A service worker is a persistent, cross-session, JS-controlled cache layer that sits in front of every network request the browser makes for a scope. Unlike HTTP caching, it is not opt-in per response — once a route is matched, the developer's strategy code decides freshness and disclosure, not Cache-Control. The common failure mode is copy-pasting one strategy (usually CacheFirst, straight from a tutorial) across navigation, API, and asset routes without differentiating by freshness need or security sensitivity. This skill performs the per-route-class review that catches both the stale-content incidents that uniform cache-first causes on navigation/API routes, and the security incidents that happen when authenticated or PII-bearing responses land in a persistent Cache API store that Workbox strategies do not automatically protect.
Use this skill when the user asks to:
\ngenerateSW/injectManifest) for caching-strategy correctness,scope / Service-Worker-Allowed coverage and cache-versioning/cleanup behavior.pwa-offline-readiness-review instead.Cache-Control/ETag header review with no service worker involved — that is standard HTTP caching, a narrower and materially different concern than programmatic Cache API control.Workbox strategy internals and Vite-PWA config surface change between major versions — never assert runtime semantics (what bypasses HTTP headers, what revalidates, what the default expiration behavior is) from memory.
ToolSearch with query \"context7\" (or \"select:mcp__Context7__resolve-library-id,mcp__Context7__query-docs\") to load the Context7 tools if not already loaded in this session./googlechrome/workbox for the strategy implementation in question (PrecacheStrategy, CacheFirst, NetworkFirst, StaleWhileRevalidate, NetworkOnly, ExpirationPlugin, cleanupOutdatedCaches)./websites/vite-pwa-org_netlify_app (or the closest match) when the project uses Vite PWA's generateSW/injectManifest config surface, runtimeCaching, skipWaiting/clientsClaim, or custom injectManifest service-worker source.precacheAndRoute serves via PrecacheStrategy, which reads from the Cache API and returns immediately on a hit, completely bypassing HTTP Cache-Control since no network round-trip occurs) is materially different from the general folk claim \"precache is cache-first\" — cite the specific mechanism, not the folk version.official_docs / references/workbox-strategy-semantics.md, and mark the claim documentation-based (Context7 unavailable) rather than presenting it as freshly verified.PrecacheStrategy/precache-and-route as a distinct mechanism from runtime CacheFirst — precache serves from the Cache API with no revalidation and no HTTP Cache-Control involvement at all; do not describe the two interchangeably.cache.put() on a non-GET request or response, treat that as a code smell requiring explanation, not a strategy question.Set-Cookie, an echoed Authorization value, or clearly PII/payment-bearing JSON is a hard block on caching, regardless of the performance justification offered — recommend NetworkOnly or explicit route exclusion instead.StaleWhileRevalidate or NetworkFirst there instead.cache.put() on an opaque, cross-origin no-cors response — the caller cannot inspect status or headers on an opaque response, so a poisoned or error response can be cached and served indefinitely with no visibility.scope (registration time) and Service-Worker-Allowed (response header, only needed when the script itself sits outside the desired scope) match the intended route coverage exactly — broader-than-needed scope expands blast radius for every finding above.activate-event cleanup step (or Workbox's cleanupOutdatedCaches) exists, and that skipWaiting/clients.claim() or a deliberate user-prompted update flow gets fixes to users in bounded time — otherwise caches grow unbounded and rollbacks/forward-fixes never land.live evidence, spec-cited, documentation-based, or inference so the reviewer knows what has actually been verified vs. reasoned about.Load these only when needed:
\nCacheFirst vs. NetworkFirst vs. StaleWhileRevalidate vs. NetworkOnly), expiration/cleanup mechanics, or Vite-PWA generateSW/injectManifest wiring.scope/Service-Worker-Allowed/cache-versioning coverage.Return, at minimum:
\ncache.put(), or any scope broader than required,activate-cleanup audit result, including whether skipWaiting/clients.claim() or an equivalent update path exists,