cf-crawl
Crawls websites using Cloudflare's API to save content as markdown files, ideal for documentation and knowledge base ingestion.
Install this skill
Security score
The cf-crawl skill was audited on May 16, 2026 and we found 28 security issues across 4 threat categories. Review the findings below before installing.
Categories Tested
Security Issues
Template literal with variable interpolation in command context
| 58 | ```bash |
Template literal with variable interpolation in command context
| 74 | ```bash |
Template literal with variable interpolation in command context
| 97 | ```bash |
Template literal with variable interpolation in command context
| 113 | ```bash |
Template literal with variable interpolation in command context
| 121 | ```bash |
Template literal with variable interpolation in command context
| 127 | ```bash |
Curl to non-GitHub URL
| 59 | curl -s -X POST "https://api.cloudflare.com/client/v4/accounts/${CLOUDFLARE_ACCOUNT_ID}/browser-rendering/crawl" \ |
Curl to non-GitHub URL
| 75 | curl -s -X POST "https://api.cloudflare.com/client/v4/accounts/${CLOUDFLARE_ACCOUNT_ID}/browser-rendering/crawl" \ |
Curl to non-GitHub URL
| 98 | curl -s -X GET "https://api.cloudflare.com/client/v4/accounts/${CLOUDFLARE_ACCOUNT_ID}/browser-rendering/crawl/<JOB_ID>?limit=1" \ |
Curl to non-GitHub URL
| 115 | curl -s -X GET "https://api.cloudflare.com/client/v4/accounts/${CLOUDFLARE_ACCOUNT_ID}/browser-rendering/crawl/<JOB_ID>?status=skipped&limit=50" \ |
Curl to non-GitHub URL
| 122 | curl -s -X GET "https://api.cloudflare.com/client/v4/accounts/${CLOUDFLARE_ACCOUNT_ID}/browser-rendering/crawl/<JOB_ID>?status=completed&limit=50" \ |
Curl to non-GitHub URL
| 128 | curl -s -X GET "https://api.cloudflare.com/client/v4/accounts/${CLOUDFLARE_ACCOUNT_ID}/browser-rendering/crawl/<JOB_ID>?status=completed&limit=50&cursor=<CURSOR>" \ |
Access to hidden dotfiles in home directory
| 27 | 4. **Home directory `.env`** - Read `~/.env` as a last resort |
Access to .env file
| 25 | 2. **Project `.env` file** - Read `.env` in the current working directory and extract the values |
Access to .env file
| 26 | 3. **Project `.env.local` file** - Read `.env.local` in the current working directory |
Access to .env file
| 27 | 4. **Home directory `.env`** - Read `~/.env` as a last resort |
Access to .env file
| 29 | To load from a `.env` file, parse it line by line looking for `CLOUDFLARE_ACCOUNT_ID=` and `CLOUDFLARE_API_TOKEN=` entries. Use this bash approach: |
Access to .env file
| 32 | # Load from .env if vars are not already set |
Access to .env file
| 34 | for envfile in .env .env.local "$HOME/.env"; do |
Access to .env file
| 42 | If credentials are still missing after checking all sources, tell the user to add them to their project `.env` file: |
External URL reference
| 48 | The API token needs "Browser Rendering - Edit" permission. Create one at [Cloudflare Dashboard > API Tokens](https://dash.cloudflare.com/profile/api-tokens). |
External URL reference
| 59 | curl -s -X POST "https://api.cloudflare.com/client/v4/accounts/${CLOUDFLARE_ACCOUNT_ID}/browser-rendering/crawl" \ |
External URL reference
| 75 | curl -s -X POST "https://api.cloudflare.com/client/v4/accounts/${CLOUDFLARE_ACCOUNT_ID}/browser-rendering/crawl" \ |
External URL reference
| 98 | curl -s -X GET "https://api.cloudflare.com/client/v4/accounts/${CLOUDFLARE_ACCOUNT_ID}/browser-rendering/crawl/<JOB_ID>?limit=1" \ |
External URL reference
| 115 | curl -s -X GET "https://api.cloudflare.com/client/v4/accounts/${CLOUDFLARE_ACCOUNT_ID}/browser-rendering/crawl/<JOB_ID>?status=skipped&limit=50" \ |
External URL reference
| 122 | curl -s -X GET "https://api.cloudflare.com/client/v4/accounts/${CLOUDFLARE_ACCOUNT_ID}/browser-rendering/crawl/<JOB_ID>?status=completed&limit=50" \ |
External URL reference
| 128 | curl -s -X GET "https://api.cloudflare.com/client/v4/accounts/${CLOUDFLARE_ACCOUNT_ID}/browser-rendering/crawl/<JOB_ID>?status=completed&limit=50&cursor=<CURSOR>" \ |
External URL reference
| 147 | base = f'https://api.cloudflare.com/client/v4/accounts/{account_id}/browser-rendering/crawl/{job_id}' |