workers-best-practices

An agent skill by cloudflare, from cloudflare/skills. Tags: cloudflare, code-quality, deployment, review, workers.

What it does

Cloudflare Workers best practices for production applications. Use when writing, reviewing, or configuring Workers.

Install

With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:

npx skills add cloudflare/skills --skill workers-best-practices

Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):

git clone --depth 1 https://github.com/cloudflare/skills
cp -r skills/skills/workers-best-practices ~/.claude/skills/workers-best-practices

Safety box score

Grade A, minimal risk: 9 of 100 risk points, rated 2026-09-22. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.

This skill is a read-only guidance pack for reviewing Cloudflare Workers projects; it does not ship executable code or installer scripts. Its main effects are outbound doc retrieval to Cloudflare and code/config review that can surface secrets and observability settings, but it does not itself run commands or change the machine.

Category levels, from 0 (none) to 3 (high)
Category	Level	Why
Code & shell execution	0 (none)	No shell scripts, binaries, or code-evaluation steps are shipped; the files are Markdown guidance only.
Network access	1 (low)	`SKILL.md` tells the agent to "Retrieve relevant Cloudflare documentation" and links to `developers.cloudflare.com`, which creates outbound reads but only to public docs.
Filesystem reach	0 (none)	The skill itself does not read, write, or delete files on disk; it only references files a reviewer may inspect in the target project.
Secrets & credentials	1 (low)	It explicitly discusses secret handling (`"Hardcoded secrets"`, `wrangler secret put`, and checking `.env`), so it may prompt inspection of secret-bearing config even though it does not request a secret outright.
Privilege & persistence	0 (none)	There is no sudo, service installation, global configuration, or OS-level change in the skill files.
Instruction hijack surface	0 (none)	The text contains normal review guidance and external doc retrieval, but no instructions to ignore higher-priority rules, hide content, or follow untrusted prompts.
Irreversible actions	0 (none)	It does not deploy, publish, send messages, or otherwise act on behalf of the user; it only advises how to review Workers code.
Transparency	0 (none)	All shipped content is plain Markdown and fully readable; there are no binaries, minified blobs, or decoded-at-runtime payloads.

Before installing

Confirm you want the agent to fetch public Cloudflare docs during reviews.
Read `references/configuration.md` to see the secret and observability checks it will apply.
Make sure your Workers projects do not keep secrets in `.env` or wrangler config before using this skill.

Rated 2026-09-22 by an automated review of 4 files from the skill's repository.

Source

Repository: cloudflare/skills (all skills from this repository)
Path: skills/workers-best-practices/SKILL.md
Branch: main
Updated: 2026-09-20

eas-hosting — EAS service (paid). Deploy Expo websites and Expo Router API routes to EAS Hosting - export the web bundle, run eas deploy for production and PR preview URLs.
code-improver — Runs an autonomous review-and-fix improvement loop over any code target — a skill, plugin, module, or directory — using a reviewer the user names.
deslop — Remove AI-generated code slop and clean up code style
differential-review — Performs security-focused differential review of code changes.
principle-minimize-reader-load — Apply when reviewing or shaping code that's hard to trace.
principle-test-behavior-not-implementation — Apply when you write, change, or keep a test. Call the code the way its users do and assert the result they observe against a literal expected value.