技能 basin
📦

basin

内容修订 r1 高风险 🌐 网络访问📁 文件系统访问⚙️ 外部命令

Build Cloudflare Basin Analytics Workflows

Streaming analytics requires coordinated ingestion, table management, and query configuration. This skill provides Cloudflare Basin references and implementation patterns across Pipelines, Catalog, and SQL.

支持: Claude Codex Code(CC)
⚠️ 38 差

使用我的智能体安装

将此请求复制给你的智能体，其中包含权威 Skill 页面和清单。

智能体请求
Review the Skillstore skill "basin" from https://skillstore.io/skills/cloudflare-basin.md and its manifest at https://skillstore.io/api/skills/cloudflare-basin/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

你的智能体仍应展示其计划，并按安全策略请求必要确认。

Agent 可读资源

当 AI Agent、爬虫或脚本需要干净上下文，而不是读取完整页面时，请使用这些链接。

Markdown 详情 GET /skills/cloudflare-basin.md 已签名 manifest GET /api/skills/cloudflare-basin/manifest 已签名 lockfile GET /api/skills/cloudflare-basin/lockfile

测试它

正在使用“basin”。 Which services should receive Worker events and support SQL reports?

预期结果:

  • Use a Basin Pipelines stream to receive validated Worker events.
  • Connect the stream through row-level transformations to a Basin Catalog Iceberg sink in R2.
  • Use Basin SQL for aggregate reports, with scoped credentials and protected dashboard access.
  • Verify current command syntax and confirm data delivery after the first flush.

正在使用“basin”。 The stream accepts events, but the table remains empty. What should I check?

预期结果:

  • Check pipeline state and failure reason without changing resources.
  • Compare events with the stream schema and inspect validation error metrics.
  • Check sink credentials, bucket availability, and catalog enablement.
  • Allow for the documented first-flush delay and verify both written files and query results.

正在使用“basin”。 Review the dashboard and Logpush examples before production deployment.

预期结果:

  • Require caller authentication and authorization before executing dashboard queries.
  • Enable ingestion authentication and control request volume.
  • Remove raw ClientIP from stored projections; hashing an additional column does not redact the original.
  • Check credential presence without printing tokens and store Worker tokens as secrets.

安全审计

高风险
v1 • 2026/10/9 打开版本化报告

All 70 static matches are false positives involving documentation links, placeholder URLs, legitimate service requests, SQL identifiers, and TypeScript strings. Four semantic risks concern unauthenticated ingestion, an unprotected analytics endpoint, ineffective IP redaction, and a command that prints an API token. No evidence found of prompt injection, malicious exfiltration, or covert code execution in the reviewed files.

16
已扫描文件
1,104
分析行数
0
复核项
0
已忽略误报

已确认安全问题 (4)

高
references/sql/patterns.md:50-58references/sql/patterns.md:61-69
Dashboard Worker Exposes Analytics Without Caller Authorization
The Worker matches "/api/analytics", queries with its server-side token, and returns result.rows without checking caller identity or permissions. A public deployment without external protection could disclose analytics and permit repeated billable queries.
The complete handler performs only a pathname check before returning authenticated query results. No caller authentication is shown; external deployment controls could reduce exposure.
中
references/pipelines/configuration.md:69-74references/pipelines/configuration.md:115-121
HTTP Ingestion Templates Disable Authentication
The REST example sets "authentication": false, and Terraform also sets authentication = false for HTTP ingestion. If deployed, unauthenticated senders could inject events, corrupt analytics, and increase storage or processing costs.
Both executable configuration examples explicitly disable authentication without requiring an upstream access boundary. Exploitation depends on deploying these examples and accessing the ingest endpoint.
中
references/pipelines/patterns.md:64-72
Claimed IP Redaction Retains Raw Client Addresses
The Logpush transform selects ClientIP alongside sha256(ClientIP) AS hashed_ip while claiming "redact PII at ingest". The stored output retains the original address, so following this example does not achieve the stated redaction.
The same SELECT explicitly includes both the raw ClientIP column and its hash. The misleading redaction comment directly contradicts the output projection.
中
references/sql/gotchas.md:31-32
Troubleshooting Command Prints Authentication Secret
The checklist recommends "echo $WRANGLER_BASIN_SQL_AUTH_TOKEN" to test token presence. This reveals the complete credential in terminal output and can expose it through captured logs or assistant transcripts.
The command explicitly expands and prints the authentication token rather than checking whether it exists. Further disclosure depends on how terminal output is recorded.

风险因素

🌐 网络访问 (26)
references/catalog/api.md:22 references/pipelines/api.md:14 references/pipelines/api.md:29 references/pipelines/api.md:36 references/pipelines/api.md:41 references/pipelines/api.md:109 references/pipelines/api.md:114 references/pipelines/patterns.md:9 references/pipelines/patterns.md:48 references/pipelines/patterns.md:48 references/pipelines/patterns.md:93 references/pipelines/README.md:51 references/sql/api.md:8 references/sql/configuration.md:36 references/sql/patterns.md:52 references/sql/patterns.md:62 references/sql/patterns.md:26 references/sql/patterns.md:22 references/sql/patterns.md:38 references/sql/patterns.md:51 SKILL.md:8 SKILL.md:12 SKILL.md:18 SKILL.md:19 SKILL.md:20 SKILL.md:22
📁 文件系统访问 (19)
references/catalog/api.md:30 references/catalog/patterns.md:10 references/catalog/patterns.md:11 references/catalog/README.md:16 references/pipelines/api.md:124 references/pipelines/gotchas.md:45 references/pipelines/patterns.md:122 references/pipelines/patterns.md:125 references/pipelines/patterns.md:130 references/pipelines/README.md:88 references/pipelines/README.md:89 references/sql/api.md:3 references/sql/api.md:96 references/sql/configuration.md:7 references/sql/patterns.md:109 references/sql/patterns.md:114 references/sql/patterns.md:118 references/sql/README.md:63 references/sql/README.md:64
⚙️ 外部命令 (6)
references/sql/patterns.md:51-54 references/sql/patterns.md:54-57 references/sql/patterns.md:57-64 references/sql/patterns.md:66-72 SKILL.md:12 SKILL.md:24
审计者: codex
分享与引用此报告

分享版本化评估报告、中性徽章、嵌入卡片和引用。Skillstore 只报告证据，不判断该 Skill 是否安全。

打开版本化报告
安全评估

复制报告链接

https://skillstore.io/skills/cloudflare-basin/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown 徽章

[![Skillstore security assessment](https://skillstore.io/badges/skills/cloudflare-basin/security.svg)](https://skillstore.io/skills/cloudflare-basin?utm_source=security_passport_badge)

HTML 徽章

<a href="https://skillstore.io/skills/cloudflare-basin?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/cloudflare-basin/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

嵌入卡片

<iframe src="https://skillstore.io/embed/skills/cloudflare-basin.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>
学术引用 (APA · BibTeX · CFF)

APA 引用

cloudflare. (2026). basin security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/cloudflare-basin/audits/1

BibTeX 引用

@techreport{cloudflare-cloudflare-basin-2026, author = {cloudflare}, title = {basin security audit report (audit version 1)}, institution = {Skillstore}, year = {2026}, number = {1}, url = {https://skillstore.io/skills/cloudflare-basin/audits/1}, note = {Author version unspecified} }

CITATION.cff

cff-version: 1.2.0 message: "If you use this Skill, cite its author and this versioned security audit report." title: "basin security audit report (audit version 1)" version: "unspecified" type: report authors: - name: "cloudflare" date-released: "2026-10-09" url: "https://skillstore.io/skills/cloudflare-basin/audits/1" identifiers: - type: other value: "skillstore:cloudflare-basin:audit:1" description: "Skillstore immutable audit report identifier"

Skillstore 评分

评分依据 证据置信度: 中
36
架构
85
可维护性
87
内容
65
社区
83
规范符合性

你能构建什么

Design a Streaming Analytics Pipeline

Plan event schemas, Worker ingestion, SQL transformations, and Iceberg sinks for an R2 analytics workflow.

Develop a Protected Analytics Dashboard

Adapt the Basin SQL Worker pattern with application access controls, bounded queries, and server-side credential storage.

Diagnose Missing Analytics Events

Investigate pipeline status, delayed flushes, validation errors, sink credentials, and delivery metrics before changing infrastructure.

试试这些提示

Choose the Basin Components 
Explain which Basin components fit my event analytics workload: [workload]. Identify required resources and questions before proposing commands.
Plan Authenticated Event Ingestion 
Plan a Basin pipeline for [event schema] in [bucket]. Include authenticated ingestion, client validation, scoped credentials, and current Wrangler command checks.
Investigate Missing Events 
Events are accepted but missing from [table]. Use these sanitized metrics: [metrics]. Propose read-only checks without printing secrets or deleting resources.
Review an Analytics Architecture 
Review [architecture] for Basin analytics. Assess caller authorization, IP minimization, partition filtering, compaction, schema migration, and rollback using current provider references.

最佳实践

  • Check current provider documentation and installed tool versions before applying migration commands or permission changes.
  • Require ingestion authentication and dashboard authorization; scope credentials and never print secret values during diagnostics.
  • Validate events before sending, verify stored output, and use partition filters, query limits, and appropriate table maintenance.

避免

  • Deploying unauthenticated ingest or dashboard examples directly into production.
  • Assuming accepted events are persisted without checking validation errors, sink files, and query results.
  • Claiming IP redaction while storing raw addresses, or exposing authentication tokens in troubleshooting output.

常见问题

What does this skill provide?
It provides reference guidance and implementation patterns for Basin Pipelines, Basin Catalog, and Basin SQL over R2.
Does installation create Cloudflare resources?
The reviewed package contains Markdown references, not provisioning scripts. Resource creation requires separately running authorized tools or API requests.
Does it cover the former Cloudflare product names?
Yes. It maps Pipelines, R2 Data Catalog, and R2 SQL to Basin names and warns that command migration requires verification.
Can Basin SQL modify data or replace a transactional database?
No. The references describe Basin SQL as read-only analytics; writes require other engines, and transactional workloads need a suitable database.
Why can accepted events be missing from queries?
Deferred schema validation, first-flush delay, roll intervals, and sink failures can prevent immediate visibility. Check service metrics and stored files.
Are the examples ready for production?
No. Review access controls, ingestion authentication, IP handling, secret diagnostics, current API behavior, and credential scope before deployment.

开发者详情

作者

cloudflare

许可证

MIT

Skillstore 修订

r1

版本提示

作者未声明版本。

仓库

https://github.com/cloudflare/skills/tree/a18ffe2a99448ebff262fc87915b0fd14bab9b70/skills/basin

引用

e406bf64b5db6e514879399e87b346fa7ff7c2fb

维护新鲜度

2026/10/11

使用量

0 次下载 · 0 次浏览

文件结构

📁 references/

📁 catalog/

📄 api.md

📄 configuration.md

📄 gotchas.md

📄 patterns.md

📄 README.md

📁 pipelines/

📄 api.md

📄 configuration.md

📄 gotchas.md

📄 patterns.md

📄 README.md

📁 sql/

📄 api.md

📄 configuration.md

📄 gotchas.md

📄 patterns.md

📄 README.md

📄 SKILL.md

cloudflare 的更多技能

查看全部

相关技能

查看全部