Навыки workers-best-practices

📦

workers-best-practices

Name: workers-best-practices
Author: cloudflare

Ревизия содержимого r1 Средний риск ⚙️ Внешние команды📁 Доступ к файловой системе🌐 Доступ к сети🔑 Переменные окружения

Review Cloudflare Workers with proven practices

Cloudflare Workers projects can fail through outdated APIs, incorrect bindings, and unsafe runtime patterns. This skill guides code reviews and implementation using current documentation and focused production checks.

Поддерживает: Claude Codex Code(CC)

📊 66 Адекватно

Установить с помощью моего Агента

Скопируйте этот запрос в своего Агента. Он содержит каноническую страницу Skill и манифест.

Запрос агента

Review the Skillstore skill "workers-best-practices" from https://skillstore.io/skills/cloudflare-workers-best-practices.md and its manifest at https://skillstore.io/api/skills/cloudflare-workers-best-practices/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

Ваш Агент по-прежнему должен показать план и запросить все подтверждения, требуемые политикой безопасности.

Ресурсы для AI-агентов

Используйте эти ссылки, когда AI-агенту, crawler или script нужен чистый контекст вместо полной страницы.

Markdown-детали GET /skills/cloudflare-workers-best-practices.md Подписанный manifest GET /api/skills/cloudflare-workers-best-practices/manifest Подписанный lockfile GET /api/skills/cloudflare-workers-best-practices/lockfile

Протестировать

Использование «workers-best-practices». Review a handler that stores the current user in a module variable.

Ожидаемый результат:

High: request-scoped data is stored in module state and can leak between reused isolates.
Use function parameters or local variables for request-specific values.

Использование «workers-best-practices». Review a configuration that stores an API key in vars.

Ожидаемый результат:

High: the configuration contains a secret that can enter version control.
Store the value with Wrangler secrets and keep only non-secret settings in vars.

Использование «workers-best-practices». Review a large upstream response that uses response.text().

Ожидаемый результат:

Medium: buffering an unbounded response can exceed the Workers memory limit.
Return the response body as a stream or process it incrementally.

Аудит безопасности

Средний риск

v1 • 20.07.2026 Открыть версионный отчет

The 92 static findings are false positives caused by Markdown code spans, illustrative Worker code, safe secret-handling guidance, and public documentation URLs. No prompt injection, credential exfiltration, or hidden execution behavior was found. The skill does instruct users to retrieve and extract an unpinned package, which warrants controlled execution.

Просканировано файлов

767

Проанализировано строк

Пункты проверки

Ложные срабатывания проигнорированы

Подтверждённые проблемы безопасности (1)

Средний

SKILL.md:21-29 references/review.md:11-18

Unpinned package retrieval and archive extraction

The skill directs the assistant to download the latest published @cloudflare/workers-types package and extract it into a shared temporary path. This creates a supply-chain and local temporary-directory exposure unless users review the package source and isolate the workspace.

Both files explicitly require retrieving the latest package and extracting its archive into /tmp. The exposure is real, although the named package is legitimate and no malicious intent is present.

Факторы риска

⚙️ Внешние команды (36)

📁 Доступ к файловой системе (9)

references/review.md:14 references/review.md:15 references/review.md:16 references/review.md:17 references/rules.md:187 SKILL.md:25 SKILL.md:26 SKILL.md:27 SKILL.md:28

🌐 Доступ к сети (29)

🔑 Переменные окружения (2)

references/rules.md:74 references/rules.md:82

Аудитор:: claude

Поделиться и цитировать этот отчет

Делитесь версионным отчетом об оценке, нейтральным значком, встраиваемой карточкой и цитатами. Skillstore публикует доказательства, не решая, безопасен ли этот Skill.

Открыть версионный отчет

Копировать ссылку на отчёт

https://skillstore.io/skills/cloudflare-workers-best-practices/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Значок Markdown

[![Skillstore security assessment](https://skillstore.io/badges/skills/cloudflare-workers-best-practices/security.svg)](https://skillstore.io/skills/cloudflare-workers-best-practices?utm_source=security_passport_badge)

Значок HTML

<a href="https://skillstore.io/skills/cloudflare-workers-best-practices?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/cloudflare-workers-best-practices/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Встраиваемая карточка

<iframe src="https://skillstore.io/embed/skills/cloudflare-workers-best-practices.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Академические ссылки (APA · BibTeX · CFF)

Цитата APA

cloudflare. (2026). workers-best-practices security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/cloudflare-workers-best-practices/audits/1

Цитата BibTeX

@techreport{cloudflare-cloudflare-workers-best-practices-2026,
  author = {cloudflare},
  title = {workers-best-practices security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/cloudflare-workers-best-practices/audits/1},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "workers-best-practices security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
  - name: "cloudflare"
date-released: "2026-07-20"
url: "https://skillstore.io/skills/cloudflare-workers-best-practices/audits/1"
identifiers:
  - type: other
    value: "skillstore:cloudflare-workers-best-practices:audit:1"
    description: "Skillstore immutable audit report identifier"

Оценка Skillstore

Почему такая оценка Достоверность доказательств: Средний

Архитектура

Сопровождаемость

Контент

Сообщество

Соответствие спецификации

Что вы можете построить

Review a Worker before release

Identify configuration, type, security, and runtime issues before a production deployment.

Set up a new Worker project

Create a configuration and handler structure that follows current Workers patterns.

Standardize team reviews

Apply a repeatable checklist for bindings, streaming, observability, and error handling.

Попробуйте эти промпты

Beginner: review one handler

Review this Cloudflare Worker handler for the most important production issues. Explain each issue and show the corrected approach.

Intermediate: check configuration

Review this wrangler.jsonc and Worker code together. Check binding names, secrets, compatibility settings, and observability.

Advanced: assess performance

Analyze this Worker for buffering, floating promises, global request state, and unnecessary network calls. Prioritize fixes by production impact.

Expert: complete release review

Perform a release review of these Worker files. Retrieve current Workers guidance first, then report verified findings with severity, evidence, and remediation.

Лучшие практики

Retrieve current Workers documentation and type definitions before making API-specific recommendations.
Provide file and line evidence for each finding and distinguish verified issues from suggestions.
Review configuration and source code together so binding names and secret handling stay consistent.

Избегать

Do not treat bundled examples as a substitute for the project's current Workers types and configuration.
Do not hardcode secrets or recommend storing credentials in Wrangler vars.
Do not buffer unbounded request or response bodies when streaming is appropriate.

Часто задаваемые вопросы

What does this skill review?

It reviews Cloudflare Workers code and Wrangler configuration for production practices, type safety, performance, and security.

Does it use current Cloudflare guidance?

It instructs the assistant to retrieve current Cloudflare documentation and Workers type definitions before API-specific advice.

Can it deploy my Worker?

No. It provides guidance and review findings. Deployment requires separate tools and authorization.

Can it find secrets?

It checks for common hardcoded secret patterns and recommends Wrangler secret storage. It cannot guarantee that all credentials are detected.

Does it support Durable Objects and Workflows?

It covers shared binding and class patterns, then directs specialized topics to the relevant documentation or skill.

Should I run its package retrieval commands automatically?

No. Review the package name and network policy first. Use trusted registries and a controlled temporary directory.

Сведения для разработчиков

Автор

cloudflare

Лицензия

MIT

Ревизия Skillstore

Примечание о версии

Автор не указал версию.

Репозиторий

https://github.com/cloudflare/skills/tree/70215303d44a81a0db3219428f4825b604fc6061/skills/workers-best-practices

Ссылка

c51565f83183133fcf8a8a7274ad0df2423655c8

Актуальность поддержки

20.07.2026

Использование

0 загрузок · 0 просмотров

Структура файлов

📁 references/

📄 review.md

📄 rules.md

📄 SKILL.md