cloudflare-workers-ci-cd

Pass

Audited by Gen Agent Trust Hub on Sep 15, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill processes metadata from GitHub and GitLab events, such as pull request numbers and commit messages, to dynamically generate environment names and preview URLs. This behavior is inherent to the primary purpose of a CI/CD automation tool and uses standard platform variables.
  • Ingestion points: Event-driven variables like ${{ github.event.number }} in GitHub Actions and $CI_MERGE_REQUEST_IID in GitLab CI.
  • Capability inventory: Deployment operations via wrangler and notification tasks via GitHub Actions.
  • Boundary markers: The templates provide a structured workflow that limits the scope of these variables to specific CI/CD tasks.
  • Sanitization: The skill relies on the underlying CI/CD platform's handling of event data.
  • [EXTERNAL_DOWNLOADS]: The workflow templates utilize official and community-standard GitHub Actions for checking out code, setting up runtimes, and deploying to Cloudflare. These resources are sourced from official repositories and well-known service providers.
  • References: Official actions from actions/, cloudflare/, oven-sh/, and slackapi/.
  • [COMMAND_EXECUTION]: The skill provides scripts and configuration for executing standard build, test, and deployment commands using bun and wrangler. These operations are essential for the intended CI/CD functionality and follow security best practices such as using secret masking and environment scoping.
  • Evidence: The verify-deployment.sh script and the rollback workflow templates implement robust error handling and verification steps.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 15, 2026, 12:00 AM
Security Audit — agent-trust-hub — cloudflare-workers-ci-cd