PinMe Worker R2 Storage Skill
Securely use the built-in R2 object storage for file uploads, downloads, and management in PinMe-deployed Cloudflare Workers.
The skill provides detailed security workflow: authentication, authorization, size and media policy validation, scoped object key generation, calling env.R2 and sanitized response. It explicitly prohibits accepting client-provided object keys, storing file bodies or base64 in D1, returning bucket names or internal keys, and emphasizes server-controlled keys and magic bytes or async scanning for sensitive formats. No malicious or overreaching behavior found; although no explicit user confirmation mechanism is shown, the skill instructs authentication and authorization before calling handlers. Deductions: lack of explicit user confirmation requirement, and the deployment platform's unknown identity. Although the platform may have external effects, the skill itself introduces no additional permissions.
The skill provides consistent, typed code examples covering upload, download, HEAD, delete, list, and R2+D1 coordination, with error handling and status code semantics. However, these examples are not tested, and no evidence of unit tests or CI covering this skill is provided. The dependency on Cloudflare R2 and D1 services cannot be verified in a static review. Deductions: lack of execution verification, and unverifiable external service dependency.
The skill clearly defines its audience (developers of PinMe Workers) and scenarios (R2 storage needs), distinguishes when to use R2 vs D1, and provides non-fit boundaries (e.g., conditional support for multipart API). The trigger description is semantically precise. However, its environment fit is limited because it depends on the PinMe platform and Cloudflare services, which may be unreachable from mainland China. Deductions: potential unreachability from mainland China and lack of discussion of service availability.
The skill is organized in a clear hierarchy: description, runtime contract, security workflow, code examples, and anti-patterns. But it lacks known limitations, explicit versioning and changelog, maintenance responsibility statement, and FAQ section. Although LICENSE and version information are provided, the skill's own version is not stated. Deductions: incomplete documentation, missing version/changelog.
The skill provides a complete implementation blueprint that can generate R2 storage code directly, but the output is not verified; also lacks quantifiable benefits compared to manual implementation or alternatives. Static review cannot confirm whether the code actually works, especially related to the specific PinMe environment binding. Deductions: unverified execution results, and lack of direct usability evidence.
The repository contains CI workflows and tests for the CLI, but these do not cover the skill itself. The skill's code examples are not tested or reference third-party verification. Deductions: lack of tests or independent verification for the skill's key paths.
- The skill depends on the PinMe platform and Cloudflare R2 services, which may be unreachable from mainland China; verify availability before deployment.
- The skill's code examples are not tested; it is recommended to run local unit tests and verify real R2 behavior before production deployment.
- Static review cannot confirm the security of the code in a real environment, e.g., the correctness of authentication and authorization implementations.
What does this skill do, and when should you use it?
This skill is designed for Cloudflare Workers generated by the PinMe platform, guiding developers to use the automatically injected env.R2 binding without manually configuring Wrangler or credentials. It provides a complete runtime contract, security workflow, streaming upload and download, metadata operations, R2 and D1 coordination, and pagination with concrete code examples. It emphasizes server-controlled object keys, authentication and authorization, and avoiding common anti-patterns. This skill is suitable for developing backends with file storage in PinMe projects, ensuring security and best practices.
The skill provides a set of TypeScript code patterns and guidelines for integrating R2 object storage in PinMe project Cloudflare Workers. Specifically, it covers securely streaming file uploads to env.R2 with content-type and size limits; streaming downloads with Range and conditional requests; reading metadata via HEAD; deleting objects; listing objects under a user prefix with pagination; and coordinating R2 with D1 for data consistency. It also emphasizes the security workflow: authentication, authorization, key generation, and response sanitization. A table of common anti-patterns is included.
- Building a file upload feature on a PinMe project where users need to upload images or PDFs without manual storage credential configuration.
- Developing an application that requires streaming large file downloads with support for Range requests and conditional requests.
- Implementing an admin interface to list user-uploaded files with pagination, without exposing bucket structure.
- An application that stores file content in R2 and metadata (like name, owner, status) in D1 database.
- Developers who want to follow security best practices and avoid unauthorized access and path traversal attacks.
What are this skill's strengths and limitations?
- No manual R2 credentials or Wrangler configuration needed – binding is automatically injected by PinMe.
- Provides comprehensive security workflow and anti-pattern checklist to avoid common vulnerabilities.
- Includes practical code snippets for streaming upload, download, metadata, pagination, and more.
- Explicitly guides coordination between R2 and D1 to manage consistency issues.
- Supports a variety of file types and scenarios, with guidance for multipart uploads for large files.
- Skill is tied to PinMe platform's R2 binding and not applicable to other deployment environments.
- Does not provide ready-to-use complete implementation code; developers must write code based on examples.
- No mention of testing strategies or how to verify the provided code, possibly lacking test coverage for examples.
- Advanced scenarios like multipart upload are only guided, not fully implemented, requiring additional effort.
How do you install this skill?
This skill is part of the PinMe repository (glitternetwork/pinme) at path skills/pinme-r2/SKILL.md. To install the entire PinMe skill collection, use the command shown in the README. After installation, the skill folder should be placed in a directory recognized by your agent. Specific steps are not documented and may vary depending on the agent used.
How do you use this skill?
In a PinMe project, when you need to handle file uploads, downloads, or management, describe the task in your prompt, e.g., 'In my PinMe Worker, I need a secure R2 file upload endpoint with streaming and size limit.' The skill will provide detailed code examples and security guidelines. You need to implement these patterns in your Worker code and ensure all routes follow the authentication and authorization workflow. For R2 and D1 coordination, follow the state transition steps in the skill.