Evidence record · captured 2026-10-11

Cloudflare Workers Best Practices

Instructs the agent to prefer retrieved docs over training data when writing or reviewing Workers, to keep compatibility dates current, and to enable Workers Logs and Traces. It lists concrete anti-patterns to flag in review (buffering unbounded bodies, hardcoded secrets, Math.random for tokens, un-awaited promises outside ctx.waitUntil, module-level request state, hand-written Env types instead of `wrangler types`, non-constant-time secret comparison) with references for configuration, runtime patterns and platform APIs.

Official publisherUnverifiedSource reviewedBehavior not tested

Source review

Editorial assessment

This is a source-only assessment. It does not claim runtime or security testing.

What it does

A code-review lens for Worker source: it gives the agent a fixed list of fifteen runtime anti-patterns to flag, each with its consequence, plus a rule that Workers Logs and Traces be enabled before production.

Best for

Reviewing a Worker pull request for runtime correctness and security issues
Preparing a new Worker for production, including compatibility date and observability settings
Auditing TypeScript Workers for drift between hand-written Env types and actual bindings

Strengths in the source

Names concrete review targets such as un-awaited promises outside ctx.waitUntil, module-level request state, and destructuring ctx methods.
Notes that observability.enabled alone does not turn on traces and that observability.traces.enabled must also be set.
Requires constant-time secret comparison via Web Crypto and crypto.getRandomValues or randomUUID instead of Math.random for tokens.
Has the agent regenerate Env types with wrangler types rather than maintain them by hand.

Limitations

Covers the Workers runtime only; Durable Objects, Workflows, and Wrangler commands are deferred to other skills or docs.
The bundled runtime-patterns reference still recommends @cloudflare/vitest-pool-workers, while the durable-objects testing reference describes migrating to the newer Vitest plugin.
Guidance on limits and APIs is meant to be verified against live docs, so results depend on network access at run time.

When not to use it

Small, narrow edits; the skill itself says a narrow edit does not require a full Workers audit.
Choosing which Cloudflare product to use, which the cloudflare platform skill handles.

Reviewed by Retenta editorial on 2026-10-11; scope: source only.

Files included in this review

skills/workers-best-practices/SKILL.md

Evidence and boundaries

Execution · not tested

Retenta has not executed this skill.

Security · not tested

The skill folder bundles no executable scripts. Retenta has not run a security scan.

Pinned publisher source: skills/workers-best-practices/SKILL.md
Revision: c430dd965cea3a8faf0ef035e3b3d73b38518081
License evidence: Apache-2.0Retenta preserves the license text captured with this immutable upstream snapshot; no independent legal or security review is claimed.
Last source change: 2026-10-01
Independent verification: Published by Cloudflare, but not independently verified by a third-party reviewer.
Upstream repository: Open publisher repository