cloudflare-temporary-deploy
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill uses shell scripts to invoke
npx wrangler, enabling the agent to deploy code to Cloudflare's infrastructure. This is consistent with the skill's stated purpose. - [EXTERNAL_DOWNLOADS]: The
deploy.shscript downloads and executes thewranglerpackage from the official NPM registry usingnpx. The package version is pinned to4.102.0to ensure consistency and security. - [SAFE]: The implementation follows several security best practices:
- Restricted Permissions: The
deploy.shscript usesumask 077andset -o noclobberwhen creating deployment logs to ensure sensitive information (like the temporary claim token) is only readable by the owner and not accidentally overwritten. - Credential Redaction: The Python parser script (
parse_deploy_output.py) redacts theclaimTokenby default to prevent accidental exposure of deployment ownership credentials in the agent's response. - User Transparency: Instructions in
SKILL.mdmandate user confirmation before public deployment and require the agent to explain the temporary nature and public accessibility of the resulting URLs.
Audit Metadata