workers-best-practices

Warn

Audited by Runlayer on Feb 21, 2026

Risk Level: MEDIUM
Scan Summary
Max Score
78%
Files
3
Flagged
3
Chunks
5
Flagged Files (3)
SKILL.mdHIGH
78.3%

Malicious tool definition detected

Tool: SKILL.md Description: --- name: workers-best-practices description: Reviews and authors Cloudflare Workers code against production best practices.

references/review.mdHIGH
78.3%

Malicious tool definition detected

Tool: references/review.md [1/2] Description: # Code Review — Workers How to review Workers code for type correctness, API usage, config validity, and best practices. This is self-contained — do not assume access to other skills.

Tool: references/review.md [2/2] Description: unsafe casts 5.

references/rules.mdHIGH
78.3%

Malicious tool definition detected

Tool: references/rules.md [1/2] Description: # Workers Best Practices — Rules Each rule has an imperative summary, what to check, the correct pattern, and an anti-pattern where applicable. Code examples are plain TypeScript — no MDX components. When a rule involves config fields or API signatures that may evolve, a **Retrieve** callout reminds you to check the latest docs or types before flagging.

Tool: references/rules.md [2/2] Description: // Caller Worker const auth = await env.AUTH_SERVICE.verifyToken(token); ``` **Retrieve**: verify `WorkerEntrypoint` import path and signature against latest `@cloudflare/workers-types`. ### Use Hyperdrive for external database connections Hyperdrive maintains a regional connection pool, eliminating per-request TCP + TLS + auth cost (often 300-500ms). Create a new `Client` per request — Hyperdrive manages the underlying pool.

Audit Metadata
Max File Score
78%
Classification
UNKNOWN_SERVER
Files Scanned
3
Files Flagged
3
Chunks Analyzed
5
Analyzed
Feb 21, 2026, 02:46 AM
Security Audit — runlayer — workers-best-practices