Este informe no está traducido al idioma solicitado. Se muestra en su lugar el informe canónico en inglés.

Evaluación de seguridad versionada

ID del informe: SA-776F3ACE

7/5/2026, 7:16:22 AM

cloudflare evaluación de seguridad v3

Informe de certificación de seguridad de la habilidad

Historial de auditorías

Modelo de auditoría: codex Informe histórico

Nombre de la habilidad: cloudflare
Versión: v3
Mantenedor: cloudflare
Fuente: github.com/cloudflare/skills/tree/main/skills/cloudflare/
Cobertura: 321 Archivos escaneados · 49,016 Líneas analizadas
Versión de la política: No disponible

Gravedad máxima de hallazgo confirmada

Crítico

4 hallazgos de seguridad confirmados requieren atención.

Contexto de instalación

Evidencia histórica

Este informe podría no describir el artefacto instalable actualmente. Abra la página actual de la Skill para obtener orientación de instalación.

Abrir la página actual de la habilidad

Este informe no bloquea ni autoriza el manifiesto ni el ZIP.

Most static findings are false positives from Markdown, Cloudflare API examples, SQL exec calls, and documented placeholder secrets. Confirmed risks remain in Sandbox examples that promote unsafe shell execution, token-in-URL cloning, and untrusted command construction, plus Tunnel service-install examples that require administrator approval.

Posición del informe

Informe histórico

Abra el historial de auditorías antes de usar este informe para instalar.

Atestación de auditoría

No se puede certificar

La vinculación inmutable requerida está incompleta.

Verificación humana

No verificado

No se ha registrado ninguna verificación humana para este informe.

Cobertura

321 Archivos escaneados · 49,016 Líneas analizadas

27 elementos mostrados para revisión

Limitaciones

Este informe no afirma ninguna ejecución en tiempo de ejecución ni en entorno aislado y no prueba la ausencia de efectos secundarios.

Cadena de evidencias

Sigue la evidencia desde la vinculación del código fuente hasta el contrato de instalación. La evidencia disponible permite la verificación; no constituye una garantía de seguridad.

Fuente

Vinculación no disponible
Artefacto

Identidad incompleta
Auditoría

Completo
Contrato de instalación

Abrir el manifiesto para verificar
Abrir el manifiesto

Capacidades observadas

Observado significa que este informe registró evidencia de respaldo. No registrado no prueba que una capacidad esté ausente.

Contiene scripts

Puede ejecutar código incluido con la habilidad.

Observado en 66 ubicaciones de evidencia

Acceso a red

Puede conectarse a servicios externos.

Observado en 928 ubicaciones de evidencia

Acceso al sistema de archivos

Puede leer o escribir archivos locales.

Observado en 228 ubicaciones de evidencia

Variables de entorno

Puede leer valores del entorno del proceso.

Observado en 200 ubicaciones de evidencia

Comandos externos

Puede invocar comandos o programas fuera de la habilidad.

Observado en 565 ubicaciones de evidencia

Elementos de revisión de capacidades (23)

Crítico

references/sandbox/patterns.md:40

Python exec() function

await sandbox.exec('curl -fsSL https://code-server.dev/install.sh | sh');

This finding is tied to the same curl-to-shell sandbox example. It fetches code from the network and executes it without pinning or verification.

Crítico

references/sandbox/patterns.md:40

Process exec

await sandbox.exec('curl -fsSL https://code-server.dev/install.sh | sh');

This finding is tied to the same curl-to-shell sandbox example. It fetches code from the network and executes it without pinning or verification.

Crítico

references/sandbox/patterns.md:40

Hardcoded URL

await sandbox.exec('curl -fsSL https://code-server.dev/install.sh | sh');

This finding is tied to the same curl-to-shell sandbox example. It fetches code from the network and executes it without pinning or verification.

Alto

references/sandbox/api.md:167

Python exec() function

const result = await sandbox.exec('python /tmp/code.py');

The lifecycle example writes a variable named code to /tmp/code.py and executes it. This is safe only for trusted code and needs explicit validation guidance.

Alto

references/sandbox/api.md:167

Process exec

const result = await sandbox.exec('python /tmp/code.py');

The lifecycle example writes a variable named code to /tmp/code.py and executes it. This is safe only for trusted code and needs explicit validation guidance.

Alto

references/sandbox/api.md:166

Temp directory access

await sandbox.writeFile('/tmp/code.py', code);

The lifecycle example writes a variable named code to /tmp/code.py and executes it. This is safe only for trusted code and needs explicit validation guidance.

Alto

references/sandbox/api.md:167

Temp directory access

const result = await sandbox.exec('python /tmp/code.py');

The lifecycle example writes a variable named code to /tmp/code.py and executes it. This is safe only for trusted code and needs explicit validation guidance.

Alto

references/sandbox/gotchas.md:29

Python exec() function

return await sandbox.exec(cmd);

The retry helper executes a caller-supplied command string. It may be legitimate, but it needs a validation boundary to avoid command injection.

Alto

references/sandbox/gotchas.md:29

Process exec

return await sandbox.exec(cmd);

The retry helper executes a caller-supplied command string. It may be legitimate, but it needs a validation boundary to avoid command injection.

Alto

references/sandbox/patterns.md:138

Python exec() function

await sandbox.exec(`git clone -b ${branch} ${repo} /workspace/repo`);

The CI example interpolates request-supplied repo and branch values directly into a shell command. This creates a command-injection risk unless inputs are strictly validated.

Alto

references/sandbox/patterns.md:186

Python exec() function

const result = await session.exec(`python3 -c "${code}"`);

The session example executes request body content through python3 -c with shell interpolation. This is unsafe untrusted code execution guidance.

Alto

references/sandbox/patterns.md:200

Python exec() function

await sandbox.exec(`git clone https://${env.GITHUB_TOKEN}@github.com/user/repo.git`);

The example embeds GITHUB_TOKEN directly in a git clone URL. Tokens in URLs can leak through logs, shell history, process listings, and error messages.

Alto

references/sandbox/patterns.md:138

Process exec

await sandbox.exec(`git clone -b ${branch} ${repo} /workspace/repo`);

The CI example interpolates request-supplied repo and branch values directly into a shell command. This creates a command-injection risk unless inputs are strictly validated.

Alto

references/sandbox/patterns.md:186

Process exec

const result = await session.exec(`python3 -c "${code}"`);

The session example executes request body content through python3 -c with shell interpolation. This is unsafe untrusted code execution guidance.

Alto

references/sandbox/patterns.md:200

Process exec

await sandbox.exec(`git clone https://${env.GITHUB_TOKEN}@github.com/user/repo.git`);

The example embeds GITHUB_TOKEN directly in a git clone URL. Tokens in URLs can leak through logs, shell history, process listings, and error messages.

Alto

references/sandbox/patterns.md:138-159

Ruby/shell backtick execution

await sandbox.exec(`git clone -b ${branch} ${repo} /workspace/repo`);

The CI example interpolates request-supplied repo and branch values directly into a shell command. This creates a command-injection risk unless inputs are strictly validated.

Alto

references/sandbox/patterns.md:186-191

Ruby/shell backtick execution

const result = await session.exec(`python3 -c "${code}"`);

The session example executes request body content through python3 -c with shell interpolation. This is unsafe untrusted code execution guidance.

Alto

references/sandbox/patterns.md:200-201

Ruby/shell backtick execution

await sandbox.exec(`git clone https://${env.GITHUB_TOKEN}@github.com/user/repo.git`);

The example embeds GITHUB_TOKEN directly in a git clone URL. Tokens in URLs can leak through logs, shell history, process listings, and error messages.

Alto

references/sandbox/patterns.md:200

Hardcoded URL

await sandbox.exec(`git clone https://${env.GITHUB_TOKEN}@github.com/user/repo.git`);

The example embeds GITHUB_TOKEN directly in a git clone URL. Tokens in URLs can leak through logs, shell history, process listings, and error messages.

Alto

references/sandbox/patterns.md:200

Git platform tokens

await sandbox.exec(`git clone https://${env.GITHUB_TOKEN}@github.com/user/repo.git`);

The example embeds GITHUB_TOKEN directly in a git clone URL. Tokens in URLs can leak through logs, shell history, process listings, and error messages.

Alto

references/tunnel/patterns.md:190

sudo privilege escalation

sudo cloudflared service install

The documentation instructs use of sudo to install or start cloudflared services. This is legitimate administration, but it is privileged execution that needs explicit human approval.

Alto

references/tunnel/patterns.md:191

sudo privilege escalation

sudo launchctl start com.cloudflare.cloudflared

The documentation instructs use of sudo to install or start cloudflared services. This is legitimate administration, but it is privileged execution that needs explicit human approval.

Medio

references/sandbox/patterns.md:41

Hardcoded IP address

await sandbox.startProcess('code-server --bind-addr 0.0.0.0:8080', {

The example starts code-server on 0.0.0.0 after installing it in a sandbox. Exposing an IDE on all interfaces is risky without explicit authentication guidance.

Hallazgos de riesgos

Las preocupaciones de seguridad confirmadas están separadas de los elementos que aún deben revisarse.

Preocupaciones de seguridad confirmadas (4)

RISK-001 Crítico

references/sandbox/patterns.md:40

Pipe to shell pattern

await sandbox.exec('curl -fsSL https://code-server.dev/install.sh | sh');

The example pipes a remotely fetched install script directly into sh inside a sandbox. This is a classic unsafe installation pattern and should not be promoted as a common pattern.

RISK-002 Alto

references/tunnel/patterns.md:184

Systemd service enablement

systemctl start cloudflared && systemctl enable cloudflared

The command enables a persistent systemd service. This is legitimate for Tunnel setup but creates persistence and should be clearly gated behind admin approval.

RISK-003 Alto

multiple:1

[HEURISTIC] SUSPICIOUS COMBINATION: Code execution + Persistence mechanism

This combination is common in malware that maintains access

The repository contains confirmed pipe-to-shell and persistent service-install examples. The evidence is documentation rather than hidden executable code, so confidence is moderate.

RISK-004 Alto

references/sandbox/patterns.md:39-41 references/sandbox/patterns.md:135-138 references/sandbox/patterns.md:185-186

Unsafe Sandbox Command Patterns Presented as Examples

The Sandbox reference includes common-pattern examples that pipe a remote installer into a shell, interpolate request values into git commands, and execute request body code. These examples need stronger warnings and safer alternatives.

The cited lines present these commands under common patterns, not only as anti-patterns. Static analysis finds the mechanics, but the framing as recommended examples is the additional risk.

Medidas correctivas

Esta auditoría registra correcciones sugeridas. Aplicarlas es responsabilidad de la persona encargada del mantenimiento.

FIX-001
Crítico
Sandbox documentation promotes curl-to-shell installation.

Replace the pipe-to-shell pattern with a pinned, checksum-verified install flow or documented package manager steps.
FIX-002
Alto
Sandbox examples interpolate request-controlled values into shell commands.

Use allowlists, strict URL validation, argument arrays where available, and avoid shell interpolation for repo, branch, and code values.
FIX-003
Alto
A git clone example embeds GITHUB_TOKEN in a URL.

Use credential helpers, short-lived scoped tokens, or environment-based authentication that does not expose tokens in command strings.
FIX-004
Alto
Tunnel examples install and enable persistent system services.

Mark these commands as manual administrator actions and include rollback, audit, and least-privilege guidance.

Evidencia experta

Identidad inmutable del sujeto, metadatos del escáner, coincidencias descartadas y evidencia a nivel de código fuente.

Sujeto del artefacto

Commit de Marketplace: No disponible
Hash del contenido: No disponible
Hash del árbol: No disponible
Ruta del Skill: No disponible
Hash de la carga de auditoría: No disponible

Metadatos del análisis

Modelo de auditoría: codex

Estado del análisis: Completo

El alcance se limita a los archivos, líneas, métodos y pruebas registrados. No se afirma ninguna ejecución en tiempo de ejecución ni en entorno aislado.

Falsos positivos estáticos ignorados (4)

Crítico

references/r2/gotchas.md:64

System password file access

const key = url.pathname.slice(1); // Could be ../../../etc/passwd

Force-confirmed blocker/critical static finding; AI dismissal overridden.

Crítico

references/secrets-store/patterns.md:80

Long fromCharCode sequence

return btoa(String.fromCharCode(...new Uint8Array(sig)));

Force-confirmed obfuscation/critical static finding; AI dismissal overridden.

Crítico

references/stream/patterns.md:152

Long fromCharCode sequence

const b64Sig = btoa(String.fromCharCode(...new Uint8Array(sig))).replace(/=/g, '').replace(/\+/g, '-

Force-confirmed obfuscation/critical static finding; AI dismissal overridden.

Alto

references/browser-rendering/api.md:13

Screen capture upload

| `/screenshot` | Capture image | `screenshotOptions: {type, fullPage, clip}` |

Force-confirmed blocker/high static finding; AI dismissal overridden.

Verificar y exportar

Informe JSON CITATION.cff SARIF 2.1.0 Manifiesto de instalación firmado

El manifiesto y el archivo de bloqueo vinculan los artefactos de instalación a hashes criptográficos. Esta afirmación de integridad es independiente de la evaluación de seguridad.

Atestación de auditoría: not_attestable