Este informe no está traducido al idioma solicitado. Se muestra en su lugar el informe canónico en inglés.
Evaluación de seguridad versionada
ID del informe: SA-7DB9B9F0
7/9/2026, 1:30:16 AM
cloudflare evaluación de seguridad v4
Informe de certificación de seguridad de la habilidad
Modelo de auditoría: claude Informe histórico
- Nombre de la habilidad
- cloudflare
- Versión
- v4
- Mantenedor
- cloudflare
- Cobertura
- 321 Archivos escaneados · 49,016 Líneas analizadas
- Versión de la política
- No disponible
Gravedad máxima de hallazgo confirmada
Crítico
2 hallazgos de seguridad confirmados requieren atención.
Contexto de instalación
Evidencia histórica
Este informe podría no describir el artefacto instalable actualmente. Abra la página actual de la Skill para obtener orientación de instalación.
Abrir la página actual de la habilidadEste informe no bloquea ni autoriza el manifiesto ni el ZIP.
The skill is primarily a large Cloudflare reference bundle with many static matches caused by documentation examples, placeholders, and product configuration snippets. A small number of command-execution examples remain security-sensitive because users or agents could copy them into real environments, but no hidden malware, prompt injection, credential exfiltration intent, or auto-executing installer behavior was found. Static review was capped at 400/2983 representative findings; omitted static matches are unconfirmed, so automatic publishing stays disabled until manual review.
Posición del informe
Informe histórico
Abra el historial de auditorías antes de usar este informe para instalar.
Atestación de auditoría
No se puede certificar
La vinculación inmutable requerida está incompleta.
Verificación humana
No verificado
No se ha registrado ninguna verificación humana para este informe.
Cobertura
321 Archivos escaneados · 49,016 Líneas analizadas
33 elementos mostrados para revisión
Limitaciones
Este informe no afirma ninguna ejecución en tiempo de ejecución ni en entorno aislado y no prueba la ausencia de efectos secundarios.
Cadena de evidencias
Sigue la evidencia desde la vinculación del código fuente hasta el contrato de instalación. La evidencia disponible permite la verificación; no constituye una garantía de seguridad.
Fuente
Vinculación no disponible
Artefacto
Identidad incompleta
Auditoría
Completo
Capacidades observadas
Observado significa que este informe registró evidencia de respaldo. No registrado no prueba que una capacidad esté ausente.
Contiene scripts
Puede ejecutar código incluido con la habilidad.
Observado en 50 ubicaciones de evidencia
Acceso a red
Puede conectarse a servicios externos.
Observado en 48 ubicaciones de evidencia
Acceso al sistema de archivos
Puede leer o escribir archivos locales.
Observado en 50 ubicaciones de evidencia
Variables de entorno
Puede leer valores del entorno del proceso.
Observado en 29 ubicaciones de evidencia
Comandos externos
Puede invocar comandos o programas fuera de la habilidad.
Observado en 66 ubicaciones de evidencia
Elementos de revisión de capacidades (31)
Alto
Dynamic code evaluation with eval()
| **OpenFeature SDK** | Workers, Node.js, browser | `@cloudflare/flagship` + `@openfeature/server-sd
The reference mentions dynamic eval usage, which is dangerous if copied into application code. Context may be educational, so confidence is moderate rather than high.
Alto
Process exec
const cursor = this.sql.exec('SELECT * FROM users WHERE email = ?', email);
The reference includes process or dynamic execution patterns. They appear to be examples, but such patterns are security-sensitive and should stay flagged for manual review.
Alto
Process exec
this.sql.exec('UPDATE accounts SET balance = balance - ? WHERE id = ?', 100, 1);
The reference includes process or dynamic execution patterns. They appear to be examples, but such patterns are security-sensitive and should stay flagged for manual review.
Alto
Process exec
this.sql.exec('UPDATE accounts SET balance = balance + ? WHERE id = ?', 100, 2);
The reference includes process or dynamic execution patterns. They appear to be examples, but such patterns are security-sensitive and should stay flagged for manual review.
Alto
Process exec
this.sql.exec(`
The reference includes process or dynamic execution patterns. They appear to be examples, but such patterns are security-sensitive and should stay flagged for manual review.
Alto
Process exec
this.sql.exec("CREATE TABLE events(id INTEGER PRIMARY KEY)");
The reference includes process or dynamic execution patterns. They appear to be examples, but such patterns are security-sensitive and should stay flagged for manual review.
Alto
Process exec
this.sql.exec("INSERT INTO events VALUES (?)", 1234567890123456789n); // Corrupts!
The reference includes process or dynamic execution patterns. They appear to be examples, but such patterns are security-sensitive and should stay flagged for manual review.
Alto
Process exec
this.sql.exec("CREATE TABLE events(id TEXT PRIMARY KEY)");
The reference includes process or dynamic execution patterns. They appear to be examples, but such patterns are security-sensitive and should stay flagged for manual review.
Alto
Process exec
this.sql.exec("INSERT INTO events VALUES (?)", "1234567890123456789");
The reference includes process or dynamic execution patterns. They appear to be examples, but such patterns are security-sensitive and should stay flagged for manual review.
Alto
Process exec
this.sql.exec(`
The reference includes process or dynamic execution patterns. They appear to be examples, but such patterns are security-sensitive and should stay flagged for manual review.
Alto
Process exec
this.sql.exec(`CREATE TABLE users(id INTEGER PRIMARY KEY, name TEXT)`);
The reference includes process or dynamic execution patterns. They appear to be examples, but such patterns are security-sensitive and should stay flagged for manual review.
Alto
Process exec
this.sql.exec("INSERT INTO _sql_schema_migrations (id) VALUES (1)");
The reference includes process or dynamic execution patterns. They appear to be examples, but such patterns are security-sensitive and should stay flagged for manual review.
Alto
Process exec
this.sql.exec(`ALTER TABLE users ADD COLUMN email TEXT`);
The reference includes process or dynamic execution patterns. They appear to be examples, but such patterns are security-sensitive and should stay flagged for manual review.
Alto
Process exec
this.sql.exec("INSERT INTO _sql_schema_migrations (id) VALUES (2)");
The reference includes process or dynamic execution patterns. They appear to be examples, but such patterns are security-sensitive and should stay flagged for manual review.
Alto
Process exec
this.sql.exec('DELETE FROM requests WHERE key = ? AND timestamp < ?', key, now - window);
The reference includes process or dynamic execution patterns. They appear to be examples, but such patterns are security-sensitive and should stay flagged for manual review.
Alto
Python exec() function
const cursor = this.sql.exec('SELECT * FROM users WHERE email = ?', email);
The reference includes process or dynamic execution patterns. They appear to be examples, but such patterns are security-sensitive and should stay flagged for manual review.
Alto
Python exec() function
this.sql.exec('UPDATE accounts SET balance = balance - ? WHERE id = ?', 100, 1);
The reference includes process or dynamic execution patterns. They appear to be examples, but such patterns are security-sensitive and should stay flagged for manual review.
Alto
Python exec() function
this.sql.exec('UPDATE accounts SET balance = balance + ? WHERE id = ?', 100, 2);
The reference includes process or dynamic execution patterns. They appear to be examples, but such patterns are security-sensitive and should stay flagged for manual review.
Alto
Python exec() function
this.sql.exec(`
The reference includes process or dynamic execution patterns. They appear to be examples, but such patterns are security-sensitive and should stay flagged for manual review.
Alto
Python exec() function
this.sql.exec("CREATE TABLE events(id INTEGER PRIMARY KEY)");
The reference includes process or dynamic execution patterns. They appear to be examples, but such patterns are security-sensitive and should stay flagged for manual review.
Alto
Python exec() function
this.sql.exec("INSERT INTO events VALUES (?)", 1234567890123456789n); // Corrupts!
The reference includes process or dynamic execution patterns. They appear to be examples, but such patterns are security-sensitive and should stay flagged for manual review.
Alto
Python exec() function
this.sql.exec("CREATE TABLE events(id TEXT PRIMARY KEY)");
The reference includes process or dynamic execution patterns. They appear to be examples, but such patterns are security-sensitive and should stay flagged for manual review.
Alto
Python exec() function
this.sql.exec("INSERT INTO events VALUES (?)", "1234567890123456789");
The reference includes process or dynamic execution patterns. They appear to be examples, but such patterns are security-sensitive and should stay flagged for manual review.
Alto
Python exec() function
this.sql.exec(`
The reference includes process or dynamic execution patterns. They appear to be examples, but such patterns are security-sensitive and should stay flagged for manual review.
Alto
Python exec() function
this.sql.exec(`CREATE TABLE users(id INTEGER PRIMARY KEY, name TEXT)`);
The reference includes process or dynamic execution patterns. They appear to be examples, but such patterns are security-sensitive and should stay flagged for manual review.
Alto
Python exec() function
this.sql.exec("INSERT INTO _sql_schema_migrations (id) VALUES (1)");
The reference includes process or dynamic execution patterns. They appear to be examples, but such patterns are security-sensitive and should stay flagged for manual review.
Alto
Python exec() function
this.sql.exec(`ALTER TABLE users ADD COLUMN email TEXT`);
The reference includes process or dynamic execution patterns. They appear to be examples, but such patterns are security-sensitive and should stay flagged for manual review.
Alto
Python exec() function
this.sql.exec("INSERT INTO _sql_schema_migrations (id) VALUES (2)");
The reference includes process or dynamic execution patterns. They appear to be examples, but such patterns are security-sensitive and should stay flagged for manual review.
Alto
Python exec() function
this.sql.exec('DELETE FROM requests WHERE key = ? AND timestamp < ?', key, now - window);
The reference includes process or dynamic execution patterns. They appear to be examples, but such patterns are security-sensitive and should stay flagged for manual review.
Alto
sudo privilege escalation
sudo cloudflared service install
The reference includes privileged service-management commands. They are documentation examples, but they can alter host persistence or privileges if followed without review.
Alto
sudo privilege escalation
sudo launchctl start com.cloudflare.cloudflared
The reference includes privileged service-management commands. They are documentation examples, but they can alter host persistence or privileges if followed without review.
Hallazgos de riesgos
Las preocupaciones de seguridad confirmadas están separadas de los elementos que aún deben revisarse.
Preocupaciones de seguridad confirmadas (2)
RISK-001 Crítico
Pipe to shell pattern
await sandbox.exec('curl -fsSL https://code-server.dev/install.sh | sh');
The reference contains a pipe-to-shell install command that an agent or user could copy into a live environment. Even though it is documentation, this pattern is hazardous and should be replaced with safer installation steps.
RISK-002 Alto
Systemd service enablement
systemctl start cloudflared && systemctl enable cloudflared
The reference includes privileged service-management commands. They are documentation examples, but they can alter host persistence or privileges if followed without review.
Medidas correctivas
Esta auditoría registra correcciones sugeridas. Aplicarlas es responsabilidad de la persona encargada del mantenimiento.
- FIX-001CríticoPipe-to-shell installation example in sandbox guidance.Replace the curl-to-shell command with explicit download, checksum verification, and reviewed installation steps.
- FIX-002AltoPrivileged tunnel service examples can alter host persistence.Add clear warnings and require manual approval before running systemd or sudo commands from the references.
- FIX-003AltoDynamic execution examples may be copied into application code.Prefer safer APIs, constrain inputs, and label exec or eval examples as non-production demonstrations.
- FIX-004MedioStatic review cappedManually review the omitted 2583 static analyzer matches or reduce bundled generated/vendor/reference content before enabling automatic publication.
- FIX-005MedioMany examples mention secrets, certificates, tokens, and environment variables.Keep placeholder values clearly fake and remind users never to paste real credentials into prompts or source files.
Evidencia experta
Identidad inmutable del sujeto, metadatos del escáner, coincidencias descartadas y evidencia a nivel de código fuente.
Sujeto del artefacto
- Commit de Marketplace
- No disponible
- Hash del contenido
- No disponible
- Hash del árbol
- No disponible
- Ruta del Skill
- No disponible
- Hash de la carga de auditoría
- No disponible
Metadatos del análisis
Modelo de auditoría: claude
Estado del análisis: Completo
El alcance se limita a los archivos, líneas, métodos y pruebas registrados. No se afirma ninguna ejecución en tiempo de ejecución ni en entorno aislado.
Verificar y exportar
El manifiesto y el archivo de bloqueo vinculan los artefactos de instalación a hashes criptográficos. Esta afirmación de integridad es independiente de la evaluación de seguridad.
Atestación de auditoría: not_attestable