The Agent Skills Directory

[SAFE]: The skill consists of a vast collection of markdown reference files for various Cloudflare products. Analysis of all 200 files confirms that the skill is purely informational.
[DATA_EXPOSURE]: Documentation correctly instructs users to manage secrets using environment variables, .dev.vars (with .gitignore recommendations), or the wrangler secret put command. No real API keys, tokens, or credentials are hardcoded in the reference material; all examples use descriptive placeholders like your-token-here, abc123, or xxx.
[EXTERNAL_DOWNLOADS]: The skill references numerous official packages and SDKs (e.g., cloudflare, @cloudflare/puppeteer, @ai-sdk/openai, pyiceberg). All mentioned packages are well-known, legitimate libraries from trusted organizations or established technology providers. No suspicious remote code execution patterns (like curl | bash) were detected.
[COMMAND_EXECUTION]: Documentation provides standard CLI usage examples for Cloudflare's official tool, wrangler. These are intended for user guidance in local development and deployment workflows and do not pose a risk to the agent's execution environment.
[PROMPT_INJECTION]: No malicious prompt injection patterns, bypass markers, or role-play instructions were found in the skill's markdown body or frontmatter. The SKILL.md uses standard retrieval patterns to bias the agent toward using current documentation over pre-trained knowledge.
[D1_DATABASE_SECURITY]: The database reference files (references/d1/api.md) explicitly emphasize the use of prepared statements to prevent SQL injection and warn against direct string interpolation.

cloudflare