrary metadata. In an observability context this is plausible and not inherently malicious, but the example lacks minimization, redaction, and privacy guidance, so it normalizes exporting potentially sensitive operational or user data to third parties.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The error reporting example serializes and transmits full request headers and URL data to an external service. Headers commonly contain Authorization tokens, cookies, session IDs, API keys, and client-identifying data, so this creates a clear risk of credential leakage and privacy exposure through observability pipelines.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The remote debugging example logs complete request and response headers to observability output. Even if intended for debugging, these logs can capture credentials, cookies, internal identifiers, and security-related headers, and may then be retained or forwarded to downstream log systems.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The Tail Worker example sends exception details to an external logging endpoint without any guidance on redaction, minimization, or privacy review. Exception payloads and request metadata can contain secrets, tokens, user identifiers, or sensitive inputs, so documenting this pattern without safeguards can lead users to exfiltrate sensitive operational data.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The email handler example forwards inbound email and stores raw email contents without warning about sensitive-data handling. Raw emails commonly include personal data, credentials, attachments, and legal or regulated content, so this pattern can cause unnecessary retention or disclosure if copied directly.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The markdown presents external error reporting that includes full request headers and URLs without any privacy warning or cautionary note. This omission is dangerous because developers may copy the pattern directly, unintentionally exporting secrets and personal data to third-party systems.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The remote debugging guidance recommends logging full request and response headers without warning about sensitive-data exposure. In a production observability workflow, that can leak credentials or user data into logs accessible by operators, vendors, or compromised log sinks.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The observability section shows logs, traces, and alerts being sent to external services with request-derived fields but does not discuss privacy, data classification, or redaction. In a Cloudflare Workers skill this functionality is contextually relevant, yet the absent safeguards make it easy for users to adopt unsafe telemetry practices.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The guide includes destructive deletion commands for namespaces, buckets, objects, secrets, and queues without nearby warnings about permanence, target-environment verification, or production impact. In infrastructure documentation, this can lead to accidental deletion of live resources or data, especially when operators copy/paste commands.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The document recommends running local development against real production bindings and even describes it as useful for debugging production data, but it does not strongly warn that local code can read, modify, or corrupt live KV, D1, R2, and other resources. This materially increases the risk of data exposure, accidental writes, destructive testing, and use of less-controlled developer environments against production systems.

External Transmission

Medium

• Category: Data Exfiltration

Content

for (const event of events) {
      if (event.outcome === "exception") {
        // Log errors to external service
        await fetch("https://logs.example.com", {
          method: "POST",
          body: JSON.stringify({
            scriptName: event.scriptName,

• Confidence: 87% confidence
• Finding: fetch("https://logs.example.com", { method: "POST"

External Transmission

Medium

• Category: Data Exfiltration

Content

};

async function reportError(error: Error, request: Request, env: Env) {
  await fetch("https://errors.example.com/report", {
    method: "POST",
    headers: {
      "Content-Type": "application/json",

• Confidence: 95% confidence
• Finding: fetch("https://errors.example.com/report", { method: "POST"

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: references/observability.md:384