cloudflare-deploy
Warn
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: MEDIUMMETADATA_POISONINGINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [METADATA_POISONING]: The skill's YAML frontmatter in SKILL.md identifies the author as 'github.com/openai/skills', which is misleading as it contradicts the system-provided author information ('tech-leads-club').
- [INDIRECT_PROMPT_INJECTION]: The skill facilitates the ingestion of untrusted external data, creating an exploitable surface area for indirect prompt injection.
- Ingestion points: Handlers for incoming emails (references/email-workers/api.md), web scraping endpoints (references/browser-rendering/api.md), and AI Gateway proxy traffic (references/ai-gateway/README.md).
- Boundary markers: Documentation examples mostly lack explicit delimiters or instructions for the agent to ignore instructions embedded within external data.
- Capability inventory: The skill enables powerful runtime operations, including shell command execution in containers (references/sandbox/api.md), database writes (references/d1/api.md), and file storage interaction (references/r2/api.md).
- Sanitization: While the documentation provides guidance on preventing injection (e.g., SQL prepared statements in references/d1/api.md), the surface for malicious data to influence agent behavior remains present.
- [EXTERNAL_DOWNLOADS]: Documentation patterns include downloading and executing content from external sources.
- Recommends installation scripts from remote domains (e.g., code-server.dev in references/sandbox/patterns.md).
- Includes patterns for fetching arbitrary application templates from GitHub via CLI tools (references/c3/patterns.md).
Audit Metadata