mj-cf-dns
Pass
Audited by Gen Agent Trust Hub on Jun 15, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill implements a 'verify before write' workflow. It enforces rules in
SKILL.mdrequiring the agent to list existing records before modification and to default to dry-run plans unless explicitly overridden by the user. - [SAFE]: Credential management follows best practices. Instructions explicitly forbid the agent from printing API tokens, only allowing it to report their presence. The helper script
scripts/mj-cf-dns.mjsconsumes these credentials directly from environment variables. - [SAFE]: Command execution is handled securely. The script uses
execFileSyncto invoke thedigutility for DNS verification. By passing arguments as an array and avoiding the shell, it prevents command injection vulnerabilities. - [SAFE]: Network operations are restricted to the official Cloudflare API (
api.cloudflare.com). No evidence of data exfiltration or communication with suspicious third-party domains was found. - [SAFE]: Dependency usage is standard for the described purpose. The skill utilizes
npx wrangler, which is the official tool for Cloudflare Workers, and standard Node.js built-ins.
Audit Metadata