Security audit
Security checks for vulnerabilities and agentic risk
This skill is aligned with CDN administration, but it gives agents command execution paths for live CDN and security changes without enough scoping or confirmation safeguards.
Review this skill before installation if it will be used with real CDN accounts. Use least-privilege API tokens, avoid pasting secrets into scripts, test on non-production zones first, and require explicit approval for any command that creates, patches, purges, or changes CDN/security configuration.
The skill states secrets should be supplied via environment variables, but the shell example assigns API_TOKEN and ZONE_ID directly in the script. Even as placeholders, this encourages users to paste real credentials into files or command history, increasing the chance of credential leakage through source control, logs, or shared snippets.
The skill includes executable examples that transmit authenticated requests to external Cloudflare APIs using bearer tokens. In a skill with exec capability, this creates a real risk of unintended outbound actions against production infrastructure if a user or agent runs the examples without sufficient confirmation, potentially modifying firewall policy remotely.
API_TOKEN="你的API_TOKEN"
ZONE_ID="你的ZONE_ID"
# ...
curl -s -X POST "https://api.cloudflare.com/client/v4/zones/${ZONE_ID}/rulesets" \
-H "Authorization: Bearer ${API_TOKEN}" \
-H "Content-Type: application/json" \
-d '{
This example performs an authenticated PATCH to change DDoS protection settings on an external service. Because the skill advertises command execution and automation, the presence of direct state-changing outbound calls increases the chance of accidental or unauthorized configuration changes to live environments.
}]
}' | jq '.success'
# ...
curl -s -X PATCH "https://api.cloudflare.com/client/v4/zones/${ZONE_ID}/ddos_protection/l7" \
-H "Authorization: Bearer ${API_TOKEN}" \
-H "Content-Type: application/json" \
-d '{"sensitivity_level":"high"}' | jq '.success'
The purge-cache example triggers authenticated external API operations that can invalidate content globally. In an agent skill with exec support, this can cause operational disruption, cache stampedes, or service degradation if invoked unintentionally or against the wrong zone.
]
}' | jq '.success'
# ...
# curl -s -X POST "https://api.cloudflare.com/client/v4/zones/${ZONE_ID}/purge_cache" \
echo "=== 按前缀刷新 ==="
cloudflare.com/client/v4/zones/${ZONE_ID}/purge_cache" \
-H "Authorization: Bearer ${API_TOKEN}" \
The skill includes executable examples that transmit authenticated requests to external Cloudflare APIs using bearer tokens. In a skill with exec capability, this creates a real risk of unintended outbound actions against production infrastructure if a user or agent runs the examples without sufficient confirmation, potentially modifying firewall policy remotely.
API_TOKEN="你的API_TOKEN"
ZONE_ID="你的ZONE_ID"
# ...
curl -s -X POST "https://api.cloudflare.com/client/v4/zones/${ZONE_ID}/rulesets" \
-H "Authorization: Bearer ${API_TOKEN}" \
-H "Content-Type: application/json" \
-d '{
This example performs an authenticated PATCH to change DDoS protection settings on an external service. Because the skill advertises command execution and automation, the presence of direct state-changing outbound calls increases the chance of accidental or unauthorized configuration changes to live environments.
}]
}' | jq '.success'
# ...
curl -s -X PATCH "https://api.cloudflare.com/client/v4/zones/${ZONE_ID}/ddos_protection/l7" \
-H "Authorization: Bearer ${API_TOKEN}" \
-H "Content-Type: application/json" \
-d '{"sensitivity_level":"high"}' | jq '.success'
The purge-cache example triggers authenticated external API operations that can invalidate content globally. In an agent skill with exec support, this can cause operational disruption, cache stampedes, or service degradation if invoked unintentionally or against the wrong zone.
]
}' | jq '.success'
# ...
# curl -s -X POST "https://api.cloudflare.com/client/v4/zones/${ZONE_ID}/purge_cache" \
echo "=== 按前缀刷新 ==="
cloudflare.com/client/v4/zones/${ZONE_ID}/purge_cache" \
-H "Authorization: Bearer ${API_TOKEN}" \
No suspicious patterns detected.