cloudflare-security-audit-skill
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructions reference an installation command that fetches content from https://github.com/cloudflare/security-audit-skill. This is an official repository belonging to a well-known and trusted organization. \n- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from the codebase being audited. This creates a surface for indirect prompt injection where malicious instructions embedded in the code or comments could attempt to influence the auditing agents. \n
- Ingestion points: Local codebase files processed during recon and hunting phases. \n
- Boundary markers: None explicitly mentioned in the instructions for separating code from instructions. \n
- Capability inventory: Reading file contents and writing reports (architecture.md, REPORT.md, findings.json). \n
- Sanitization: No specific sanitization or escaping of ingested code content is described. \n- [COMMAND_EXECUTION]: The documentation includes commands for executing a local script validate-findings.cjs using node. This is part of the intended workflow for validating the generated findings.
Audit Metadata