The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill fetches the latest @cloudflare/workers-types using npm pack to ensure up-to-date type checking during code review. This is an expected operation for a development tool and targets an official package from a well-known service.
[COMMAND_EXECUTION]: The skill utilizes several shell commands such as mkdir, npm pack, tar, cat, and npx wrangler to manage local development environments, extract type definitions, and inspect configuration schemas. These are standard developer workflows.
[PROMPT_INJECTION]: As the skill is designed to ingest and analyze user-provided code for review, it has an indirect prompt injection surface. Malicious instructions could be embedded in comments or code to attempt to subvert the agent's analysis logic.
Ingestion points: User-provided Cloudflare Workers code and configuration files are processed in the Writing or Refactoring and Code Review workflows.
Boundary markers: No specific delimiters or "ignore embedded instructions" warnings are used when interpolating code into prompts.
Capability inventory: Subprocess calls include npm, tar, cat, and npx (all used for fetching types/schemas). Network access is primarily for fetching official documentation and packages.
Sanitization: No explicit sanitization or filtering of the ingested code is described.

workers-best-practices