cloudflare-mcp-server
Fail
Audited by Gen Agent Trust Hub on Sep 4, 2026
Risk Level: CRITICALINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill guides the creation of MCP servers that process data from external sources such as the GitHub API and user-provided input via the
this.elicit()method. This creates an attack surface for indirect prompt injection where malicious instructions could be embedded in the data retrieved from these external sources. - Ingestion points: GitHub API responses in
templates/mcp-oauth-proxy.ts, user input elicitation inSKILL.md. - Capability inventory: D1 database writes in
templates/mcp-with-d1.ts, image generation intemplates/mcp-with-workers-ai.ts, and repository management intemplates/mcp-oauth-proxy.ts. - Sanitization: The templates utilize Zod schemas for parameter validation, which mitigates simple schema confusion but does not fully prevent instruction injection within the text content.
- [EXTERNAL_DOWNLOADS]: The skill references several external resources and instructions for downloading tools and templates.
- Fetches official templates from Cloudflare's GitHub repository (
github.com/cloudflare/ai). - Instructs the installation of standard Node.js packages from the NPM registry.
- The troubleshooting guide and documentation include a reference to
https://oauth-provider.com/token. This URL is flagged as malicious by automated scanners, although it appears to be intended as a generic placeholder.
Recommendations
- Contains 1 malicious URL(s) - DO NOT USE
Audit Metadata