workers-best-practices

Reviews and authors Cloudflare Workers code against production best practices and anti-patterns.

Updated Mar 1, 2026
One-click install
npx skills add https://github.com/involvex/dev --skill workers-best-practices-involvex
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: workers-best-practices
Source: https://github.com/involvex/dev/tree/main/.claude/skills/workers-best-practices
Command: npx skills add https://github.com/involvex/dev --skill workers-best-practices-involvex

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve? Cloudflare Workers APIs, types, and wrangler configuration change frequently, so code written from stale knowledge often contains anti-patterns like floating promises, global request state, hardcoded secrets, and incorrect binding access that cause runtime failures or security issues. ## Core Features & Use Cases - Best-Practice Rule Enforcement: Applies canonical rules for configuration, streaming, waitUntil, bindings, observability, and Web Crypto security, with retrieval from live Cloudflare docs preferred over pre-trained knowledge. - Structured Code Review Workflow: Runs an eight-step review covering type validation, wrangler.jsonc config validation, binding-code consistency, serialization boundaries, and severity-rated findings with evidence and suggested fixes. - Anti-Pattern Detection: Flags common mistakes such as await response.text() on unbounded data, Math.random() for tokens, destructured ctx, hand-written Env interfaces, and implements instead of extends on platform base classes. - Use Case: When writing a new Worker with KV and Queue bindings, use this Skill to generate correct handler signatures, validate the wrangler config, and verify every Promise is awaited or passed to ctx.waitUntil() before deployment. ## Quick Start Review my Cloudflare Worker code and wrangler.jsonc for best-practice violations and anti-patterns.

Frequently Asked Questions about workers-best-practices

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I review Cloudflare Workers code for best practices?▼

Review Workers code by first retrieving the latest best practices page, workers types, and wrangler schema, then checking types, config, patterns, and security in sequence. Validate with `npx tsc --noEmit` and lint for `no-floating-promises`, and report findings with severity, line numbers, and suggested fixes.

What are common Cloudflare Workers anti-patterns to avoid?▼

Common anti-patterns include buffering unbounded responses with `await response.text()`, hardcoded secrets, `Math.random()` for tokens, floating promises, module-level request state, and calling the Cloudflare REST API instead of using bindings. Each causes memory exhaustion, credential leaks, or cross-request data leaks.

Should I use wrangler.jsonc or wrangler.toml for new projects?▼

Use wrangler.jsonc for new projects because newer Workers features are JSON-only and JSONC supports comments for documenting config decisions. TOML is legacy and acceptable in existing projects but should be flagged in new ones.

Why does destructuring ctx throw Illegal invocation in Workers?▼

Destructuring `ctx` with `const { waitUntil } = ctx` loses the `this` binding, causing an Illegal invocation error at runtime. Always call `ctx.waitUntil()` directly on the ExecutionContext parameter passed to your fetch handler.

How do I access bindings in Durable Objects versus module handlers?▼

Module export handlers like fetch and scheduled access bindings via the `env.X` parameter, while classes extending platform base classes like DurableObject or WorkerEntrypoint use `this.env.X`. Mixing these patterns is the most common binding access error.

When should I use Hyperdrive for database connections in Workers?▼

Use Hyperdrive for all external PostgreSQL or MySQL connections from Workers. It maintains a regional connection pool that eliminates per-request TCP, TLS, and auth overhead of 300-500ms, and requires the nodejs_compat compatibility flag.