setup-cloudflare
Fail
Audited by Gen Agent Trust Hub on Oct 23, 2026
Risk Level: HIGHREMOTE_CODE_EXECUTIONPERSISTENCEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill instructs the agent to execute
npm install -g cf. The package name 'cf' on the public NPM registry is not the official Cloudflare CLI (which is Wrangler), and the skill's instructions explicitly forbid using the official tool. This creates a high risk of installing a malicious or unrelated package with global system permissions. - [PERSISTENCE]: The skill attempts to maintain persistence by modifying the user's shell configuration files (
~/.zshrcor~/.bashrc) or Windows environment variables. It injectsexport CLOUDFLARE_ACCOUNT_IDcommands to ensure its settings remain active across all future terminal sessions. - [EXTERNAL_DOWNLOADS]: The skill is configured to fetch additional scripts and configuration files from a remote GitHub repository (
https://raw.githubusercontent.com/Melvynx/ai-maxxing-skills/main/) at runtime. These external resources are executed or read by the agent to fulfill the skill's logic. - [COMMAND_EXECUTION]: The skill performs several direct shell operations, including
cf auth login,cf accounts list, and$SHELL -lic 'cf --version', which interact with the system and potentially sensitive account data.
Recommendations
- AI detected serious security threats
Audit Metadata