building-mcp-server-on-cloudflare
Warn
Audited by Gen Agent Trust Hub on Feb 17, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- EXTERNAL_DOWNLOADS (MEDIUM): The skill uses 'npm create cloudflare' to download templates from the 'cloudflare' organization (e.g., 'cloudflare/ai/demos/remote-mcp-authless'). As this organization is not on the trusted list, the integrity of the downloaded code is considered unverifiable.
- REMOTE_CODE_EXECUTION (MEDIUM): The skill utilizes 'npx' to run remote packages like '@modelcontextprotocol/inspector' and 'mcp-remote' directly from the npm registry without pinning versions or verifying package integrity.
- COMMAND_EXECUTION (MEDIUM): The 'query_db' tool example explicitly demonstrates accepting a raw SQL string as input and executing it directly on a D1 database. This pattern is highly susceptible to SQL injection and unauthorized data access if an attacker influences the agent's input.
- PRIVILEGE_ESCALATION (MEDIUM): The guide recommends a global installation of the Wrangler CLI ('npm install -g wrangler'), which typically requires administrative or root privileges.
- INDIRECT_PROMPT_INJECTION (LOW): The skill describes tools that ingest external data (e.g., 'get_weather' via fetch) and provides high-privilege tools (SQL execution) without implementing boundary markers or sanitization. Evidence: 1. Ingestion point: 'fetch' in 'get_weather'. 2. Boundary markers: Absent. 3. Capability inventory: Network fetch, SQL execution on D1. 4. Sanitization: Absent (uses Zod for type checking but not for escaping SQL/URLs).
Audit Metadata