cloudflare-queues
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to consume and process messages from Cloudflare Queues, which serves as a significant ingestion point for potentially untrusted data from external producers. The agent could potentially be manipulated by malicious instructions embedded within queue message bodies.
- Ingestion points: The
queuehandler inSKILL.mdand several template files (templates/queues-consumer-basic.ts,templates/queues-consumer-explicit-ack.ts, etc.) process message bodies fromMessageBatchobjects. - Boundary markers: Most provided templates do not implement explicit boundary markers or "ignore" instructions to separate data from instructions within the message payload.
- Capability inventory: The skill includes capabilities for network operations (calling APIs via
fetch), database modifications (D1), and storage operations (R2/KV), creating a functional attack surface if message content is not handled carefully. - Sanitization: Although
references/http-publishing.mdcontains a section on input validation best practices, the core consumer templates inSKILL.mdand other files lack default sanitization or strict schema enforcement.
Audit Metadata