Cloudflare applications can accumulate usage charges through retries, recurring jobs, and unbounded work. This skill reviews local configuration and source for supported cost mechanisms and uncertainties.
Review the Skillstore skill "daftai-cloudflare-billing-audit" from https://skillstore.io/skills/daftai2026-daftai-cloudflare-billing-audit.md and its manifest at https://skillstore.io/api/skills/daftai2026-daftai-cloudflare-billing-audit/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.
エージェントは引き続き計画を提示し、セキュリティポリシーで必要な確認を求める必要があります。
エージェントが読めるリソース
AI エージェント、クローラー、スクリプトがページ全体ではなく整理されたコンテキストを必要とする場合は、これらのリンクを使ってください。
All 400 supplied matches were adjudicated as false positives from exclusions, synthetic tests, documentation, or bounded offline operations. No evidence found for credential exfiltration, malicious execution, or prompt injection in the reviewed context. The analyzer omitted 238 additional matches; manual review remains required, and portable filesystem access requires stable input and output trees. Static review was capped at 400/638 representative findings; omitted static matches are unconfirmed, so automatic publishing stays disabled until manual review.
daftai2026. (2026). daftai-cloudflare-billing-audit security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/daftai2026-daftai-cloudflare-billing-audit/audits/1
BibTeX形式の引用
@techreport{daftai2026-daftai2026-daftai-cloudflare-billing-audit-2026,
author = {daftai2026},
title = {daftai-cloudflare-billing-audit security audit report (audit version 1)},
institution = {Skillstore},
year = {2026},
number = {1},
url = {https://skillstore.io/skills/daftai2026-daftai-cloudflare-billing-audit/audits/1},
note = {Author version unspecified}
}
CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "daftai-cloudflare-billing-audit security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
- name: "daftai2026"
date-released: "2026-10-13"
url: "https://skillstore.io/skills/daftai2026-daftai-cloudflare-billing-audit/audits/1"
identifiers:
- type: other
value: "skillstore:daftai2026-daftai-cloudflare-billing-audit:audit:1"
description: "Skillstore immutable audit report identifier"
Skillstore スコア
このスコアの理由証拠の信頼度: 中
68
アーキテクチャ
85
保守性
87
コンテンツ
65
コミュニティ
91
仕様準拠
作成できるもの
Review a Worker before release
Inspect configured request paths and recurring jobs for source-supported cost amplification before deployment.
Investigate queue and alarm exposure
Trace queue feedback, retries, and Durable Object scheduling while distinguishing persistent job limits from per-invocation controls.
Prepare a cost-risk review
Summarize supported mechanisms, coverage gaps, and owner verification steps without requiring credentials or assuming production usage.
これらのプロンプトを試す
Start an offline audit
Audit the Cloudflare project at [absolute project path] for billing exposure. Keep the review offline and read-only, and separate supported findings from unknowns.
Focus on one workspace
Audit [absolute workspace path] for Workers and D1 cost mechanisms. Review configured entry points, query amplification, and listed migrations. Record deployment and index uncertainty.
Trace recurring work
Review [absolute project path] for queue feedback and Durable Object alarm recurrence. Trace persistent job budgets, progress, retries, and terminal guards through fingerprint-checked evidence.
Model a bounded cost scenario
Audit [absolute project path] and estimate costs using [plan, period, currency, and supplied usage assumptions]. Retrieve current official pricing and record dates, units, and uncertainties.
ベストプラクティス
Provide an explicit project path and a private output location outside the target tree; keep target, ancestor, and output trees stable.
Review only fingerprint-checked evidence and inspect actual triggers, guards, and persistent limits before promoting a scanner candidate.
Keep traffic assumptions, deployment uncertainty, and pricing dates explicit; use current official pricing only for requested estimates.
回避
Treating an empty candidate list or a binding declaration as proof of safety or proof of a billing defect.
Running target scripts, reading excluded credential files, or bypassing a refused controlled read with another reader.
Presenting budget alerts, per-request limits, or stale pricing as a guaranteed whole-account spending cap.
よくある質問
Which assistants can use this skill?
The skill supports Claude, Codex, and Claude Code. Its helper requires Bun and a supported local filesystem environment.
Does the audit require a Cloudflare token?
No. Default audits inspect local files offline and do not sign in, call account APIs, or read credentials.
Does it run or modify my application?
No. It does not execute target code, scripts, tests, hooks, or migrations. Reports are written outside the target tree.
Can it prevent an unexpected bill?
No. It identifies supported exposure mechanisms and review gaps. It does not enforce account limits or guarantee a spending cap.
Are all Cloudflare products scanned automatically?
No. Automated candidates cover narrow alarm and queue patterns. Product guides support broader agent review of authorized evidence.
Can it estimate monthly charges?
Only when explicitly requested. Estimates require current official prices, plan details, billing period, currency, usage assumptions, and stated uncertainties.