Workers Production Review
Write and review production-ready Workers code using current Cloudflare guidance.
The skill is advisory and emphasizes keeping secrets out of source, using bindings, explicit error handling, and avoiding unnecessary public calls. No malware, exfiltration, or disproportionate permission red line is evident. Points are deducted because it directs agents to retrieve external documentation and run npm pack/npx commands without specifying user confirmation, network data-flow disclosure, dependency integrity checks, rollback, or sensitive-content handling.
The retrieval, typing, configuration, pattern, and security workflows across SKILL.md, review.md, and rules.md are broadly consistent and include useful failure risks. Points are deducted because execution depends on npm, node_modules, wrangler, search tooling, and network availability; commands lack robust error handling, version pinning, and explicit fallback behavior. Static review cannot reproduce key paths, so the score stays at or below 10.
The trigger scenarios, scope, and boundaries around Durable Objects, Workflows, and Wrangler are reasonably clear, including the distinction between module handlers and platform base classes. Points are deducted for missing explicit input/output formats and exclusion conditions, no Chinese-language support, and no mainland-China reachability discussion despite core dependence on Cloudflare documentation and npm services.
The material is layered into the main skill, review workflow, and detailed rules, with progressive disclosure, examples, anti-patterns, and severity definitions. The repository supplies Apache-2.0 licensing and installation guidance. Points are deducted because the skill lacks its own version, changelog, named maintenance responsibility, update path, and dependency-version policy; some governance and installation details exist only in shared README context.
The skill provides concrete Workers review criteria, implementation patterns, anti-patterns, and suggested validation commands, so it can directly guide the core task. Points are deducted because no representative review outputs or execution evidence are included; retrieval results, type validity, and command success remain for the user to verify. Under static calibration, the score cannot exceed 7.
The rules include specific Cloudflare documentation paths, commands, checks, and examples, providing limited auditability. The repository also has a Semgrep workflow, but it does not demonstrate coverage of the skill’s key paths and there are no skill-specific tests or independent third-party reproduction records. Static verifiability is therefore limited.
- The core workflow depends on live Cloudflare documentation, npm packages, and local tools, but degradation and diagnosable failure behavior are underspecified.
- Retrieved documentation and types are incorporated into review decisions without explicit guidance for handling untrusted, conflicting, or sensitive external content.
- There are no Chinese examples or mainland-China reachability notes, so Chinese users may need to translate terminology and solve access issues themselves.
- No skill-specific tests, version history, changelog, or clearly named maintenance owner is provided.
What does this skill do, and when should you use it?
This skill writes and reviews Cloudflare Workers code and checks wrangler.jsonc configuration. It focuses on streaming, promises, global state, secrets, bindings, observability, and security-related anti-patterns. Before making recommendations, it instructs the agent to retrieve current Cloudflare documentation, Workers types, and the Wrangler configuration schema. It is a good fit for production-oriented Workers development, but it does not replace the separate Durable Objects, Workflows, or Wrangler CLI skills.
Retrieves the current Workers best-practices page, Workers type definitions, the project's Wrangler configuration schema, and related reference files; reviews complete source files for binding access, handler types, configuration, streaming, floating promises, global state, serialization boundaries, secrets, cryptography, and error handling; recommends checks such as npx tsc --noEmit, Wrangler type generation, and linting; reports concrete violations, evidence, and corrective patterns.
- A developer is starting a Worker and needs to check compatibility dates, nodejs_compat, bindings, and secret configuration.
- A team is reviewing a Worker pull request and wants to catch floating promises, unbounded response reads, or module-level request state.
- An engineer is validating access patterns for KV, R2, D1, Queues, service bindings, or Hyperdrive.
- A maintainer is preparing a Worker for production and needs observability, structured errors, and secure randomness.
- A developer is unsure about a Workers API or type definition and wants current official references before changing code.
What are this skill's strengths and limitations?
- A retrieval-first workflow helps reduce errors caused by outdated Workers APIs and configuration fields.
- Covers configuration, request handling, architecture, observability, code patterns, and security.
- Lists concrete anti-patterns and explains why they matter.
- Prioritizes evidence, type validation, and code that developers may copy into production.
- Relies on network retrieval and local tools such as Node.js/npm, Wrangler, and TypeScript.
- The source provides no test suite, performance benchmark, or demonstrated review results.
- Its scope is Workers best practices; Durable Objects, Workflows, and Wrangler CLI require separate skills or references.
- The README documents the broader collection rather than a dedicated installation command for this skill.
How do you install this skill?
Install the repository and copy the skills/workers-best-practices folder into the skill directory used by the Agent client. The README documents destinations including ~/.claude/skills/ for Claude Code and ~/.codex/skills/ for OpenAI Codex. The collection can also be installed with npx skills add https://github.com/cloudflare/skills, or through the client's documented GitHub skill-installation flow. The source does not provide a dedicated command for installing only this skill.
How do you use this skill?
In an Agent Skills-compatible client, make a Workers coding or review request such as: “Review this Worker for streaming, floating promises, binding access, secret handling, and wrangler.jsonc configuration.” The skill first calls for current references, then checks the full files, types, configuration, code patterns, and security handling.