cloudflare-drop
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTIONCREDENTIALS_UNSAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill automates the deployment process by executing the
wranglerCLI and usescurlto verify that the deployed URL is active and serving valid content.\n- [EXTERNAL_DOWNLOADS]: It fetches the official Cloudflarewranglerpackage from the npm registry to ensure the latest deployment tools are used.\n- [DYNAMIC_EXECUTION]: For password-protected deployments, the skill generates a Cloudflare Worker script and configuration at runtime, ensuring that the access code logic is handled server-side rather than in the client-side assets.\n- [CREDENTIALS_UNSAFE]: While the skill interacts with Cloudflare API tokens and OAuth configuration files, it adheres to security best practices by using restricted file permissions (0600) for temporary secrets and performing a full cleanup of staging materials upon completion or failure.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes local HTML files for publication; it mitigates risks by excluding hidden configuration files (like .env) and system directories from the deployment bundle while sanitizing all user-provided worker names.
Audit Metadata