# Build Cloudflare Basin Analytics Workflows

Streaming analytics requires coordinated ingestion, table management, and query configuration. This skill provides Cloudflare Basin references and implementation patterns across Pipelines, Catalog, and SQL.

## Install

```bash
npx skillstore add cloudflare/basin
```

## Metadata

- Status: approved
- Slug: cloudflare-basin
- Skillstore revision: r1
- Version status: missing
- Tree hash: 5f6d8e6932924af878f03dfc2caa6d5ea081f832a895fe540e30490336bd2003
- Author: cloudflare
- GitHub username: cloudflare
- License: MIT
- Repository: https://github.com/cloudflare/skills/tree/a18ffe2a99448ebff262fc87915b0fd14bab9b70/skills/basin
- Ref: e406bf64b5db6e514879399e87b346fa7ff7c2fb
- Supported tools: Claude, Codex, Claude Code
- Audit status: complete
- Agent install advisory: confirmation\_required
- Manual install advisory: allowed
- Artifact signature: available
- Audit attestation: unavailable
- Human verification: not\_verified
- Risk factors: network, filesystem, external\_commands
- Quality score: 38
- Quality tier: warning
- Public page: https://skillstore.pages.dev/skills/cloudflare-basin
- Manifest: https://skillstore.pages.dev/api/skills/cloudflare-basin/manifest

## Capabilities

- Guide stream, sink, and pipeline configuration through Wrangler, REST examples, and Terraform templates.
- Provide Worker producer, scheduled collector, schema validation, and Logpush transformation patterns.
- Explain catalog connection discovery, engine selection, and maintenance planning using linked provider documentation.
- Provide analytical SQL examples for joins, window functions, pagination, and partition filtering.
- Diagnose delayed ingestion, silent validation drops, failed sinks, and missing Worker bindings.
- Map former Pipelines, R2 Data Catalog, and R2 SQL names to the Basin workflow.

## Use Cases

- Design a Streaming Analytics Pipeline: Plan event schemas, Worker ingestion, SQL transformations, and Iceberg sinks for an R2 analytics workflow.
- Develop a Protected Analytics Dashboard: Adapt the Basin SQL Worker pattern with application access controls, bounded queries, and server-side credential storage.
- Diagnose Missing Analytics Events: Investigate pipeline status, delayed flushes, validation errors, sink credentials, and delivery metrics before changing infrastructure.

## Prompt Templates

### Choose the Basin Components

```
Explain which Basin components fit my event analytics workload: [workload]. Identify required resources and questions before proposing commands.
```

### Plan Authenticated Event Ingestion

```
Plan a Basin pipeline for [event schema] in [bucket]. Include authenticated ingestion, client validation, scoped credentials, and current Wrangler command checks.
```

### Investigate Missing Events

```
Events are accepted but missing from [table]. Use these sanitized metrics: [metrics]. Propose read-only checks without printing secrets or deleting resources.
```

### Review an Analytics Architecture

```
Review [architecture] for Basin analytics. Assess caller authorization, IP minimization, partition filtering, compaction, schema migration, and rollback using current provider references.
```

## Limitations

- This is reference guidance, not a standalone connector; live operations require installed tools, credentials, and authorized Cloudflare resources.
- Basin naming and command migration is ongoing; current documentation and installed Wrangler versions require verification.
- Pipeline transforms are row-level, while Basin SQL is read-only and is not intended for transactional application workloads.
- Examples require security hardening for authentication, authorization, IP handling, and credential diagnostics before production use.

## Best Practices

- Check current provider documentation and installed tool versions before applying migration commands or permission changes.
- Require ingestion authentication and dashboard authorization; scope credentials and never print secret values during diagnostics.
- Validate events before sending, verify stored output, and use partition filters, query limits, and appropriate table maintenance.

## Anti Patterns

- Deploying unauthenticated ingest or dashboard examples directly into production.
- Assuming accepted events are persisted without checking validation errors, sink files, and query results.
- Claiming IP redaction while storing raw addresses, or exposing authentication tokens in troubleshooting output.

## Security Audit

- Audited at: 2026-10-09T14:53:46.817\+00:00
- Summary: All 70 static matches are false positives involving documentation links, placeholder URLs, legitimate service requests, SQL identifiers, and TypeScript strings. Four semantic risks concern unauthenticated ingestion, an unprotected analytics endpoint, ineffective IP redaction, and a command that prints an API token. No evidence found of prompt injection, malicious exfiltration, or covert code execution in the reviewed files.

## Stats

- Views: 0
- Downloads: 1
- Favorites: 0
- Popularity score: 0