Security audit
R2 Relay Channel
Security checks for vulnerabilities and agentic risk
Overview
This is a coherent Cloudflare R2 messaging channel plugin whose sensitive behaviors are tied to relaying chat, media, and session state through the user-configured bucket.
Install only with an R2 bucket and access keys you are comfortable using for relay data. Treat clients with those R2 credentials as trusted, because they can send messages to the gateway and participate in approval flows; use a dedicated bucket/key and review retention settings if stored relay objects matter.
SkillSpector was not run because this plugin release contains no bundled skills.
Static analysis
No suspicious patterns detected.