{"data":{"skill":{"slug":"cloudflare-frameworks-on-cloudflare","name":"frameworks-on-cloudflare","icon":"📦","repo":"https://github.com/cloudflare/skills/tree/6eb6c781aa9b6438e0c7307bd102788a75fe1a6d/skills/frameworks-on-cloudflare","status":"approved","author":"cloudflare","authorVersion":null,"skillstoreRevision":1,"license":null},"licenseCorrection":null,"audit":{"id":"6a824397-ebc6-4a90-b1b6-fdbe9aa80ab8","skill_id":"d81d183c-c6ea-484f-9188-28b457a7479c","version":1,"content_hash":"v3:c993c6abcbffafea2683d7748b53b3dfaf438415:0edfc9c8090988c32b76a0be007264073a67be1c8623b72c172976d510eccda4:065f5583eaff8969ad32f6b16b385b3f87b981f83c6c0449218b669e65213412:736b696c6c732f636c6f7564666c6172652f6672616d65776f726b732d6f6e2d636c6f7564666c617265:ecf89ea08a10cc9a0fde3558ea47e4f1","risk_level":"safe","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":"allowed","manual_install_policy":"allowed","summary":"All 20 static findings are false positives involving Markdown formatting, official documentation links, or feedback safeguards. Feedback submission requires redaction and explicit approval of the exact public issue text. No evidence found of credential theft, malicious execution, or prompt injection in the reviewed files.","remediation":[],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":12,"line_start":12},{"file":"SKILL.md","line_end":16,"line_start":16},{"file":"SKILL.md","line_end":17,"line_start":17},{"file":"SKILL.md","line_end":18,"line_start":18},{"file":"SKILL.md","line_end":23,"line_start":23},{"file":"SKILL.md","line_end":26,"line_start":26},{"file":"SKILL.md","line_end":28,"line_start":28}]},{"factor":"network","evidence":[{"file":"SKILL.md","line_end":8,"line_start":8},{"file":"SKILL.md","line_end":18,"line_start":18},{"file":"SKILL.md","line_end":24,"line_start":24},{"file":"SKILL.md","line_end":25,"line_start":25},{"file":"SKILL.md","line_end":26,"line_start":26},{"file":"SKILL.md","line_end":27,"line_start":27},{"file":"SKILL.md","line_end":28,"line_start":28},{"file":"SKILL.md","line_end":29,"line_start":29},{"file":"SKILL.md","line_end":30,"line_start":30},{"file":"SKILL.md","line_end":32,"line_start":32}]},{"factor":"filesystem","evidence":[{"file":"SKILL.md","line_end":25,"line_start":25}]}],"critical_findings":[],"high_findings":[],"medium_findings":[],"low_findings":[],"dangerous_patterns":[],"files_scanned":2,"total_lines":79,"audit_model":"codex","audited_at":"2026-11-07T14:36:29.326+00:00","created_at":"2026-11-09T15:34:06.813237+00:00","static_findings":[{"id":"blocker:references/skill-feedback.md:14:system-reconnaissance","file":"references/skill-feedback.md","pattern":"System reconnaissance","snippet":"- Internal hostnames and URLs","category":"blocker","line_end":14,"severity":"low","line_start":14},{"id":"blocker:references/skill-feedback.md:39:system-reconnaissance","file":"references/skill-feedback.md","pattern":"System reconnaissance","snippet":"| Actual | What the skill said or what happened, e.g. \"Unknown option: --preview\" |","category":"blocker","line_end":39,"severity":"low","line_start":39},{"id":"external_commands:SKILL.md:12:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"1. Inspect the repository before changing it. Identify the framework, installed version, package man","category":"external_commands","line_end":12,"severity":"medium","line_start":12},{"id":"external_commands:SKILL.md:16:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **New project:** follow the framework's Workers guide for project creation. The guides currently c","category":"external_commands","line_end":16,"severity":"medium","line_start":16},{"id":"external_commands:SKILL.md:17:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **Existing project with Wrangler configuration:** keep Wrangler and load the `wrangler` skill. Fol","category":"external_commands","line_end":17,"severity":"medium","line_start":17},{"id":"external_commands:SKILL.md:18:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **Existing project with no Cloudflare configuration:** use `cf`, which detects supported framework","category":"external_commands","line_end":18,"severity":"medium","line_start":18},{"id":"external_commands:SKILL.md:23:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Next.js | Load the `nextjs-on-cloudflare` skill. | Listed in that skill. |","category":"external_commands","line_end":23,"severity":"medium","line_start":23},{"id":"external_commands:SKILL.md:26:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| SvelteKit | Follow the [Workers guide](https://developers.cloudflare.com/workers/framework-guides/","category":"external_commands","line_end":26,"severity":"medium","line_start":26},{"id":"external_commands:SKILL.md:28:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Astro | Distinguish fully prerendered output from on-demand rendering: a static site deploys as st","category":"external_commands","line_end":28,"severity":"medium","line_start":28},{"id":"network:SKILL.md:8:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"Use the framework as the primary development interface and Cloudflare Workers as the deployment targ","category":"network","line_end":8,"severity":"low","line_start":8},{"id":"network:SKILL.md:18:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- **Existing project with no Cloudflare configuration:** use `cf`, which detects supported framework","category":"network","line_end":18,"severity":"low","line_start":18},{"id":"network:SKILL.md:24:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"| TanStack Start | Follow the [Workers guide](https://developers.cloudflare.com/workers/framework-gu","category":"network","line_end":24,"severity":"low","line_start":24},{"id":"network:SKILL.md:25:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"| React Router | Identify Framework, Data, or Declarative mode. Follow the [Workers guide](https://d","category":"network","line_end":25,"severity":"low","line_start":25},{"id":"network:SKILL.md:26:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"| SvelteKit | Follow the [Workers guide](https://developers.cloudflare.com/workers/framework-guides/","category":"network","line_end":26,"severity":"low","line_start":26},{"id":"network:SKILL.md:27:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"| Hono | Choose an API-only Worker or a frontend plus API. The [Cloudflare guide](https://developers","category":"network","line_end":27,"severity":"low","line_start":27},{"id":"network:SKILL.md:28:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"| Astro | Distinguish fully prerendered output from on-demand rendering: a static site deploys as st","category":"network","line_end":28,"severity":"low","line_start":28},{"id":"network:SKILL.md:29:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"| Nuxt | Follow the [Workers guide](https://developers.cloudflare.com/workers/framework-guides/web-a","category":"network","line_end":29,"severity":"low","line_start":29},{"id":"network:SKILL.md:30:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"| React or Vue SPA | Follow the [React + Vite](https://developers.cloudflare.com/workers/framework-g","category":"network","line_end":30,"severity":"low","line_start":30},{"id":"network:SKILL.md:32:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"For other frameworks, start from the [framework guides index](https://developers.cloudflare.com/work","category":"network","line_end":32,"severity":"low","line_start":32},{"id":"filesystem:SKILL.md:25:hidden-file-access","file":"SKILL.md","pattern":"Hidden file access","snippet":"| React Router | Identify Framework, Data, or Declarative mode. Follow the [Workers guide](https://d","category":"filesystem","line_end":25,"severity":"medium","line_start":25}],"finding_verdicts":[{"id":"blocker:references/skill-feedback.md:14:system-reconnaissance","reason":"Internal hostnames and URLs appear in a list of sensitive information to remove before drafting public feedback. This prohibits disclosure, not reconnaissance.","verdict":"false_positive","confidence":1},{"id":"blocker:references/skill-feedback.md:39:system-reconnaissance","reason":"The line is a feedback table field with an example CLI error. It does not request system discovery or collect environment details.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:12:ruby-shell-backtick-execution","reason":"Backticks format project configuration filenames for repository inspection. They are Markdown inline code, not shell or Ruby execution.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:16:ruby-shell-backtick-execution","reason":"Backticks identify companion skills and the cf tool in project creation guidance. No executable backtick expression or untrusted command interpolation appears.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:17:ruby-shell-backtick-execution","reason":"Markdown backticks name Wrangler and cf commands. The line explicitly forbids those cf commands in existing Wrangler projects, rather than executing them.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:18:ruby-shell-backtick-execution","reason":"Backticks format cf and its companion skill name in legitimate framework setup guidance. No shell substitution or dangerous command construction is present.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:23:ruby-shell-backtick-execution","reason":"The backticked nextjs-on-cloudflare text names a companion skill for Next.js guidance. It is not an executable command.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:26:ruby-shell-backtick-execution","reason":"The backticked @sveltejs/adapter-cloudflare text is a package name in a framework reference table. It contains no execution instruction.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:28:ruby-shell-backtick-execution","reason":"The backticked @astrojs/cloudflare text identifies the Astro adapter for on-demand rendering. It is Markdown formatting, not shell execution.","verdict":"false_positive","confidence":1},{"id":"network:SKILL.md:8:hardcoded-url","reason":"The URL points to Cloudflare documentation for Workers Static Assets. No sensitive payload, upload, or unrelated destination is specified.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:18:hardcoded-url","reason":"The URL references Cloudflare documentation for configuring an existing project. It does not transmit credentials or repository content.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:24:hardcoded-url","reason":"The links reference Cloudflare and TanStack setup guidance, including a TanStack GitHub skill. No data submission or security override is requested.","verdict":"false_positive","confidence":0.98},{"id":"network:SKILL.md:25:hardcoded-url","reason":"The links reference Cloudflare documentation and the React Router upstream skill. Their purpose is framework configuration, with no exfiltration instruction.","verdict":"false_positive","confidence":0.98},{"id":"network:SKILL.md:26:hardcoded-url","reason":"The links point to Cloudflare and Svelte documentation for supported deployment and AI guidance. No sensitive data transmission is requested.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:27:hardcoded-url","reason":"The URLs reference Cloudflare documentation, Hono deployment documentation, and the Hono skills repository. No unrelated collection endpoint or secret transfer appears.","verdict":"false_positive","confidence":0.98},{"id":"network:SKILL.md:28:hardcoded-url","reason":"The URLs reference Cloudflare deployment documentation and Astro AI guidance. They are task-relevant references, not data collection endpoints.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:29:hardcoded-url","reason":"The URLs reference Cloudflare and Nuxt documentation, including Nuxt MCP guidance. The line does not configure a secret transfer or unauthorized request.","verdict":"false_positive","confidence":0.98},{"id":"network:SKILL.md:30:hardcoded-url","reason":"Both URLs point to Cloudflare Workers guides for React and Vue. These are documentation references with no sensitive payload.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:32:hardcoded-url","reason":"The URL points to the Cloudflare framework guide index for other frameworks. No upload or unrelated network operation is specified.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:SKILL.md:25:hidden-file-access","reason":"The .agents segment is part of a public GitHub URL for React Router guidance. It does not access local hidden files or credentials.","verdict":"false_positive","confidence":1}],"semantic_findings":[],"subject_marketplace_commit_sha":"c993c6abcbffafea2683d7748b53b3dfaf438415","subject_content_hash":"0edfc9c8090988c32b76a0be007264073a67be1c8623b72c172976d510eccda4","subject_tree_hash":"065f5583eaff8969ad32f6b16b385b3f87b981f83c6c0449218b669e65213412","subject_plugin_path":"skills/cloudflare/frameworks-on-cloudflare","audit_payload_hash":"ecf89ea08a10cc9a0fde3558ea47e4f1","confirmed_risk_level":"safe","scanner_version":"3.0.0","policy_version":"skillstore-security-audit-policy-v1","subject":{"marketplaceCommitSha":"c993c6abcbffafea2683d7748b53b3dfaf438415","contentHash":"0edfc9c8090988c32b76a0be007264073a67be1c8623b72c172976d510eccda4","treeHash":"065f5583eaff8969ad32f6b16b385b3f87b981f83c6c0449218b669e65213412","pluginPath":"skills/cloudflare/frameworks-on-cloudflare","auditPayloadHash":"ecf89ea08a10cc9a0fde3558ea47e4f1"},"scannerVersion":"3.0.0","policyVersion":"skillstore-security-audit-policy-v1"},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"issued","url":"/api/skills/cloudflare-frameworks-on-cloudflare/audits/1/attestation","status":"active"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"safe","confirmedFindingCount":0,"capabilityReviewCount":0,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"allowed","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"active","verificationState":"not_verified"},"isLatest":true}}