cloudflare-worker-base

Pass

Audited by Gen Agent Trust Hub on Mar 10, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSCREDENTIALS_UNSAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill incorporates several companion agents (debug, deploy, migration, and scaffold) that use shell commands to manage Cloudflare Worker projects. These agents execute standard development tools including npx wrangler, npm install, npx drizzle-kit, and git. The instructions for these agents are structured with safety constraints that forbid unauthorized code modification and require explicit user triggers for deployment or diagnostic actions.
  • [EXTERNAL_DOWNLOADS]: Both the documentation and automated scaffolding agents facilitate the installation of software packages from the official NPM registry. These packages, such as hono, vite, typescript, and @cloudflare/vite-plugin, are well-known in the industry and provided by established organizations. The project initialization process also leverages npm create cloudflare@latest, an official tool from Cloudflare.
  • [CREDENTIALS_UNSAFE]: A hardcoded Cloudflare Account ID (0460574641fdbb98159c98ebf593e2bd) is present in the templates/wrangler.jsonc file. While Account IDs are frequently exposed in public worker URLs and are not considered sensitive secrets like API keys, best practice typically involves using placeholders for project templates. The skill includes separate, correct guidance on handling actual secrets using the wrangler secret put command in its deployment documentation.
Audit Metadata
Risk Level
SAFE
Analyzed
Mar 10, 2026, 03:49 AM