cloudflare-browser-rendering
Pass
Audited by Gen Agent Trust Hub on Oct 6, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill documents workflows for scraping web content and processing it with LLMs (e.g., Workers AI), creating a surface for indirect prompt injection.
- Ingestion points: The skill uses
page.content()to extract raw HTML from external websites and passes it to theai.runmethod (SKILL.md, Section: AI-Powered Web Scraper). - Boundary markers: The provided code examples lack explicit delimiters (e.g., XML tags or triple quotes) or 'ignore embedded instructions' warnings when interpolating the
contentvariable into the LLM prompt. - Capability inventory: The skill utilizes powerful capabilities including browser automation (
puppeteer.launch), persistent storage (env.KV.put,env.R2.put), and downstream AI processing (ai.run). - Sanitization: There is no evidence of sanitization, filtering, or HTML cleaning performed on the external content before it is processed by the AI model.
Audit Metadata