cloudflare-workers-security
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill is a defensive resource providing code templates and documentation for securing serverless functions. It correctly handles sensitive operations like secret management and authentication with best-practice implementations.
- [INDIRECT_PROMPT_INJECTION]: The skill templates define a surface for processing untrusted HTTP request data. This is safely managed through the mandatory use of Zod for schema validation and custom sanitization logic.
- Ingestion points: The skill handles untrusted data via
request.json(),request.headers.get(), and URL parameters intemplates/secure-worker.ts,templates/auth-middleware.ts, andreferences/input-validation.md. - Boundary markers: It implements robust boundary markers through the extensive use of Zod schemas to define strict data shapes and ignore unexpected input.
- Capability inventory: The provided templates have capabilities to interact with KV storage, D1 databases, and R2 buckets, and can perform outbound HTTP requests via
fetch. - Sanitization: The skill includes specific sanitization logic for HTML escaping (
escapeHtml), path sanitization (sanitizePath), and generic content cleaning (sanitizeUserContent) to mitigate injection and traversal risks.
Audit Metadata