The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external sources including worker logs (via query_worker_observability), build logs (via workers_builds_get_build_logs), and HTML/Markdown content from URLs (via get_url_html_content and get_url_markdown).
Ingestion points: SKILL.md defines tools that pull data from Cloudflare observability and external web pages.
Boundary markers: The skill instructions do not specify the use of delimiters or 'ignore embedded instructions' warnings when processing this external data.
Capability inventory: The skill possesses high-privilege tools such as container_exec (shell command execution) and d1_database_query (SQL execution).
Sanitization: There is no evidence of sanitization, escaping, or validation of the external content before it is interpolated into the agent's context.
[COMMAND_EXECUTION]: The skill includes the container_exec tool, which allows the execution of arbitrary shell commands within a sandbox environment. While categorized under a 'Super Admin' tier for isolated environments, it represents a significant capability that could be misused if the agent is influenced by malicious input.
[DYNAMIC_EXECUTION]: The d1_database_query tool enables the execution of arbitrary SQL statements. This is a dynamic execution sink that could be vulnerable to schema confusion or injection if the agent processes malicious instructions embedded in the data it reads.

mcp-cloudflare