heating the forge...

@forgecat/openai_skills_cloudflare-deploy — Security Risk Report | ForgeCat

openai_skills_cloudflare-deploy

Security risk report for @forgecat/openai_skills_cloudflare-deploy v0.0.10

SRC-010High

Static scanner flagged danger: 24 reference files are listed as untrusted sources (intent/tool-source hints), indicating the profile pulls external or unverified documentation.
Profile metadata claims 'Original repository: https://github.com/openai/skills' and 'Author: OpenAI', but the actual content is a Cloudflare-specific skill with extensive Cloudflare product references—source attribution appears misaligned or the profile is a derivative without clear provenance.
Many reference files (containers, hyperdrive, pipelines, vectorize, workerd, etc.) are not included in the provided content, making it impossible to verify their integrity or detect injected malicious guidance.

Details

Findings

Data exfiltration
skills/cloudflare-deploy/references/cron-triggers/patterns.md · SKILL-002
Data exfiltration
skills/cloudflare-deploy/references/email-workers/gotchas.md · SKILL-002
Data exfiltration
skills/cloudflare-deploy/references/images/api.md · SKILL-002
Data exfiltration
skills/cloudflare-deploy/references/images/patterns.md · SKILL-002
Suspicious URLs
skills/cloudflare-deploy/references/miniflare/api.md · SKILL-007
Data exfiltration
skills/cloudflare-deploy/references/pages-functions/patterns.md · SKILL-002
Data exfiltration
skills/cloudflare-deploy/references/queues/patterns.md · SKILL-002
Data exfiltration
skills/cloudflare-deploy/references/realtime-sfu/patterns.md · SKILL-002
Code obfuscation
skills/cloudflare-deploy/references/secrets-store/patterns.md · SKILL-005
Code obfuscation
skills/cloudflare-deploy/references/snippets/gotchas.md · SKILL-005
System modification
skills/cloudflare-deploy/references/tunnel/patterns.md · SKILL-009
Data exfiltration
skills/cloudflare-deploy/references/stream/api.md · SKILL-002
Data exfiltration
skills/cloudflare-deploy/references/stream/gotchas.md · SKILL-002
Code obfuscation

Low

Content is educational documentation for Cloudflare deployment tools; no instructions to ignore system prompts, read credentials, exfiltrate data, or install remote payloads.
Guidance on authentication, API tokens, and secrets is standard best-practice documentation (e.g., 'use wrangler secret put', 'store keys in dashboard BYOK'), not instructions to leak or misuse them.
No evidence of prompt injection, role hijacking, or guidance poisoning—the skill describes legitimate Cloudflare products and their APIs without steering the AI toward malicious actions.

Details

Findings

Invisible characters detected
skills/cloudflare-deploy/references/api-shield/configuration.md · SKILL-011
Invisible characters detected
skills/cloudflare-deploy/references/argo-smart-routing/README.md · SKILL-011
Invisible characters detected
skills/cloudflare-deploy/references/containers/README.md · SKILL-011
Invisible characters detected
skills/cloudflare-deploy/references/containers/api.md · SKILL-011
Invisible characters detected

Low

No tool definitions or MCP servers declared in the profile; skill is purely documentation/reference material with no executable hooks or permissions requested.
Content describes how to use Cloudflare APIs and SDKs but does not grant the AI agent any direct authority—deployment actions require explicit user invocation and Cloudflare credentials.
Guidance on 'sandbox_permissions=require_escalated' for network access is transparent and conditional, not a blanket demand for elevated authority.

Details

Evidence

Profile header: 'Declared tools (normalized categories; paths are untrusted): (none declared)'
Profile header: 'MCP servers (untrusted data): (none)'
SKILL.md: 'If deployment fails due to network issues... rerun the deploy with escalated permissions (use sandbox_permissions=require_escalated).' — user-facing, conditional guidance.

Low

No MCP servers defined in the profile; all content is static markdown documentation.
No hidden instructions in tool descriptions, binary execution, or unrestricted network/filesystem access requested.
References to external services (Cloudflare APIs, Workers AI, etc.) are standard API calls, not arbitrary code execution.

Details

Evidence

Profile header: 'MCP servers (untrusted data): (none)'
Content consists entirely of markdown reference files with code examples and configuration guidance—no MCP server definitions or dynamic execution.