The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill templates and utility scripts perform network requests to Cloudflare's official domains to fetch public certificates necessary for authentication token verification.
Evidence: Found in templates/jwt-validation-manual.ts and scripts/test-access-jwt.sh which target https://${team_domain}/cdn-cgi/access/certs.
Context: These operations target a well-known service and are a fundamental requirement for the skill's Zero Trust functionality.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted JWT (JSON Web Token) strings provided in HTTP headers, which constitutes a data ingestion surface.
Ingestion points: CF-Access-JWT-Assertion header in various integration templates including templates/hono-basic-setup.ts and templates/jwt-validation-manual.ts.
Capability inventory: The skill uses validated identity data to authorize requests and provide user context to the backend application.
Boundary markers: Not applicable for encoded JWT strings.
Sanitization: The skill implements strict validation logic including cryptographic signature verification, expiration (exp) checking, and audience (aud)/issuer (iss) matching to ensure the integrity and authenticity of the ingested data.
[COMMAND_EXECUTION]: The skill includes interactive bash scripts intended to assist developers with configuration and token debugging.
Evidence: scripts/create-service-token.sh and scripts/test-access-jwt.sh.
Analysis: These scripts are local development aids that use standard utilities like curl, jq, and base64. They do not perform unauthorized file system modifications, privilege escalation, or remote script execution.

cloudflare-zero-trust-access