Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →okhp3/okhp3-cloudflare-worker-api-proxy
Create a Cloudflare Worker that proxies API calls from a static frontend to a keyed API, keeping the API key server-side.
Passed 15 of 23 test cases with the skill, and 11 of 23 without it.
and 1 more in the full report
4 fixed11 passed either way8 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 4 test cases the skill fixed. Same model, same prompt, with and without the skill.
I am setting up a Cloudflare Worker to proxy API calls for my frontend app running at https://myapp.example.com. Since browsers send preflight OPTIONS requests, how should the Worker handle OPTIONS requests, and what headers should it return?
| Checked | Without skill | With skill |
|---|---|---|
| The preflight handler returns Access-Control-Allow-Origin matching the configured allowed origin environment variable. | Missed | Passed |
| The preflight response includes Access-Control-Allow-Methods specifying POST, GET, and OPTIONS. | Passed | Passed |
The instructions your model reads when the skill loads.
OverKill Hill P³ · overkillhill.com · github.com/OKHP3
A Cloudflare Worker is a serverless function that runs at Cloudflare's edge. It handles the API call server-side, holds the API key in secrets, and returns
| In scope | Out of scope |
|---|---|
| A narrow static-frontend-to-keyed-API proxy, CORS policy, secret binding, request validation, and client fetch example | Hiding a public endpoint, replacing authentication or authorization, rate-abuse prevention by assumption, or promising current plan limits without verification |
| the result to your browser. The key never appears in your JavaScript bundle. |
Use this pattern when:
// worker.js — paste this into the Cloudflare Worker editor
export default {
async fetch(request, env) {
// Handle CORS preflight
if (request.method === 'OPTIONS') {
return new Response(null, {
headers: {
'Access-Control-Allow-Origin': env.ALLOWED_ORIGIN || '*',
'Access-Control-Allow-Methods': 'POST, GET, OPTIONS',
'Access-Control-Allow-Headers': 'Content-Type',
'Access-Control-Max-Age': '86400',
},
});
}
test cases passed, vs 11 / 23 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.