# Bootstrap a Cloudflare Workers App Locally

Existing Cloudflare Workers apps can fail locally when bindings, secrets, or initial data are missing. This skill guides setup and verifies an application request using the project's existing tools.

## Install

```bash
npx skillstore add cloudflare/cloudflare-app-bootstrap
```

## Metadata

- Status: approved
- Slug: cloudflare-cloudflare-app-bootstrap
- Skillstore revision: r1
- Version status: missing
- Tree hash: 356f359bb4a7a2130c071884144ddbe17c607729361ee350d9caf415e6873def
- Author: cloudflare
- GitHub username: cloudflare
- Repository: https://github.com/cloudflare/skills/tree/6eb6c781aa9b6438e0c7307bd102788a75fe1a6d/skills/cloudflare-app-bootstrap
- Ref: c993c6abcbffafea2683d7748b53b3dfaf438415
- Supported tools: Claude, Codex, Claude Code
- Audit status: complete
- Agent install advisory: allowed
- Manual install advisory: allowed
- Artifact signature: available
- Audit attestation: unavailable
- Human verification: not\_verified
- Risk factors: external\_commands, network
- Quality score: 70
- Public page: https://skillstore.pages.dev/skills/cloudflare-cloudflare-app-bootstrap
- Manifest: https://skillstore.pages.dev/api/skills/cloudflare-cloudflare-app-bootstrap/manifest

## Capabilities

- Inspect application roots, lockfiles, scripts, framework versions, and Cloudflare configuration before choosing setup commands.
- Map application bindings to existing or local resources while preserving resource identifiers.
- Guide D1 initialization with explicit local or remote migration targets and distinguish Durable Objects migration requirements.
- Separate build, browser, and runtime configuration while protecting local secret files.
- Regenerate binding types and run existing build and type checks.
- Exercise a representative application request and document verified behavior, resource targets, and remaining setup.

## Use Cases

- Onboard to an existing application: Connect required bindings and local configuration, then verify a representative request without replacing the existing project.
- Initialize a data-backed local workflow: Apply the minimum local initialization needed for a feature and verify its database access using existing migration tooling.
- Verify repeatable team setup: Check build and runtime configuration, distinguish local and remote resources, and document tested setup commands and unresolved requirements.

## Prompt Templates

### Start an existing app locally

```
Help me run this existing Cloudflare Workers app locally. Preserve its framework and package manager, identify missing configuration, and verify one meaningful request.
```

### Connect bindings and secrets

```
Inspect this app's bindings and required values. Separate browser, build, and runtime configuration, protect secrets, and report anything missing before verification.
```

### Initialize local application data

```
Prepare the minimum local D1 state needed for this feature using existing migrations. Do not modify remote data. Verify the intended response and state change.
```

### Audit a monorepo bootstrap workflow

```
Identify the app root and configuration source in this monorepo. Map local and remote bindings, regenerate types, run checks, and document verified setup. Do not deploy.
```

## Limitations

- Assumes an existing application; delegates initial Cloudflare configuration to related skills.
- Requires installed project tools and current documentation to confirm version-specific commands.
- Cannot verify behavior that depends on missing credentials or unsupported local services.
- Does not deploy unless deployment is part of the requested task.

## Best Practices

- Preserve the existing lockfile, configuration source, migration tooling, and resource identifiers.
- Confirm account, environment, and local or remote resource targets before creation, migrations, or test writes.
- Verify an application request and intended state change, then document tested commands and unresolved requirements.

## Anti Patterns

- Replacing a working application with a starter to fix configuration.
- Putting private runtime credentials into public client configuration or committing local secret files.
- Treating server startup as proof of working bindings or deploying when only local setup was requested.

## Security Audit

- Audited at: 2026-11-07T14:36:29.032\+00:00
- Summary: All 16 static findings are false positives: Markdown code spans, official Cloudflare documentation links, and feedback examples do not establish malicious execution or reconnaissance. The instructions restrict remote changes, protect secrets, and require approval before publishing sanitized feedback. No evidence found of prompt injection, credential exfiltration, or unauthorized destructive intent.

## Stats

- Views: 0
- Downloads: 0
- Favorites: 0
- Popularity score: 0