workers-best-practices
Pass
Audited by Gen Agent Trust Hub on Jul 11, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the agent to fetch official Cloudflare Workers documentation and the latest
@cloudflare/workers-typespackage from the npm registry. These downloads originate from well-known services and trusted organizations to ensure the agent has up-to-date knowledge for code review tasks. - [COMMAND_EXECUTION]: The skill uses standard development tools such as
npm,tar,cat, and linters (tsc,eslint,oxlint) to validate worker code and configuration. These operations are within the expected scope of a technical code-reviewing skill. - [DATA_EXFILTRATION]: No evidence of data exfiltration was found. The skill contains explicit instructions to prevent the exposure of secrets, such as advising against hardcoding credentials and recommending the use of secure environment variables via
wrangler secret. - [PROMPT_INJECTION]: No direct prompt injection patterns were found. While the skill processes user-provided code, which is a potential surface for indirect prompt injection, it focuses on technical validation and does not exhibit vulnerabilities or instructions aimed at overriding agent behavior.
Audit Metadata