cf-cli@r1

CAUTION

Publisher claims: "Cloudflare's official cf CLI (beta) for the public Cloudflare API and Workers projects. Use for finding and running Cloudflare commands from the terminal — sign-in and profiles, cf cli search, cf schema, cf deploy/dev/build, resource commands for DNS, zones, D1, KV, and R2 — and for choosing between cf and Wrangler in a project." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry skills.shPublisher cloudflare · joined 2 days agoInstalls 10,018Last detonated 2 h ago

Dispute verdict

Behavior trace

Honeypot run · 0 s · 1 scenarios · 0 deviations

t+CategoryObserved action

0.0sprocessno install scripts in bundle

0.0sprocessscript backend runs setup only

Static findings

HIGH

npx invocation of non-well-known packageSKILL.md:87 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

Instructs the agent to modify its persistent memory or instruction filesSKILL.md:44 · Instructs the agent to modify its persistent memory or instruction files

AST01

HIGH

npx invocation of non-well-known packageSKILL.md:84 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

npx invocation of non-well-known packageSKILL.md:86 · npx invocation of non-well-known package — may execute untrusted code

AST06