ClawHub
Back to skill

Security audit

Cloudflare Dns Updater

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it claims: it updates Cloudflare DNS records using a Cloudflare API token, with no hidden persistence or unrelated data flow found.

Before installing, treat this as an administrative DNS-changing tool: use a least-privilege Cloudflare token limited to the intended zone, verify the zone, record, and IP before running it, and be cautious with the public-IP lookup example because it may resolve the machine running the agent rather than your target server.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Note
Location
requirements.txt:1
Finding

Unpinned Third-Party Dependency

Content
View full analysis

Vulnerability Details

File Location: requirements.txt:1
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Low

Vulnerable Code

text
requests

Technical Analysis

The requests dependency is declared without an exact version or integrity hash. Consequently, separate installations may resolve to different package versions over time. This weakens build reproducibility and may introduce a vulnerable or compromised future release without any corresponding repository change.

The package name is legitimate and there is no evidence that the current dependency is malicious. The risk arises from unconstrained dependency resolution and the absence of integrity verification.

Attack Path

  1. An attacker compromises the dependency distribution path or publishes a malicious release under the legitimate package.
  2. A deployment installs the project dependencies from requirements.txt.
  3. Because no exact version or hash is specified, the installer resolves and installs the affected release.
  4. The dependency executes within the Python process when scripts/update-record.py imports or uses it.
  5. Malicious dependency code could access process resources, including the CLOUDFLARE_API_TOKEN environment variable, and perform unauthorized actions.

This path requires an upstream supply-chain compromise or installation from an untrusted package source; it is not directly exploitable solely through the script's command-line arguments.

Impact Assessment

A compromised dependency would execute with the operating-system privileges of the user running the skill. It could read environment variables and files accessible to that account, make outbound network requests, and modify process-accessible data. In this skill's context, exposure of CLOUDFLARE_API_TOKEN could permit unauthorized DNS changes within the zones and permissions granted to that token.

Remediation
View remediation

Remediation Suggestions

  1. Pin requests and its transitive dependencies to reviewed, exact versions using a generated lock file.
  2. Enable package hash verification, such as pip's --require-hashes option with SHA-256 hashes for every resolved artifact.
  3. Install dependencies exclusively from a trusted, explicitly configured package index.
  4. Use automated dependency vulnerability scanning and a controlled update process to keep pinned versions secure.
  5. Restrict the Cloudflare token to DNS-edit access for only the required zones, limiting the impact of a compromised runtime dependency.

Example workflow:

bash
pip-compile --generate-hashes requirements.in
python3 -m pip install --require-hashes -r requirements.txt

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (19)

Tainted flow: 'headers' from os.getenv (line 22, credential/environment) → requests.get (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/update-record.py (reported line 32)May include surrounding context.

python
# --- Get Zone ID ---
    try:
        zone_id_url = f"https://api.cloudflare.com/client/v4/zones?name={args.zone}"
        response = requests.get(zone_id_url, headers=headers, timeout=10)
        response.raise_for_status()
        zone_data = response.json()
        if not zone_data.get("result"):

Tainted flow: 'headers' from os.getenv (line 22, credential/environment) → requests.get (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/update-record.py (reported line 47)May include surrounding context.

python
# --- Check for existing Record ---
    try:
        record_url = f"https://api.cloudflare.com/client/v4/zones/{zone_id}/dns_records?type=A&name={full_record_name}"
        response = requests.get(record_url, headers=headers, timeout=10)
        response.raise_for_status()
        record_data = response.json()
        existing_records = record_data.get("result", [])

Tainted flow: 'headers' from os.getenv (line 22, credential/environment) → requests.put (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/update-record.py (reported line 69)May include surrounding context.

python
record_id = existing_records[0]["id"]
            print(f"Record '{full_record_name}' already exists (ID: {record_id}). Updating IP to {args.ip}...")
            update_url = f"https://api.cloudflare.com/client/v4/zones/{zone_id}/dns_records/{record_id}"
            response = requests.put(update_url, headers=headers, json=payload, timeout=10)
        else:
            print(f"Record '{full_record_name}' does not exist. Creating new record...")
            create_url = f"https://api.cloudflare.com/client/v4/zones/{zone_id}/dns_records"

Tainted flow: 'headers' from os.getenv (line 22, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/update-record.py (reported line 73)May include surrounding context.

python
else:
            print(f"Record '{full_record_name}' does not exist. Creating new record...")
            create_url = f"https://api.cloudflare.com/client/v4/zones/{zone_id}/dns_records"
            response = requests.post(create_url, headers=headers, json=payload, timeout=10)

        response.raise_for_status()
        result = response.json()

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The README describes a tool that creates or updates Cloudflare DNS records but does not clearly warn that using it will make live changes to production DNS. In an agent-driven or automated context, this omission increases the chance of unintended infrastructure changes, service disruption, or traffic redirection because an operator may treat the skill as low-risk automation rather than a state-changing operation.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding

The skill documents use of environment variables and external network access, but it does not declare an explicit tool scope such as allowed tools or permissions. That makes the skill's operational boundary ambiguous and can enable broader-than-expected agent behavior, especially in environments that rely on manifest-declared scoping for enforcement or review.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill performs a live administrative action—creating or updating proxied Cloudflare DNS records—but the description does not prominently warn that it changes production DNS state. Without an explicit warning and confirmation expectation, users or agents may invoke it without appreciating the operational impact, potentially causing outages, traffic rerouting, or exposure of services.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill claims to take the IP address as an input, but the example instructs the agent to fetch an IP from an unrelated third-party service. This expands the skill's behavior beyond its stated purpose, introduces unnecessary outbound network access and data flow to an external domain, and risks updating DNS with the wrong host's public IP in multi-host or proxied environments.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/update-record.py (reported line 31)May include surrounding context.

python
# --- Get Zone ID ---
    try:
        zone_id_url = f"https://api.cloudflare.com/client/v4/zones?name={args.zone}"
        response = requests.get(zone_id_url, headers=headers, timeout=10)
        response.raise_for_status()
        zone_data = response.json()

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/update-record.py (reported line 46)May include surrounding context.

python
# --- Get Zone ID ---
    try:
        zone_id_url = f"https://api.cloudflare.com/client/v4/zones?name={args.zone}"
        response = requests.get(zone_id_url, headers=headers, timeout=10)
        response.raise_for_status()
        zone_data = response.json()

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/update-record.py (reported line 68)May include surrounding context.

python
# --- Get Zone ID ---
    try:
        zone_id_url = f"https://api.cloudflare.com/client/v4/zones?name={args.zone}"
        response = requests.get(zone_id_url, headers=headers, timeout=10)
        response.raise_for_status()
        zone_data = response.json()

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/update-record.py (reported line 72)May include surrounding context.

python
# --- Get Zone ID ---
    try:
        zone_id_url = f"https://api.cloudflare.com/client/v4/zones?name={args.zone}"
        response = requests.get(zone_id_url, headers=headers, timeout=10)
        response.raise_for_status()
        zone_data = response.json()

Tainted flow: 'record_url' from requests.get (line 46, network input) → requests.get (network output)

Medium
Category
Data Flow
Confidence
65% confidence
Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/update-record.py (reported line 47)May include surrounding context.

python
# --- Check for existing Record ---
    try:
        record_url = f"https://api.cloudflare.com/client/v4/zones/{zone_id}/dns_records?type=A&name={full_record_name}"
        response = requests.get(record_url, headers=headers, timeout=10)
        response.raise_for_status()
        record_data = response.json()
        existing_records = record_data.get("result", [])

External Transmission

Medium
Category
Data Exfiltration
Confidence
80% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/update-record.py (reported line 69)May include surrounding context.

python
record_id = existing_records[0]["id"]
            print(f"Record '{full_record_name}' already exists (ID: {record_id}). Updating IP to {args.ip}...")
            update_url = f"https://api.cloudflare.com/client/v4/zones/{zone_id}/dns_records/{record_id}"
            response = requests.put(update_url, headers=headers, json=payload, timeout=10)
        else:
            print(f"Record '{full_record_name}' does not exist. Creating new record...")
            create_url = f"https://api.cloudflare.com/client/v4/zones/{zone_id}/dns_records"

Tainted flow: 'update_url' from requests.get (line 68, network input) → requests.put (network output)

Medium
Category
Data Flow
Confidence
65% confidence
Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/update-record.py (reported line 69)May include surrounding context.

python
record_id = existing_records[0]["id"]
            print(f"Record '{full_record_name}' already exists (ID: {record_id}). Updating IP to {args.ip}...")
            update_url = f"https://api.cloudflare.com/client/v4/zones/{zone_id}/dns_records/{record_id}"
            response = requests.put(update_url, headers=headers, json=payload, timeout=10)
        else:
            print(f"Record '{full_record_name}' does not exist. Creating new record...")
            create_url = f"https://api.cloudflare.com/client/v4/zones/{zone_id}/dns_records"

External Transmission

Medium
Category
Data Exfiltration
Confidence
80% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/update-record.py (reported line 73)May include surrounding context.

python
else:
            print(f"Record '{full_record_name}' does not exist. Creating new record...")
            create_url = f"https://api.cloudflare.com/client/v4/zones/{zone_id}/dns_records"
            response = requests.post(create_url, headers=headers, json=payload, timeout=10)

        response.raise_for_status()
        result = response.json()

Tainted flow: 'create_url' from requests.get (line 72, network input) → requests.post (network output)

Medium
Category
Data Flow
Confidence
65% confidence
Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/update-record.py (reported line 73)May include surrounding context.

python
else:
            print(f"Record '{full_record_name}' does not exist. Creating new record...")
            create_url = f"https://api.cloudflare.com/client/v4/zones/{zone_id}/dns_records"
            response = requests.post(create_url, headers=headers, json=payload, timeout=10)

        response.raise_for_status()
        result = response.json()

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
97% confidence
Finding

The dependency specification uses an unpinned package name (requests) with no version constraint, making builds non-reproducible and allowing installation of newer releases with unexpected bugs or security regressions. In a skill that programmatically updates Cloudflare DNS, a compromised or vulnerable HTTP client library could affect credentials handling or outbound API requests.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text
requests

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
92% confidence
Finding

The manifest includes requests without a pinned version, so it is impossible to verify whether deployment will pull a release affected by one of multiple known advisories. Because this skill likely authenticates to Cloudflare and makes external HTTP requests, vulnerabilities in requests could plausibly expose credentials, mishandle redirects, or weaken transport/security guarantees depending on the resolved version.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.