cloudflare-workers-security

Cloudflare Workers security with authentication, CORS, rate limiting, input validation. Use for securing APIs, JWT/API keys, or encountering auth failures, CORS errors, XSS/injection vulnerabilities.

Quality

83%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Quality

Content

76%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A highly actionable skill body with comprehensive executable code and well-organized progressive disclosure to real reference files. Main weakness is workflow clarity — it presents patterns as a catalog rather than a sequenced, validated workflow with feedback loops.

Suggestions

Add explicit validation checkpoints and an error-recovery loop to the Quick Security Checklist (e.g., 'If auth fails, check token format and expiry before retrying').

Resolve the Templates table: either create the referenced templates/ directory (auth-middleware.ts, cors-handler.ts, rate-limiter.ts, secure-worker.ts) or remove the table to avoid dangling references.

Consolidate the inline code into a single ordered 'secure a Worker' workflow so the sequencing (validate → authenticate → rate-limit → apply headers → CORS) reads as one process rather than parallel reference snippets.

Dimension	Reasoning	Score
Conciseness	Mostly efficient with executable code blocks and tight tables, but a few sections pad concepts Claude already knows (e.g., inline comments restating 'Validate all input' and explanatory preambles like 'Comprehensive security patterns for protecting Workers and APIs').	4 / 5
Actionability	Provides copy-paste-ready, executable TypeScript for JWT verification, API key validation, Zod input validation, security headers, and CORS, plus a runnable audit script — covering the common cases with concrete code.	5 / 5
Workflow Clarity	The Quick Security Checklist sequences steps (validate → authenticate → rate limit → headers → cookies) but there are no explicit validation checkpoints or error-recovery feedback loops, and the body mixes parallel patterns rather than a single clear workflow.	3 / 5
Progressive Disclosure	Good structure with a dedicated 'When to Load References' section pointing to real one-level-deep reference files (verified: authentication.md, cors-security.md, input-validation.md, rate-limiting.md, secrets-management.md, security-headers.md all exist) and a scripts table; however the Templates table references a non-existent templates/ directory, a minor organization gap.	4 / 5
	Total	16 / 20 Passed

Description

91%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, well-constructed description that clearly states capabilities and provides rich, natural trigger phrases. Minor gap is that capabilities are framed as domains rather than concrete verbs, but this does not materially weaken utility.

Dimension	Reasoning	Score
Specificity	Names the domain (Cloudflare Workers security) and lists several concrete capability areas ('authentication, CORS, rate limiting, input validation'), though it describes domains rather than discrete actions like 'verify', 'configure', or 'validate'.	4 / 5
Completeness	Explicitly answers both 'what' (security with authentication, CORS, rate limiting, input validation) and 'when' ('Use for securing APIs, JWT/API keys, or encountering auth failures, CORS errors, XSS/injection vulnerabilities') with concrete trigger phrases.	5 / 5
Trigger Term Quality	Comprehensive natural trigger terms including 'securing APIs', 'JWT/API keys', 'auth failures', 'CORS errors', and 'XSS/injection vulnerabilities' — phrases a user would actually say when they need this skill.	5 / 5
Distinctiveness Conflict Risk	Clearly scoped to Cloudflare Workers security with distinct triggers (JWT/API keys, CORS errors, XSS/injection), making overlap with unrelated skills minimal.	5 / 5
	Total	19 / 20 Passed

Validation

100%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository: secondsky/claude-skills
Path: plugins/cloudflare-workers/skills/cloudflare-workers-security/SKILL.md
Commit: 84802a4

Reviewed: 3 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.