The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill directs the agent to install the cf package from npm (npm i -g cf), falsely claiming it is the "official Cloudflare CLI". The actual official CLI for Cloudflare is wrangler. The cf package on npm is associated with Cloud Foundry, not Cloudflare, creating a supply chain risk through misdirection.
[CREDENTIALS_UNSAFE]: The instructions require the user to perform OAuth authentication via cf auth login and to export CLOUDFLARE_ACCOUNT_ID. Providing these credentials to an incorrect and unverified tool exposes the user's Cloudflare environment to compromise.
[COMMAND_EXECUTION]: The core functionality of the skill relies on executing shell commands using a tool that is not the official provider CLI, including commands for sensitive operations like modifying DNS, deploying Workers, and accessing R2 storage.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest DNS record data from various third-party services (e.g., Stripe, Google, Lumail) and apply them to the Cloudflare environment.
Ingestion points: DNS record details provided by external services mentioned in SKILL.md.
Boundary markers: No specific delimiters or "ignore instructions" markers are provided when interpolating external record data into the cf dns records create command.
Capability inventory: Full CLI access for DNS management, Worker deployment (cf deploy), R2 storage manipulation (cf r2 objects put), and WAF/SSL configuration.
Sanitization: The skill lacks any instruction to validate or sanitize the record content (type, name, content, priority) before execution, allowing for potential command injection or malicious record insertion if the external data is poisoned.

cloudflare