cloudflare-workers-ci-cd
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes metadata from GitHub and GitLab events, such as pull request numbers and commit messages, to dynamically generate environment names and preview URLs. This behavior is inherent to the primary purpose of a CI/CD automation tool and uses standard platform variables.
- Ingestion points: Event-driven variables like
${{ github.event.number }}in GitHub Actions and$CI_MERGE_REQUEST_IIDin GitLab CI. - Capability inventory: Deployment operations via
wranglerand notification tasks via GitHub Actions. - Boundary markers: The templates provide a structured workflow that limits the scope of these variables to specific CI/CD tasks.
- Sanitization: The skill relies on the underlying CI/CD platform's handling of event data.
- [EXTERNAL_DOWNLOADS]: The workflow templates utilize official and community-standard GitHub Actions for checking out code, setting up runtimes, and deploying to Cloudflare. These resources are sourced from official repositories and well-known service providers.
- References: Official actions from
actions/,cloudflare/,oven-sh/, andslackapi/. - [COMMAND_EXECUTION]: The skill provides scripts and configuration for executing standard build, test, and deployment commands using
bunandwrangler. These operations are essential for the intended CI/CD functionality and follow security best practices such as using secret masking and environment scoping. - Evidence: The
verify-deployment.shscript and the rollback workflow templates implement robust error handling and verification steps.
Audit Metadata