building-ai-agent-on-cloudflare
Fail
Audited by Gen Agent Trust Hub on Feb 16, 2026
Risk Level: HIGHPROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION] (HIGH): The skill is highly susceptible to Indirect Prompt Injection (Category 8). It ingests untrusted data from WebSocket connections in the
onMessageandhandleChatmethods and interpolates it directly into the AI prompt history without boundary markers. Because the agent possesses 'write' and 'execute' capabilities—specifically the ability to perform SQL operations viathis.sqland manage background tasks viathis.schedule—an attacker could use crafted messages to manipulate the LLM into performing unauthorized database or scheduling actions. - [EXTERNAL_DOWNLOADS] (MEDIUM): The instructions require the installation and execution of external tools. Evidence:
npm install -g wranglerandnpm create cloudflare@latest. While these are standard for the Cloudflare ecosystem, the provider is not included in the explicit 'Trusted External Sources' list, making these unverifiable remote dependencies that execute with local user privileges. - [COMMAND_EXECUTION] (LOW): The skill encourages the use of
npx wrangler deployand other CLI-based deployment commands which involve executing locally installed packages that were downloaded from external registries.
Recommendations
- AI detected serious security threats
- Contains 1 malicious URL(s) - DO NOT USE
Audit Metadata