Skills durable-objects
📦

durable-objects

Content revision r1 Medium Risk ⚡ Contains scripts⚙️ External commands🌐 Network access📁 Filesystem access🔑 Env variables

Build reliable Durable Objects

Stateful Workers applications can fail when storage, concurrency, and routing patterns are unclear. This skill provides practical Durable Objects patterns for implementation, review, configuration, and testing.

Supports: Claude Codex Code(CC)
📊 67 Adequate

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request
Review the Skillstore skill "durable-objects" from https://skillstore.io/skills/cloudflare-durable-objects.md and its manifest at https://skillstore.io/api/skills/cloudflare-durable-objects/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/cloudflare-durable-objects.md Signed manifest GET /api/skills/cloudflare-durable-objects/manifest Signed lockfile GET /api/skills/cloudflare-durable-objects/lockfile

Test it

Using "durable-objects". Design a booking Durable Object with temporary holds.

Expected outcome:

  • Suggested one object per resource or schedule.
  • SQLite tables for holds and confirmed bookings.
  • An alarm pattern for hold expiration.
  • Concurrency and validation considerations.

Using "durable-objects". Review my Durable Object test strategy.

Expected outcome:

  • Coverage gaps for isolated storage and alarm execution.
  • Recommended direct object and HTTP integration tests.
  • Concrete assertions for routing and persistence.

Security Audit

Medium Risk
v1 • 7/20/2026 Open versioned report

All 93 static findings are false positives caused by documentation syntax, Durable Objects SQLite APIs, test fixtures, and Cloudflare documentation links. No command execution, local secret access, or data-exfiltration behavior was found. One medium-risk documentation issue remains: the CORS example uses a wildcard origin while allowing Authorization.

4
Files scanned
1,095
Lines analyzed
0
Review items
0
False positives ignored

Confirmed security concerns (1)

Medium
references/workers.md:285-290
Overly Broad CORS Example
The CORS example permits every origin while allowing the Authorization header. Users who copy it for authenticated endpoints may expose those endpoints to untrusted origins.
The example explicitly sets Access-Control-Allow-Origin to a wildcard and permits Authorization. This is a well-known unsafe default for authenticated browser APIs.

Risk Factors

⚡ Contains scripts (11)
references/rules.md:26 references/rules.md:58 references/rules.md:85 references/rules.md:97 references/rules.md:104 references/rules.md:145 references/rules.md:146 references/rules.md:147 references/testing.md:196 SKILL.md:85 SKILL.md:149
⚙️ External commands (40)
references/rules.md:26-27 references/rules.md:58-59 references/rules.md:85-88 references/rules.md:97-98 references/rules.md:104-106 references/rules.md:145 references/rules.md:146 references/rules.md:147 references/rules.md:90-97 references/rules.md:101-104 references/rules.md:107-110 references/rules.md:161-164 references/rules.md:164-167 references/testing.md:196 SKILL.md:85-89 SKILL.md:149 SKILL.md:29 SKILL.md:34 SKILL.md:35 SKILL.md:36 SKILL.md:38 SKILL.md:62-70 SKILL.md:70-74 SKILL.md:74-85 SKILL.md:90-110 SKILL.md:110-115 SKILL.md:115-116 SKILL.md:116-117 SKILL.md:117-120 SKILL.md:120-125 SKILL.md:125-127 SKILL.md:127-128 SKILL.md:128 SKILL.md:132-143 SKILL.md:143-147 SKILL.md:147-155 SKILL.md:155-159 SKILL.md:159-171 SKILL.md:171-175 SKILL.md:175-186
🌐 Network access (22)
references/rules.md:163 references/rules.md:261 references/rules.md:163 references/testing.md:87 references/testing.md:97 references/testing.md:98 references/testing.md:100 references/testing.md:87 references/testing.md:97 references/testing.md:98 references/testing.md:100 references/workers.md:107 references/workers.md:117 references/workers.md:294 references/workers.md:325 SKILL.md:104 SKILL.md:118 SKILL.md:128 SKILL.md:16 SKILL.md:17 SKILL.md:18 SKILL.md:19
📁 Filesystem access (3)
references/testing.md:33 references/testing.md:38 references/testing.md:114
🔑 Env variables (4)
references/workers.md:319 references/workers.md:95 references/workers.md:318 references/workers.md:326
Audited by: claude
Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report
Security Assessment

Copy report link

https://skillstore.io/skills/cloudflare-durable-objects/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/cloudflare-durable-objects/security.svg)](https://skillstore.io/skills/cloudflare-durable-objects?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/cloudflare-durable-objects?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/cloudflare-durable-objects/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/cloudflare-durable-objects.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>
Academic citations (APA · BibTeX · CFF)

APA citation

cloudflare. (2026). durable-objects security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/cloudflare-durable-objects/audits/1

BibTeX citation

@techreport{cloudflare-cloudflare-durable-objects-2026, author = {cloudflare}, title = {durable-objects security audit report (audit version 1)}, institution = {Skillstore}, year = {2026}, number = {1}, url = {https://skillstore.io/skills/cloudflare-durable-objects/audits/1}, note = {Author version unspecified} }

CITATION.cff

cff-version: 1.2.0 message: "If you use this Skill, cite its author and this versioned security audit report." title: "durable-objects security audit report (audit version 1)" version: "unspecified" type: report authors: - name: "cloudflare" date-released: "2026-07-20" url: "https://skillstore.io/skills/cloudflare-durable-objects/audits/1" identifiers: - type: other value: "skillstore:cloudflare-durable-objects:audit:1" description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium
45
Architecture
85
Maintainability
87
Content
65
Community
83
Spec Compliance

What You Can Build

Plan coordinated application state

Design room, game, booking, or tenant objects with clear ownership and routing.

Review Durable Object code

Check storage, concurrency, RPC, alarms, and error handling before release.

Build Workers test coverage

Create isolated Vitest tests for Durable Object methods, HTTP routes, storage, and alarms.

Try These Prompts

Start a Durable Object 
Create a TypeScript Durable Object for a chat room. Include a Wrangler binding, SQLite schema, and two RPC methods.
Add reliable storage 
Review this Durable Object storage design. Recommend a SQLite schema and explain how to keep related writes atomic.
Test an alarm workflow 
Write a Vitest test plan for a Durable Object alarm that expires booking holds. Include normal, retry, and isolation cases.
Review a production design 
Review this Workers and Durable Objects architecture for sharding, authorization boundaries, concurrency, WebSocket lifecycle, and observability. List prioritized fixes.

Best Practices

  • Retrieve current Cloudflare documentation before relying on an API or configuration detail.
  • Persist critical state before updating in-memory caches.
  • Use a trusted-origin allowlist for authenticated CORS endpoints.

Avoid

  • Do not route all requests through one global Durable Object.
  • Do not hold blockConcurrencyWhile across network or other external I/O.
  • Do not store secrets in Wrangler configuration files.

Frequently Asked Questions

What does this skill help build?
It helps build and review Cloudflare Durable Objects for stateful Workers applications.
Can it create Durable Object code?
Yes. It can propose TypeScript classes, Workers handlers, Wrangler configuration, and tests.
Does it support SQLite storage?
Yes. It includes patterns for SQLite schemas, parameterized queries, and migrations.
Can it help with testing?
Yes. It covers unit tests, HTTP integration tests, storage inspection, and alarm tests with Vitest.
Does it deploy my Worker?
No. It provides guidance and examples but does not deploy or modify Cloudflare resources.
Should I use the CORS example unchanged?
No. Replace wildcard origins with a trusted-origin allowlist for authenticated APIs.

Developer Details

Author

cloudflare

License

MIT

Skillstore revision

r1

Version notice

The author did not declare a version.

Repository

https://github.com/cloudflare/skills/tree/70215303d44a81a0db3219428f4825b604fc6061/skills/durable-objects

Ref

77d5da919262b24fe9496be8a819516787d082ed

Maintenance freshness

7/20/2026

Usage

0 downloads · 0 views

File structure

📁 references/

📄 rules.md

📄 testing.md

📄 workers.md

📄 SKILL.md

More from cloudflare

View all

Related Skills

View all