cloudflare@r1

CAUTION

Publisher claims: "Discover and choose Cloudflare products for apps, APIs, AI agents, storage, networking, and security. Use for architecture and product selection, including when the user describes a need without naming a Cloudflare product; then find the relevant skill or documentation." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry skills.shPublisher cloudflare · joined 2 days agoInstalls 134KLast detonated 35 h ago

Dispute verdict

Behavior trace

Honeypot run · 0 s · 1 scenarios · 0 deviations

t+CategoryObserved action

0.0sprocessno install scripts in bundle

0.0sprocessscript backend runs setup only

Static findings

HIGH

npx invocation of non-well-known packagereferences/c3/configuration.md:38 · npx invocation of non-well-known package — may execute untrusted code

AST06

CRITICAL

Credential pass-through configurationreferences/containers/configuration.md:10 · Credential pass-through configuration — agent relays sensitive credentials

AST02

HIGH

npx invocation of non-well-known packagereferences/c3/configuration.md:39 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

npx invocation of non-well-known packagereferences/c3/gotchas.md:10 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

npx invocation of non-well-known packagereferences/c3/gotchas.md:88 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

npx invocation of non-well-known packagereferences/c3/configuration.md:81 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

npx invocation of non-well-known packagereferences/c3/gotchas.md:16 · npx invocation of non-well-known package — may execute untrusted code

AST06

MEDIUM

File type combined with upload actionreferences/hyperdrive/README.md:7 · File type combined with upload action — agent may exfiltrate local data files

AST07