cloudflare-workflows
Pass
Audited by Gen Agent Trust Hub on Jun 14, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: No security issues or malicious patterns such as prompt injection, data exfiltration, or obfuscation were detected in the analyzed skill files. The content is educational and provides implementation patterns for the Cloudflare platform.\n- [EXTERNAL_DOWNLOADS]: The skill references official Cloudflare documentation (developers.cloudflare.com) and standard development tools (e.g., npm create cloudflare), which are trusted and well-known services for the intended use case.\n- [INDIRECT_PROMPT_INJECTION]: The templates provided demonstrate how to process external data (e.g., event.payload or HTTP request bodies) using capabilities like network access and database operations. While this is a standard capability of Cloudflare Workflows, it is noted here as a potential vulnerability surface if user-provided data is not validated.\n
- Ingestion points: event.payload in WorkflowEntrypoint templates and HTTP request bodies in the Worker trigger template.\n
- Boundary markers: Absent in code examples.\n
- Capability inventory: fetch (network access), KV (storage), and D1 (database) operations across multiple template files.\n
- Sanitization: Not explicitly shown in the example code snippets.
Audit Metadata