Address Snyk W007 (HIGH) finding for insecure credential handling.
- Remove `echo "secret-value" | wrangler secret put` pattern; use interactive
prompt as primary method and file redirect for CI
- Replace hardcoded connection string `postgres://user:pass@...` with env var
reference `$HYPERDRIVE_CONNECTION_STRING` and individual params
- Replace `--origin-password "new-password"` with `$DB_PASSWORD` env var
- Fix incorrect `--public-credential` flag to actual wrangler flags
(`--aws-access-key-id`, `--dockerhub-username`) with env var references
- Add security callout blocks in Secrets and Container Registries sections
- Add best practice #9: never embed secrets in commands
* Add GraphQL Analytics API reference skill
New reference covering Cloudflare's GraphQL Analytics API — the single
endpoint for querying analytics across all Cloudflare products (HTTP,
Workers, DNS, Firewall, R2, KV, D1, AI, and 70+ other datasets).
New files:
- references/graphql-api/README.md — Overview, decision tree, dataset
index, naming conventions, reading order
- references/graphql-api/api.md — Query structure, aggregation fields
(sum/avg/quantiles/count/ratio/uniq/confidence), dimensions, filtering
operators, pagination, sorting, introspection, settings node
- references/graphql-api/configuration.md — Auth (API tokens), client
setup (curl, TypeScript, Python, Workers), GraphQL Explorer, schema
introspection, finding zone/account IDs
- references/graphql-api/patterns.md — 15+ ready-to-use query patterns:
time-series, top-N, Workers performance, firewall events, DNS, cache
analytics, R2/KV/D1 storage, AI inference, multi-dataset dashboards
- references/graphql-api/gotchas.md — Rate limits, ABR sampling caveats,
common errors (with solutions), plan-based availability, datetime
handling, performance tips
Modified files:
- SKILL.md — Added analytics/metrics decision tree, added GraphQL API
entry to Developer Tools product index
- analytics-engine/README.md — Added See Also cross-links to graphql-api
and observability references
- api/README.md — Added See Also cross-link to graphql-api reference
- observability/README.md — Added See Also cross-link to graphql-api
- web-analytics/README.md — Added reciprocal cross-link to graphql-api
Testing:
- Thorough human review (read-through of each file)
- Two comprehensive AI reviews using parallel subagents for factual
accuracy, completeness, and style — followed by a validation pass that
filtered false positives. Caught and fixed 8 issues:
- Settings node query was structurally invalid (missing dataset nesting)
- R2 query pattern used nonexistent count field (only sum/dimensions/
confidence exist on r2OperationsAdaptiveGroups)
- Worker example in configuration.md was missing datetime_lt upper
bound, contradicting the skill's own best practice
- Confidence interval example included undocumented isValid field
- Rate limit described as flat 300/5min; corrected to cost-based
default 300, max 320
- Separator convention (-- vs -) mismatched peer references; fixed
across all 5 files
- web-analytics/ was missing reciprocal cross-link
- _notin/_notlike operators initially removed as undocumented, then
re-added after schema introspection confirmed they exist (with note)
- 20 GraphQL queries executed against a live Cloudflare account covering:
zone-scoped (HTTP time-series, top-N countries/paths/errors, firewall
events/blocks, DNS volume, cache breakdown, multi-dataset dashboard,
confidence intervals, daily rollups with uniq, _like filter, _notin
filter, aliases) and account-scoped (Workers overview/error-rate with
quantiles, KV operations, R2 operations, settings node, cost/budget).
19/20 passed on first attempt; the 1 failure (R2 count) was fixed.
* Trim graphql-api reference files to ~200 lines each per review feedback
* add workers-best-practices skill
* address self-review findings
- fix floating promise in streaming concatenation example (contradicted own rules)
- add base URL note for relative Retrieve paths in rules.md
- generalize implements-vs-extends anti-pattern to all platform base classes
- deduplicate review.md anti-pattern table (points to SKILL.md instead)
- expand code categorization step with per-category check guidance
- add CPU time limit awareness rule
- fix vague ~6 months threshold in compat date rule
Add new sandbox-sdk skill for building secure code execution environments on Cloudflare. The skill follows the retrieval-led reasoning approach from the Vercel agents.md research, biasing agents towards fetching official docs and examples rather than relying on potentially outdated training data.
- Add sandbox-sdk skill with core patterns, wrangler config, and API guidance
- Include references for detailed API signatures and example mappings
- Add retrieval-first section to durable-objects skill with doc URLs
- Update README with sandbox-sdk in skills table
The sandbox-sdk skill covers getSandbox lifecycle, exec vs runCode decisions, file operations, Dockerfile extensions, preview URLs, and anti-patterns.
The "owner" key is not valid in the Claude Code plugin schema.
The correct key for attribution is "author".
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Matt Silverlock