技能 workers-best-practices

📦

workers-best-practices

Name: workers-best-practices
Author: cloudflare

内容修订 r1 中风险 ⚙️ 外部命令📁 文件系统访问🌐 网络访问🔑 环境变量

Review Cloudflare Workers with proven practices

Cloudflare Workers projects can fail through outdated APIs, incorrect bindings, and unsafe runtime patterns. This skill guides code reviews and implementation using current documentation and focused production checks.

支持: Claude Codex Code(CC)

📊 66 合格

使用我的智能体安装

将此请求复制给你的智能体，其中包含权威 Skill 页面和清单。

智能体请求

Review the Skillstore skill "workers-best-practices" from https://skillstore.io/skills/cloudflare-workers-best-practices.md and its manifest at https://skillstore.io/api/skills/cloudflare-workers-best-practices/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

你的智能体仍应展示其计划，并按安全策略请求必要确认。

Agent 可读资源

当 AI Agent、爬虫或脚本需要干净上下文，而不是读取完整页面时，请使用这些链接。

Markdown 详情 GET /skills/cloudflare-workers-best-practices.md 已签名 manifest GET /api/skills/cloudflare-workers-best-practices/manifest 已签名 lockfile GET /api/skills/cloudflare-workers-best-practices/lockfile

测试它

正在使用“workers-best-practices”。 Review a handler that stores the current user in a module variable.

预期结果:

High: request-scoped data is stored in module state and can leak between reused isolates.
Use function parameters or local variables for request-specific values.

正在使用“workers-best-practices”。 Review a configuration that stores an API key in vars.

预期结果:

High: the configuration contains a secret that can enter version control.
Store the value with Wrangler secrets and keep only non-secret settings in vars.

正在使用“workers-best-practices”。 Review a large upstream response that uses response.text().

预期结果:

Medium: buffering an unbounded response can exceed the Workers memory limit.
Return the response body as a stream or process it incrementally.

安全审计

中风险

v1 • 2026/7/20 打开版本化报告

The 92 static findings are false positives caused by Markdown code spans, illustrative Worker code, safe secret-handling guidance, and public documentation URLs. No prompt injection, credential exfiltration, or hidden execution behavior was found. The skill does instruct users to retrieve and extract an unpinned package, which warrants controlled execution.

已扫描文件

767

分析行数

复核项

已忽略误报

已确认安全问题 (1)

中

SKILL.md:21-29 references/review.md:11-18

Unpinned package retrieval and archive extraction

The skill directs the assistant to download the latest published @cloudflare/workers-types package and extract it into a shared temporary path. This creates a supply-chain and local temporary-directory exposure unless users review the package source and isolate the workspace.

Both files explicitly require retrieving the latest package and extracting its archive into /tmp. The exposure is real, although the named package is legitimate and no malicious intent is present.

风险因素

⚙️ 外部命令 (36)

📁 文件系统访问 (9)

references/review.md:14 references/review.md:15 references/review.md:16 references/review.md:17 references/rules.md:187 SKILL.md:25 SKILL.md:26 SKILL.md:27 SKILL.md:28

🌐 网络访问 (29)

🔑 环境变量 (2)

references/rules.md:74 references/rules.md:82

审计者: claude

分享与引用此报告

分享版本化评估报告、中性徽章、嵌入卡片和引用。Skillstore 只报告证据，不判断该 Skill 是否安全。

打开版本化报告

复制报告链接

https://skillstore.io/skills/cloudflare-workers-best-practices/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown 徽章

[![Skillstore security assessment](https://skillstore.io/badges/skills/cloudflare-workers-best-practices/security.svg)](https://skillstore.io/skills/cloudflare-workers-best-practices?utm_source=security_passport_badge)

HTML 徽章

<a href="https://skillstore.io/skills/cloudflare-workers-best-practices?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/cloudflare-workers-best-practices/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

嵌入卡片

<iframe src="https://skillstore.io/embed/skills/cloudflare-workers-best-practices.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

学术引用 (APA · BibTeX · CFF)

APA 引用

cloudflare. (2026). workers-best-practices security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/cloudflare-workers-best-practices/audits/1

BibTeX 引用

@techreport{cloudflare-cloudflare-workers-best-practices-2026,
  author = {cloudflare},
  title = {workers-best-practices security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/cloudflare-workers-best-practices/audits/1},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "workers-best-practices security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
  - name: "cloudflare"
date-released: "2026-07-20"
url: "https://skillstore.io/skills/cloudflare-workers-best-practices/audits/1"
identifiers:
  - type: other
    value: "skillstore:cloudflare-workers-best-practices:audit:1"
    description: "Skillstore immutable audit report identifier"

Skillstore 评分

评分依据证据置信度: 中

架构

可维护性

内容

社区

规范符合性

你能构建什么

Review a Worker before release

Identify configuration, type, security, and runtime issues before a production deployment.

Set up a new Worker project

Create a configuration and handler structure that follows current Workers patterns.

Standardize team reviews

Apply a repeatable checklist for bindings, streaming, observability, and error handling.

试试这些提示

Beginner: review one handler

Review this Cloudflare Worker handler for the most important production issues. Explain each issue and show the corrected approach.

Intermediate: check configuration

Review this wrangler.jsonc and Worker code together. Check binding names, secrets, compatibility settings, and observability.

Advanced: assess performance

Analyze this Worker for buffering, floating promises, global request state, and unnecessary network calls. Prioritize fixes by production impact.

Expert: complete release review

Perform a release review of these Worker files. Retrieve current Workers guidance first, then report verified findings with severity, evidence, and remediation.

最佳实践

Retrieve current Workers documentation and type definitions before making API-specific recommendations.
Provide file and line evidence for each finding and distinguish verified issues from suggestions.
Review configuration and source code together so binding names and secret handling stay consistent.

避免

Do not treat bundled examples as a substitute for the project's current Workers types and configuration.
Do not hardcode secrets or recommend storing credentials in Wrangler vars.
Do not buffer unbounded request or response bodies when streaming is appropriate.

常见问题

What does this skill review?

It reviews Cloudflare Workers code and Wrangler configuration for production practices, type safety, performance, and security.

Does it use current Cloudflare guidance?

It instructs the assistant to retrieve current Cloudflare documentation and Workers type definitions before API-specific advice.

Can it deploy my Worker?

No. It provides guidance and review findings. Deployment requires separate tools and authorization.

Can it find secrets?

It checks for common hardcoded secret patterns and recommends Wrangler secret storage. It cannot guarantee that all credentials are detected.

Does it support Durable Objects and Workflows?

It covers shared binding and class patterns, then directs specialized topics to the relevant documentation or skill.

Should I run its package retrieval commands automatically?

No. Review the package name and network policy first. Use trusted registries and a controlled temporary directory.

开发者详情

作者

cloudflare

许可证

MIT

Skillstore 修订

版本提示

作者未声明版本。

仓库

https://github.com/cloudflare/skills/tree/70215303d44a81a0db3219428f4825b604fc6061/skills/workers-best-practices

引用

c51565f83183133fcf8a8a7274ad0df2423655c8

维护新鲜度

2026/7/20

使用量

0 次下载 · 0 次浏览

文件结构

📁 references/

📄 review.md

📄 rules.md

提升 Vue 3 代码质量

由 vuejs-ai

Vue 项目常常会随着时间积累响应式、组件和性能方面的问题。此技能为更安全的模式和更清晰的代码提供有针对性的 Vue 3 指导。

编码与开发查看

workers-best-practices

使用我的智能体安装

Agent 可读资源

测试它

安全审计

已确认安全问题 (1)

风险因素

复制报告链接

Markdown 徽章

HTML 徽章

嵌入卡片

APA 引用

BibTeX 引用

CITATION.cff

Skillstore 评分

你能构建什么

Review a Worker before release

Set up a new Worker project

Standardize team reviews

试试这些提示

最佳实践

避免

常见问题

开发者详情

cloudflare 的更多技能

cloudflare-one-migrations

workers-profiling

k2

sandbox-stable

sandbox-migrate-to-next

cloudflare-one

相关技能

nestjs-code-audit

gauntlet

playwright-testing

code-reviewer

starknet-js

vue-best-practices