Dieser Bericht ist nicht in der angeforderten Sprache verfügbar. Stattdessen wird der maßgebliche englische Bericht angezeigt.
Versionierte Sicherheitsbewertung
Berichts-ID: SA-7DB9B9F0
7/9/2026, 1:30:16 AM
cloudflare Sicherheitsbewertung v4
Zertifizierungsbericht zur Skill-Sicherheit
Auditmodell: claude Historischer Bericht
- Skillname
- cloudflare
- Version
- v4
- Betreuer
- cloudflare
- Abdeckung
- 321 Gescannte Dateien · 49,016 Analysierte Zeilen
- Richtlinienversion
- Nicht verfügbar
Höchster bestätigter Schweregrad eines Befunds
Kritisch
2 bestätigte Sicherheitsbefunde erfordern Aufmerksamkeit.
Installationskontext
Historische Nachweise
Dieser Bericht beschreibt möglicherweise nicht das derzeit installierbare Artefakt. Öffnen Sie die aktuelle Skill-Seite für Installationshinweise.
Aktuelle Skill-Seite öffnenDieser Bericht blockiert oder autorisiert weder das Manifest noch die ZIP-Datei.
The skill is primarily a large Cloudflare reference bundle with many static matches caused by documentation examples, placeholders, and product configuration snippets. A small number of command-execution examples remain security-sensitive because users or agents could copy them into real environments, but no hidden malware, prompt injection, credential exfiltration intent, or auto-executing installer behavior was found. Static review was capped at 400/2983 representative findings; omitted static matches are unconfirmed, so automatic publishing stays disabled until manual review.
Position melden
Historischer Bericht
Öffnen Sie den Auditverlauf, bevor Sie diesen Bericht zur Installation verwenden.
Audit-Nachweis
Nicht bescheinigungsfähig
Die erforderliche unveränderliche Bindung ist unvollständig.
Menschliche Überprüfung
Nicht überprüft
Für diesen Bericht ist keine menschliche Überprüfung verzeichnet.
Abdeckung
321 Gescannte Dateien · 49,016 Analysierte Zeilen
33 Elemente zur Überprüfung angezeigt
Einschränkungen
Dieser Bericht beansprucht keine Laufzeit- oder Sandbox-Ausführung und beweist nicht das Fehlen von Nebenwirkungen.
Beweiskette
Folgen Sie den Nachweisen von der Quellenbindung bis zum Installationsvertrag. Verfügbare Nachweise unterstützen die Überprüfung; sie sind keine Sicherheitsgarantie.
Quelle
Bindung nicht verfügbar
Artefakt
Identität unvollständig
Prüfung
Vollständig
Beobachtete Funktionen
„Beobachtet“ bedeutet, dass dieser Bericht unterstützende Nachweise erfasst hat. Nicht erfasst bedeutet nicht, dass eine Fähigkeit nicht vorhanden ist.
Enthält Skripte
Kann mit dem Skill enthaltenen Code ausführen.
An 50 Nachweisstellen beobachtet
Netzwerkzugriff
Kann eine Verbindung zu externen Diensten herstellen.
An 48 Nachweisstellen beobachtet
Dateisystemzugriff
Kann lokale Dateien lesen oder schreiben.
An 50 Nachweisstellen beobachtet
Umgebungsvariablen
Kann Werte aus der Prozessumgebung lesen.
An 29 Nachweisstellen beobachtet
Externe Befehle
Kann Befehle oder Programme außerhalb des Skills aufrufen.
An 66 Nachweisstellen beobachtet
Elemente der Fähigkeitsprüfung (31)
Hoch
Dynamic code evaluation with eval()
| **OpenFeature SDK** | Workers, Node.js, browser | `@cloudflare/flagship` + `@openfeature/server-sd
The reference mentions dynamic eval usage, which is dangerous if copied into application code. Context may be educational, so confidence is moderate rather than high.
Hoch
Process exec
const cursor = this.sql.exec('SELECT * FROM users WHERE email = ?', email);
The reference includes process or dynamic execution patterns. They appear to be examples, but such patterns are security-sensitive and should stay flagged for manual review.
Hoch
Process exec
this.sql.exec('UPDATE accounts SET balance = balance - ? WHERE id = ?', 100, 1);
The reference includes process or dynamic execution patterns. They appear to be examples, but such patterns are security-sensitive and should stay flagged for manual review.
Hoch
Process exec
this.sql.exec('UPDATE accounts SET balance = balance + ? WHERE id = ?', 100, 2);
The reference includes process or dynamic execution patterns. They appear to be examples, but such patterns are security-sensitive and should stay flagged for manual review.
Hoch
Process exec
this.sql.exec(`
The reference includes process or dynamic execution patterns. They appear to be examples, but such patterns are security-sensitive and should stay flagged for manual review.
Hoch
Process exec
this.sql.exec("CREATE TABLE events(id INTEGER PRIMARY KEY)");
The reference includes process or dynamic execution patterns. They appear to be examples, but such patterns are security-sensitive and should stay flagged for manual review.
Hoch
Process exec
this.sql.exec("INSERT INTO events VALUES (?)", 1234567890123456789n); // Corrupts!
The reference includes process or dynamic execution patterns. They appear to be examples, but such patterns are security-sensitive and should stay flagged for manual review.
Hoch
Process exec
this.sql.exec("CREATE TABLE events(id TEXT PRIMARY KEY)");
The reference includes process or dynamic execution patterns. They appear to be examples, but such patterns are security-sensitive and should stay flagged for manual review.
Hoch
Process exec
this.sql.exec("INSERT INTO events VALUES (?)", "1234567890123456789");
The reference includes process or dynamic execution patterns. They appear to be examples, but such patterns are security-sensitive and should stay flagged for manual review.
Hoch
Process exec
this.sql.exec(`
The reference includes process or dynamic execution patterns. They appear to be examples, but such patterns are security-sensitive and should stay flagged for manual review.
Hoch
Process exec
this.sql.exec(`CREATE TABLE users(id INTEGER PRIMARY KEY, name TEXT)`);
The reference includes process or dynamic execution patterns. They appear to be examples, but such patterns are security-sensitive and should stay flagged for manual review.
Hoch
Process exec
this.sql.exec("INSERT INTO _sql_schema_migrations (id) VALUES (1)");
The reference includes process or dynamic execution patterns. They appear to be examples, but such patterns are security-sensitive and should stay flagged for manual review.
Hoch
Process exec
this.sql.exec(`ALTER TABLE users ADD COLUMN email TEXT`);
The reference includes process or dynamic execution patterns. They appear to be examples, but such patterns are security-sensitive and should stay flagged for manual review.
Hoch
Process exec
this.sql.exec("INSERT INTO _sql_schema_migrations (id) VALUES (2)");
The reference includes process or dynamic execution patterns. They appear to be examples, but such patterns are security-sensitive and should stay flagged for manual review.
Hoch
Process exec
this.sql.exec('DELETE FROM requests WHERE key = ? AND timestamp < ?', key, now - window);
The reference includes process or dynamic execution patterns. They appear to be examples, but such patterns are security-sensitive and should stay flagged for manual review.
Hoch
Python exec() function
const cursor = this.sql.exec('SELECT * FROM users WHERE email = ?', email);
The reference includes process or dynamic execution patterns. They appear to be examples, but such patterns are security-sensitive and should stay flagged for manual review.
Hoch
Python exec() function
this.sql.exec('UPDATE accounts SET balance = balance - ? WHERE id = ?', 100, 1);
The reference includes process or dynamic execution patterns. They appear to be examples, but such patterns are security-sensitive and should stay flagged for manual review.
Hoch
Python exec() function
this.sql.exec('UPDATE accounts SET balance = balance + ? WHERE id = ?', 100, 2);
The reference includes process or dynamic execution patterns. They appear to be examples, but such patterns are security-sensitive and should stay flagged for manual review.
Hoch
Python exec() function
this.sql.exec(`
The reference includes process or dynamic execution patterns. They appear to be examples, but such patterns are security-sensitive and should stay flagged for manual review.
Hoch
Python exec() function
this.sql.exec("CREATE TABLE events(id INTEGER PRIMARY KEY)");
The reference includes process or dynamic execution patterns. They appear to be examples, but such patterns are security-sensitive and should stay flagged for manual review.
Hoch
Python exec() function
this.sql.exec("INSERT INTO events VALUES (?)", 1234567890123456789n); // Corrupts!
The reference includes process or dynamic execution patterns. They appear to be examples, but such patterns are security-sensitive and should stay flagged for manual review.
Hoch
Python exec() function
this.sql.exec("CREATE TABLE events(id TEXT PRIMARY KEY)");
The reference includes process or dynamic execution patterns. They appear to be examples, but such patterns are security-sensitive and should stay flagged for manual review.
Hoch
Python exec() function
this.sql.exec("INSERT INTO events VALUES (?)", "1234567890123456789");
The reference includes process or dynamic execution patterns. They appear to be examples, but such patterns are security-sensitive and should stay flagged for manual review.
Hoch
Python exec() function
this.sql.exec(`
The reference includes process or dynamic execution patterns. They appear to be examples, but such patterns are security-sensitive and should stay flagged for manual review.
Hoch
Python exec() function
this.sql.exec(`CREATE TABLE users(id INTEGER PRIMARY KEY, name TEXT)`);
The reference includes process or dynamic execution patterns. They appear to be examples, but such patterns are security-sensitive and should stay flagged for manual review.
Hoch
Python exec() function
this.sql.exec("INSERT INTO _sql_schema_migrations (id) VALUES (1)");
The reference includes process or dynamic execution patterns. They appear to be examples, but such patterns are security-sensitive and should stay flagged for manual review.
Hoch
Python exec() function
this.sql.exec(`ALTER TABLE users ADD COLUMN email TEXT`);
The reference includes process or dynamic execution patterns. They appear to be examples, but such patterns are security-sensitive and should stay flagged for manual review.
Hoch
Python exec() function
this.sql.exec("INSERT INTO _sql_schema_migrations (id) VALUES (2)");
The reference includes process or dynamic execution patterns. They appear to be examples, but such patterns are security-sensitive and should stay flagged for manual review.
Hoch
Python exec() function
this.sql.exec('DELETE FROM requests WHERE key = ? AND timestamp < ?', key, now - window);
The reference includes process or dynamic execution patterns. They appear to be examples, but such patterns are security-sensitive and should stay flagged for manual review.
Hoch
sudo privilege escalation
sudo cloudflared service install
The reference includes privileged service-management commands. They are documentation examples, but they can alter host persistence or privileges if followed without review.
Hoch
sudo privilege escalation
sudo launchctl start com.cloudflare.cloudflared
The reference includes privileged service-management commands. They are documentation examples, but they can alter host persistence or privileges if followed without review.
Risikofunde
Bestätigte Sicherheitsbedenken werden von Punkten getrennt, die noch überprüft werden müssen.
Bestätigte Sicherheitsbedenken (2)
RISK-001 Kritisch
Pipe to shell pattern
await sandbox.exec('curl -fsSL https://code-server.dev/install.sh | sh');
The reference contains a pipe-to-shell install command that an agent or user could copy into a live environment. Even though it is documentation, this pattern is hazardous and should be replaced with safer installation steps.
RISK-002 Hoch
Systemd service enablement
systemctl start cloudflared && systemctl enable cloudflared
The reference includes privileged service-management commands. They are documentation examples, but they can alter host persistence or privileges if followed without review.
Abhilfemaßnahmen
Von diesem Audit vorgeschlagene Korrekturen wurden erfasst. Ihre Umsetzung liegt in der Verantwortung des Maintainers.
- FIX-001KritischPipe-to-shell installation example in sandbox guidance.Replace the curl-to-shell command with explicit download, checksum verification, and reviewed installation steps.
- FIX-002HochPrivileged tunnel service examples can alter host persistence.Add clear warnings and require manual approval before running systemd or sudo commands from the references.
- FIX-003HochDynamic execution examples may be copied into application code.Prefer safer APIs, constrain inputs, and label exec or eval examples as non-production demonstrations.
- FIX-004MittelStatic review cappedManually review the omitted 2583 static analyzer matches or reduce bundled generated/vendor/reference content before enabling automatic publication.
- FIX-005MittelMany examples mention secrets, certificates, tokens, and environment variables.Keep placeholder values clearly fake and remind users never to paste real credentials into prompts or source files.
Expertennachweise
Unveränderliche Subjektidentität, Scanner-Metadaten, verworfene Treffer und Nachweise auf Quellcodeebene.
Artefakt-Subjekt
- Marketplace-Commit
- Nicht verfügbar
- Inhalts-Hash
- Nicht verfügbar
- Tree-Hash
- Nicht verfügbar
- Skill-Pfad
- Nicht verfügbar
- Hash der Audit-Nutzlast
- Nicht verfügbar
Analysemetadaten
Auditmodell: claude
Analysestatus: Vollständig
Der Umfang ist auf die aufgezeichneten Dateien, Zeilen, Methoden und Nachweise beschränkt. Es wird keine Ausführung in einer Laufzeitumgebung oder Sandbox beansprucht.
Verifizieren und exportieren
Das Manifest und die Lockdatei binden Installationsartefakte an kryptografische Hashes. Diese Integritätsaussage ist von der Sicherheitsbewertung getrennt.
Audit-Nachweis: not_attestable