cloudflare-worker-builder
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references technical documentation, issue trackers, and migration guides from official sources including Cloudflare's developer portal and the HonoJS GitHub organization. These resources are utilized to provide users with troubleshooting context and best practices for the serverless platform.
- [COMMAND_EXECUTION]: Instructions include standard development commands for project setup and deployment using the Cloudflare CLI (
wrangler) and Node.js package managers (npm). These operations are routine and necessary for the intended use-case of building and deploying serverless functions. - [INDIRECT_PROMPT_INJECTION]: The skill facilitates a workflow where the agent scaffolds a project based on a user-provided description of the application's functionality and storage needs.
- Ingestion points: User-provided project description in
SKILL.md(Step 1). - Boundary markers: None explicitly defined in the instructional text for the user brief.
- Capability inventory: The skill instructs the agent to create files and execute standard Cloudflare deployment commands (
wrangler deploy). - Sanitization: None; the skill relies on the agent's ability to interpret descriptions into a standard file structure based on provided assets.
- [SAFE]: The asset files provided (e.g.,
wrangler.jsonc,index.ts,vite.config.ts) follow industry-standard patterns for Cloudflare Workers. Whileassets/wrangler.jsonccontains a hardcoded Cloudflareaccount_id, this is a public-facing identifier for deployment targeting and does not constitute a sensitive secret like an API key or private token.
Audit Metadata