cloudflare-browser-rendering
Pass
Audited by Gen Agent Trust Hub on Apr 29, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [PROMPT_INJECTION]: The skill includes an AI-enhanced scraping template (
templates/ai-enhanced-scraper.ts) that ingests content from external URLs and passes it to a Large Language Model for data extraction. This pattern creates an inherent surface for indirect prompt injection, as malicious instructions could be embedded in the scraped HTML to manipulate the model's extraction logic. The template includes system-level instructions to mitigate this, but does not perform content sanitization. - [COMMAND_EXECUTION]: The
scripts/check-versions.shscript is provided as a local development tool to check for package updates via thenpm viewcommand. This script is intended for use in a controlled local environment and does not pose a threat to the runtime environment of the agent or the Cloudflare Workers platform. - [EXTERNAL_DOWNLOADS]: The documentation and configuration files recommend installing verified official packages from the Cloudflare organization, such as
@cloudflare/puppeteerand@cloudflare/playwright, and provide links to official Cloudflare documentation and source repositories.
Audit Metadata