The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses child_process.execFileSync to run npm and curl commands. The npm command is used to invoke the wrangler CLI for site deployment, while curl is utilized to verify that the deployed URL is active and serving the expected content.
[EXTERNAL_DOWNLOADS]: The skill downloads and executes the wrangler CLI directly from the npm registry using npm exec --yes wrangler@latest. This is a standard and supported method for using the official Cloudflare deployment tool.
[INDIRECT_PROMPT_INJECTION]: The skill ingests and processes user-provided HTML files and sibling assets for deployment. While this content could theoretically contain malicious instructions, the skill does not interpret the content as instructions for itself and includes filters to prevent the accidental upload of sensitive directories such as .git or node_modules.
[CREDENTIALS_UNSAFE]: The skill manages Cloudflare authentication via environment variables (CLOUDFLARE_API_TOKEN and CF_API_TOKEN). It also includes a documented procedure to temporarily rename the local Wrangler OAuth configuration file (default.toml) to enable anonymous temporary previews when credentials are not configured, with a guaranteed restoration logic in a finally block.

cloudflare-drop