{"data":{"skill":{"slug":"cloudflare-workers-profiling","name":"workers-profiling","icon":"📦","repo":"https://github.com/cloudflare/skills/tree/c430dd965cea3a8faf0ef035e3b3d73b38518081/skills/workers-profiling","status":"approved","author":"cloudflare","authorVersion":null,"skillstoreRevision":1},"audit":{"id":"36600ee7-9e9f-4c2a-89d4-7c3aab3ba455","skill_id":"f77f9b0c-12c6-41f9-956c-d04a78491144","version":1,"content_hash":"v3:919ee28dc01b50c3ac40238df51719a4c8d20e40:fd608bf7d8e64708ddd301318007aa8581de5d2e1344231ea969e8fd1d0c9e4e:3c0d53835dd05d047307e15797d909d7706ab47b3d22b6dbc60676151d3280f8:736b696c6c732f636c6f7564666c6172652f776f726b6572732d70726f66696c696e67:e715309639ad9666e738958aa55ed891","risk_level":"safe","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":"allowed","manual_install_policy":"allowed","summary":"All four static findings are false positives: Markdown backticks name profiling tools, and the URL links to official Cloudflare documentation. No evidence found of prompt injection, credential theft, or data exfiltration in SKILL.md. The workflow confirms deployment targets and suggests asking before installing missing tooling.","remediation":[],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":22,"line_start":22},{"file":"SKILL.md","line_end":24,"line_start":24},{"file":"SKILL.md","line_end":27,"line_start":27}]},{"factor":"network","evidence":[{"file":"SKILL.md","line_end":12,"line_start":12}]}],"critical_findings":[],"high_findings":[],"medium_findings":[],"low_findings":[],"dangerous_patterns":[],"files_scanned":1,"total_lines":45,"audit_model":"codex","audited_at":"2026-10-11T14:34:16.006+00:00","created_at":"2026-10-11T15:08:50.038975+00:00","static_findings":[{"id":"external_commands:SKILL.md:22:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Where possible, use the [`cf` CLI](/cf/) to capture profiles. If the user requests `cf`, inspect the","category":"external_commands","line_end":22,"severity":"medium","line_start":22},{"id":"external_commands:SKILL.md:24:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"If `cf` isn't available, consider prompting the user whether they would like to install it.","category":"external_commands","line_end":24,"severity":"medium","line_start":24},{"id":"external_commands:SKILL.md:27:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"The profiling API will return a pprof file which you can analyze directly, or using appropriate tool","category":"external_commands","line_end":27,"severity":"medium","line_start":27},{"id":"network:SKILL.md:12:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"Start with the [production profiling guide](https://developers.cloudflare.com/workers/observability/","category":"network","line_end":12,"severity":"low","line_start":12}],"finding_verdicts":[{"id":"external_commands:SKILL.md:22:ruby-shell-backtick-execution","reason":"Line 22 uses Markdown backticks to name the cf CLI and recommends inspecting its installed help. This is documentation, not shell backtick execution.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:24:ruby-shell-backtick-execution","reason":"Line 24 formats cf as inline Markdown and suggests asking the user about installation. It contains no executable command or automatic installation instruction.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:27:ruby-shell-backtick-execution","reason":"Line 27 names Go's pprof utility using Markdown backticks as an option for analyzing profiling output. No shell substitution or executable payload appears.","verdict":"false_positive","confidence":1},{"id":"network:SKILL.md:12:hardcoded-url","reason":"Line 12 links to the official Cloudflare production profiling guide on developers.cloudflare.com. The instruction retrieves documentation and does not request sending credentials or profiling data.","verdict":"false_positive","confidence":0.99}],"semantic_findings":[],"subject_marketplace_commit_sha":"919ee28dc01b50c3ac40238df51719a4c8d20e40","subject_content_hash":"fd608bf7d8e64708ddd301318007aa8581de5d2e1344231ea969e8fd1d0c9e4e","subject_tree_hash":"3c0d53835dd05d047307e15797d909d7706ab47b3d22b6dbc60676151d3280f8","subject_plugin_path":"skills/cloudflare/workers-profiling","audit_payload_hash":"e715309639ad9666e738958aa55ed891","confirmed_risk_level":"safe","scanner_version":"3.0.0","policy_version":"skillstore-security-audit-policy-v1","subject":{"marketplaceCommitSha":"919ee28dc01b50c3ac40238df51719a4c8d20e40","contentHash":"fd608bf7d8e64708ddd301318007aa8581de5d2e1344231ea969e8fd1d0c9e4e","treeHash":"3c0d53835dd05d047307e15797d909d7706ab47b3d22b6dbc60676151d3280f8","pluginPath":"skills/cloudflare/workers-profiling","auditPayloadHash":"e715309639ad9666e738958aa55ed891"},"scannerVersion":"3.0.0","policyVersion":"skillstore-security-audit-policy-v1"},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"issued","url":"/api/skills/cloudflare-workers-profiling/audits/1/attestation","status":"active"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"safe","confirmedFindingCount":0,"capabilityReviewCount":0,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"allowed","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"active","verificationState":"not_verified"},"isLatest":true}}