cloudflare-deploy
Pass
Audited by Gen Agent Trust Hub on Jun 15, 2026
Risk Level: SAFENO_CODE
Full Analysis
- [SAFE]: The skill consists entirely of Markdown documentation, configuration examples, and SVG assets. It functions as an information resource for an AI agent to assist with Cloudflare service integration.
- [NO_CODE]: There are no executable scripts (.js, .py, .sh, etc.) included in the skill files that would be directly executed by the agent; all code snippets are provided as illustrative examples within documentation files.
- [EXTERNAL_DOWNLOADS]: The documentation references several well-known and trusted packages and services, including official Cloudflare SDKs, Vercel AI SDK, Pulumi, and common database drivers (pg, mysql2). These are all established industry standards.
- [REMOTE_CODE_EXECUTION]: One documentation file (
references/sandbox/patterns.md) provides an example of installing code-server using a shell script from a well-known developer tool domain (code-server.dev). This is documented as a legitimate use case for the Cloudflare Sandbox service and does not pose a risk in the context of the skill itself. - [CREDENTIALS_UNSAFE]: The skill documentation correctly uses environment variable placeholders (e.g.,
process.env.CLOUDFLARE_API_TOKEN) and explicit warnings against hardcoding secrets, demonstrating a high posture toward credential security.
Audit Metadata