skillhash

Is agents-sdk safe?

Grade A, 98/100. No meaningful risk found.

Build, debug, or review Cloudflare Agents SDK applications using the agents package.

cloudflare/skills/skills/agents-sdk 3.1kChecked 3h agoContent last changed 3h ago
A

agents-sdk

skills/agents-sdk
98/100 · No meaningful risk found1 low

Build, debug, or review Cloudflare Agents SDK applications using the agents package.

Content hash
sha256:3f027b7798cdd3decc09d038dfe0f00311aa774ba12230cf0e4103cc21602c8d
Files
20
Quality
100/100

Security findings

  • lowUnpinned package installSL501 · skills/agents-sdk/SKILL.md:81
    npm install agents

    Installing without a version means a future malicious release lands automatically. Fix: Pin an exact version (pkg==1.2.3, pkg@1.2.3).

  • infoUnpinned package installSL501 · skills/agents-sdk/references/configuration.md:57
    npx wrangler types

    Installing without a version means a future malicious release lands automatically. Fix: Pin an exact version (pkg==1.2.3, pkg@1.2.3). Severity lowered: the line reads as documentation, not an instruction.

  • infoUnpinned package installSL501 · skills/agents-sdk/references/think.md:8
    npm install @cloudflare/think

    Installing without a version means a future malicious release lands automatically. Fix: Pin an exact version (pkg==1.2.3, pkg@1.2.3). Severity lowered: the line reads as documentation, not an instruction.

  • infoUnpinned package installSL501 · skills/agents-sdk/references/voice.md:8
    npm install @cloudflare/voice

    Installing without a version means a future malicious release lands automatically. Fix: Pin an exact version (pkg==1.2.3, pkg@1.2.3). Severity lowered: the line reads as documentation, not an instruction.

  • infoUnpinned package installSL501 · skills/agents-sdk/references/webhooks-push.md:48
    npm install web-push

    Installing without a version means a future malicious release lands automatically. Fix: Pin an exact version (pkg==1.2.3, pkg@1.2.3). Severity lowered: the line reads as documentation, not an instruction.

  • infoUnpinned package installSL501 · skills/agents-sdk/references/webhooks-push.md:86
    VAPID keys: generate with `npx web-push generate-vapid-keys`, store as secrets.

    Installing without a version means a future malicious release lands automatically. Fix: Pin an exact version (pkg==1.2.3, pkg@1.2.3). Severity lowered: the line reads as documentation, not an instruction.

Files in this skill
  • SKILL.md11.8 KB
  • references/browse-the-web.md1.6 KB
  • references/callable.md2.1 KB
  • references/client-sdk.md1.2 KB
  • references/codemode.md2.8 KB
  • references/configuration.md1.8 KB
  • references/durable-execution.md1.7 KB
  • references/email.md3.5 KB
  • references/human-in-the-loop.md929 B
  • references/mcp.md1.3 KB
  • references/observability.md1.3 KB
  • references/queue-retries.md1.4 KB
  • references/routing.md1.8 KB
  • references/server-driven-messages.md868 B
  • references/state-scheduling.md1.5 KB
  • references/streaming-chat.md1.4 KB
  • references/think.md2.9 KB
  • references/voice.md1.9 KB
  • references/webhooks-push.md2.4 KB
  • references/workflows.md2.3 KB

Questions about agents-sdk

Is agents-sdk safe to install?
Our scanner gave agents-sdk grade A (98/100): no meaningful risk found. It matched 1 rule(s); review them below before installing. Static analysis cannot prove safety, so pin the reviewed revision with a lockfile.
How do I install agents-sdk in Claude Code or Codex?
Run skillhash add github:cloudflare/skills/skills/agents-sdk. It downloads the exact commit, checks the grade against your policy, writes skills.lock and installs it into .claude/skills and .agents/skills.
What happens if agents-sdk changes upstream?
Its content hash changes. skillhash verify fails in CI until you review the new version and update the lock. With a watch, you also get an alert.

More from cloudflare/skills