cloudflare-worker-base
Pass
Audited by Gen Agent Trust Hub on Mar 10, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSCREDENTIALS_UNSAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill incorporates several companion agents (debug, deploy, migration, and scaffold) that use shell commands to manage Cloudflare Worker projects. These agents execute standard development tools including
npx wrangler,npm install,npx drizzle-kit, andgit. The instructions for these agents are structured with safety constraints that forbid unauthorized code modification and require explicit user triggers for deployment or diagnostic actions. - [EXTERNAL_DOWNLOADS]: Both the documentation and automated scaffolding agents facilitate the installation of software packages from the official NPM registry. These packages, such as
hono,vite,typescript, and@cloudflare/vite-plugin, are well-known in the industry and provided by established organizations. The project initialization process also leveragesnpm create cloudflare@latest, an official tool from Cloudflare. - [CREDENTIALS_UNSAFE]: A hardcoded Cloudflare Account ID (
0460574641fdbb98159c98ebf593e2bd) is present in thetemplates/wrangler.jsoncfile. While Account IDs are frequently exposed in public worker URLs and are not considered sensitive secrets like API keys, best practice typically involves using placeholders for project templates. The skill includes separate, correct guidance on handling actual secrets using thewrangler secret putcommand in its deployment documentation.
Audit Metadata