wrangler

What it claims to do

Cloudflare Workers CLI for deploying, developing, and managing Workers, KV, R2, D1, Vectorize, Hyperdrive, Workers AI, Containers, Queues, Workflows, Pipelines, and Secrets Store. Load before running wrangler commands to ensure correct synt…

What we found · 7

• Description doesn’t say WHEN to use itmediumA good description names the trigger (e.g. "when reviewing a PR"). Without it the skill mis-fires or never fires.
• Bloated: high token costmedium~4,589 tokens on every single call. Compress instructions and trim examples.
• References API keys / env configmediumReads an API key or env var — normal for API clients. Ensure keys come from the runtime (not hardcoded); a leak risk only if sent to an untrusted endpoint.
• Embedded shell script blockmediumShips runnable command-line scripts. Not necessarily bad, but must be sandboxed and reviewed.
• Contains curl / wget network commandmediumAccesses the network from the shell. If the target is untrusted it can pull malware or exfiltrate data.
• Reads credentials and makes network calls — verify the destinationmediumThe normal shape of an API client (your key → the API). Static analysis sees the capability, not the intent — confirm the endpoint is one you trust; it is a data-leak risk only if it is not.
• Repeated contentlow~7 duplicate lines detected; de-duping is free token savings.

What its scripts can do

Conflicts with · 7

If you have both installed, they compete for the same triggers — the top cause of an agent picking the wrong skill.