cloudflare

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 0.90). The reference docs contain explicit examples that log/record API keys or return full environment bindings (env) — patterns that can leak credentials and enable data exfiltration if used as-is or automated, representing a high-risk abuse vector.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). references/agents-sdk/api.md shows an agent onMessage(conn, msg) that parses and appends WebSocket client text into agent state (this.setState({messages: ...})) and example patterns show chat/email request handlers that process user-provided input, so outsider-authored free text can reach the agent without selecting a specific trusted item first.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The Agents SDK examples register and call out to an MCP server (env.MCP_SERVER_URL → https://mcp.example.com) at runtime to fetch AI tools which are injected into the agent's toolset and directly influence prompts/behavior, so this external URL can control agent instructions.