cloudflare-email-service

What it claims to do

Send and receive transactional emails with Cloudflare Email Service (Email Sending + Email Routing). Use when building email sending (Workers binding or REST API), email routing, Agents SDK email handling, or integrating email into any app …

What we found · 6

• Possible data-exfiltration intentcritical"Send … to <server>" phrasing; combined with secret access this forms a complete data-leak path.
• Trigger is too broadmediumWords like "any" make it fire everywhere and fight other skills for the same task — the #1 cause of conflicts.
• Bloated: high token costmedium~1,982 tokens on every single call. Compress instructions and trim examples.
• References API keys / env configmediumReads an API key or env var — normal for API clients. Ensure keys come from the runtime (not hardcoded); a leak risk only if sent to an untrusted endpoint.
• Contains curl / wget network commandmediumAccesses the network from the shell. If the target is untrusted it can pull malware or exfiltrate data.
• Description too longlowThe description is read on every trigger check; overly long ones waste tokens and dilute the signal.

Conflicts with · 8

If you have both installed, they compete for the same triggers — the top cause of an agent picking the wrong skill.