cliproxyapi-cloudflare-stack
Fail
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: HIGHREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPRIVILEGE_ESCALATIONPERSISTENCEINDIRECT_PROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill instructions direct the user to clone a repository from an untrusted account (
github.com/xsser/cliproxyapi-cloudflare-stack.git) and immediately execute a shell script (scripts/deploy_vm.sh) with root-level impacts. - [EXTERNAL_DOWNLOADS]: Pulls a third-party Docker image
cliproxyapi/cliproxyapifrom Docker Hub. This image is not from a verified or trusted vendor and could contain unvetted code. - [EXTERNAL_DOWNLOADS]: Fetches the
cloudflaredbinary from Cloudflare's official GitHub releases and installs thewranglerCLI via the NPM registry. - [COMMAND_EXECUTION]: The skill uses extensive shell commands to manage system states, including
docker,wrangler, andcloudflaredfor container and network management. - [PRIVILEGE_ESCALATION]: Uses
sudoto install system packages and modify/etc/systemd/system/to register new background services, requiring administrative access. - [PERSISTENCE]: Configures a permanent background service using
systemd(cloudflared-cpa.service) to maintain a Cloudflare tunnel across system reboots. - [INDIRECT_PROMPT_INJECTION]: The skill establishes an LLM API gateway that processes untrusted traffic. This creates a surface for indirect prompt injection where malicious instructions could be embedded in the data being proxied between clients and LLM providers. Mitigation requires strict sanitization of the proxied content.
Recommendations
- AI detected serious security threats
Audit Metadata