workers-best-practices
Pass
Audited by Gen Agent Trust Hub on Mar 26, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches the latest version of the
@cloudflare/workers-typespackage from the NPM registry using thenpm packcommand. This ensures the agent has access to the most recent API definitions from Cloudflare, which is a well-known and trusted service. - [COMMAND_EXECUTION]: Utilizes standard shell commands including
npm pack,tar, andnpx(for running tools likewrangler,eslint, andoxlint). These commands are used for environment setup and validating the user's Workers code. - [SAFE]: Explicitly provides security guidelines that teach the agent to identify and flag high-risk patterns such as hardcoded secrets, insecure use of
Math.random()for tokens, and potential timing side-channel attacks. - [SAFE]: Encourages the use of secure alternatives like the Web Crypto API,
ctx.waitUntil()for background tasks, and service bindings for internal communication, aligning with production safety standards.
Audit Metadata