Is cloudflare/computer safe?
https://github.com/cloudflare/computer
cloudflare/computer is an official open-source Cloudflare project (MIT licensed) providing a TypeScript SDK for SQLite-backed virtual filesystems and FUSE-based sandboxed execution in Cloudflare Workers. The six included SKILL.md files cover legitimate developer workflow topics and contain no prompt injection, persona manipulation, or exfiltration attempts. Honeypot file accesses observed during monitoring occurred 5 seconds before the git clone and are attributable to SSH/PAM initialization by the audit harness, not the repository; all canary files remained intact. The only notable finding is a dynamic external skill-fetch instruction in cloudflare/SKILL.md that directs agents to pull from Cloudflare's own skills repository at runtime, which is low risk but introduces a supply-chain dependency.
Category Scores
Findings (4)
LOW External skill fetch instruction targeting GitHub -10 ▶
The cloudflare/SKILL.md file contains the instruction: 'If a skill isn't already available in your environment, fetch it from the URL listed and load it manually.' This directs an agent to pull content from https://github.com/cloudflare/skills at runtime. While the repository is legitimately owned by Cloudflare, this dynamic loading pattern means agent behavior depends on the current state of an external resource rather than the audited snapshot. A supply-chain compromise of that repository would silently alter agent behavior.
INFO Canary files read before git clone — audit harness attribution 0 ▶
Six honeypot credential files were opened and read via inotify at 15:40:26. The git clone command was issued at 15:40:31 per auditd EXECVE records, meaning no code from the cloned repository could have triggered these reads. The access pattern — interleaved with /etc/pam.d/*, /etc/passwd, /etc/shadow, and /etc/group lookups — is consistent with SSH session authentication and PAM module execution by the audit harness itself. The canary integrity check confirms all files remain unmodified and no honeypot content was observed in outbound traffic.
INFO FUSE/privileged-container tooling present but requires explicit invocation -3 ▶
The repository ships tooling for mounting kernel FUSE filesystems and running privileged Docker containers (computerd). AGENTS.md explicitly warns that real FUSE requires --privileged or CAP_SYS_ADMIN. None of this code executes on git clone or without explicit user direction. The risk profile is appropriate for a sandboxed execution SDK.
INFO Clean clone with only expected network destinations 0 ▶
The git clone produced exactly the expected network behavior: a TLS connection to GitHub (140.82.121.3:443) for pack data transfer. The Canonical CDN connection (185.125.190.49:443) visible in pre-clone traffic is consistent with Ubuntu's MOTD update checker running on SSH login and predates the clone. No C2 traffic, no beaconing, no DNS-exfiltration patterns observed.