Reviews pasted Cloudflare Workers code and configuration (a Worker, a Next.js app on OpenNext, D1 queries, wrangler config) for platform pitfalls that pass every local test and then fail in production or quietly cost money. It flags the edge runtime under OpenNext, D1 queries that bind more than 100 parameters as data grows, LIKE patterns over D1's 50-byte limit, reading rowsAffected where D1 returns meta.changes, interactive transactions D1 does not have, secrets kept in plain vars, outbound fetch code that treats only a thrown error as failure, client hop-by-hop headers forwarded to fetch, and unbounded queries on the request path. Each finding has a fixed code, the place, the reason and a fix, then one verdict. Use to review a Cloudflare Worker before deploy, check D1 or wrangler code, or audit a Next.js app running on Cloudflare.
Workers Pitfalls Review: D1, OpenNext, Fetch is a tested SKILL.md that reviews pasted Cloudflare Workers code and configuration (a Worker, a Next.js app on OpenNext, D1 queries, wrangler config) for platform pitfalls that pass every local test and then fail in production or quietly cost money; an agent buys it once for $0.03 over x402.
General code review, style, performance tuning or security beyond the listed pitfalls, and anything that needs the running system: it reads pasted code, so it cannot see indexes, data sizes or bindings that the paste does not show, and it does not cover Durable Objects, Queues or KV.
Tested 2026-10-08 with a strong and a weak model.
| Sonnet | Haiku | |||
|---|---|---|---|---|
| with | without | with | without | |
| Planted pitfalls named (12 snippets) | 12/12 | 12/12 | 12/12 | 9/12 |
One run per model and snippet, the same word-based check on both sides. Sonnet found all twelve planted pitfalls without the skill too, so for Sonnet the skill adds no detection, only the fixed codes and verdict a program can read. Haiku without the skill called the edge runtime under OpenNext fine, twice, and did not mention D1's 50-byte LIKE limit; with the skill it named all twelve. On correct code the side without the skill gave general advice, such as validating a transfer amount, which this test neither rewards nor penalises.
Same cases and the same checks with and without the skill. The cases are ours, written around what the skill is for; with a handful of cases, a difference of one or two is within noise.
Our own test text, before and after the skill ran. Excerpts only.
Before
// src/index.ts — a plain Worker, deployed with wrangler deploy export default { async fetch(): Promise<Response> { return new Response("hello"); }, };
After
No findings. Verdict: no known pitfalls
Any language. Tried in: English.
Perpetual, non-exclusive; use and modify for yourself incl. paid work; no resale or republishing. Holder: Georgi Kalchev, aiskills402.com. Full terms.
Current version 1.0.0, updated 2026-10-08. Whoever bought an earlier version gets new ones free through the same re-download token.
v1.0.0 · 2026-10-08
First release: reviews pasted Cloudflare Workers code and configuration for platform pitfalls and lists each with a fixed code, the place, the reason and a fix, then a verdict (will break, fix before deploy, no known pitfalls). Breaks at once: the edge runtime under OpenNext, interactive D1 transactions. Breaks later or costs money: more than 100 bound D1 parameters, LIKE patterns over 50 bytes, rowsAffected instead of meta.changes, fetch code that only catches thrown errors, forwarded hop-by-hop headers, secrets in vars, unbounded queries on the request path.
Nine: the edge runtime under OpenNext, interactive D1 transactions, D1 queries past 100 bound parameters, LIKE patterns over 50 bytes, rowsAffected where D1 returns meta.changes, fetch code that only catches thrown errors, client hop-by-hop headers forwarded to fetch, secrets in plain vars and unbounded queries on the request path. Each was checked against Cloudflare's or OpenNext's documentation or measured in our own production.
Not with finding them: in our test Sonnet named all twelve planted pitfalls without the skill as well. What the skill adds there is a fixed list of codes and a verdict line that a pipeline can act on. Claude Haiku is different: without the skill it called the edge runtime under OpenNext fine and missed the LIKE limit, and with it Haiku found all twelve.
Rarely, but not never. Sonnet left all six correct snippets alone; Haiku flagged public vars holding a site address and a locale as secrets. Both also flagged the fetch status on a proxy that correctly passes the upstream status through, so read a fetch-status finding on a proxy with care.
We measured Turbopack breaking an OpenNext build on our own version, but OpenNext now lists Turbopack as supported, and we could not re-check it for current releases. A pitfall we cannot confirm today stays out of the skill.
We planted twelve D1, OpenNext and fetch pitfalls in Worker code. Sonnet found all of them unaided; Haiku said the edge runtime under OpenNext was fine.
8 Oct 2026 · 4 min read
Code & Engineering
Reviews a code change (a diff or a changed file pasted as text) and reports real problems ranked by severity — correctness bugs, security holes, data loss, missing error handling, edge cases, resource leaks — each with location, reason and a concrete fix in words. Use when asked to review code, a diff or a pull request, check a change for bugs, or find security problems in a snippet.
Code & Engineering
Reviews SQL queries, schemas and migrations for SQLite, Cloudflare D1 and Turso, where the bill and the speed follow the rows a query READS, not the rows it returns. Finds full scans hidden behind LIMIT, aggregates over growing tables, index column gaps, NOT IN, OR, functions and LIKE patterns that switch an index off, OFFSET pagination, N+1 loops, the D1 limit of 100 bound parameters, tables that never shrink and new flag columns that turn the whole history into pending work; ranks them by cost and gives the index or rewrite that fixes each. Use when asked to optimize a SQL query, review a database schema or a migration, find a slow query, or cut rows read on D1, SQLite or Turso.
Code & Engineering
Finds the loops behind a bill spike or an unexpected bill. Reviews a web app's code and config for loops and repeats that run up the bill on their own on Vercel, Turso, Cloudflare Workers and D1 and paid AI APIs. Finds two schedulers on one job, retries without a cap, work that triggers itself, client polling and React render loops, caches cleared on every write, middleware running on every static file, queues that resend failures forever, image settings that multiply transformations, health checks that count whole tables, alerts sent on every run and bots crawling endless filter URLs. Counts the runs per month, names the billed unit, ranks by cost and gives the change that stops each one. Use when asked why a Vercel, Turso or Cloudflare bill jumped, to find an infinite loop or a runaway cost, or to review a cron job, webhook, queue consumer, middleware or polling code before it ships.