setup-cloudflare-pr-previews
Pass
Audited by Gen Agent Trust Hub on Jul 20, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill implements a secure cleanup lifecycle using the
pull_request_targettrigger. It mitigates privilege escalation and secret leakage risks by ensuring the workflow only executes trusted code from the base branch and operates with minimal repository permissions. - [SAFE]: Robust input sanitization is applied to branch names and other external data before they are used in shell commands, SQL queries, or resource identifiers. The use of deterministic sanitizers (mapping special characters to hyphens/underscores) prevents command injection and resource naming collisions.
- [SAFE]: SQL operations on the D1 database use manual escaping for string literals to prevent SQL injection when logging deployment metadata like branch names and commit hashes.
- [SAFE]: The template rendering script (
render_templates.py) incorporates security checks to prevent directory traversal by validating that all target paths are relative and do not contain parent directory markers. - [SAFE]: Credential management follows industry best practices by utilizing GitHub Secrets and environment variables instead of hardcoding sensitive tokens or passing them as command-line arguments that could appear in logs.
Audit Metadata