How do I install the Cache Policy Designer skill?

Run npx skillmds@latest add imtiazrayhan/cache-policy-designer in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Cache Policy Designer safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Cache Policy Designer?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Cache Policy Designer free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Cache Policy Designer?

imtiazrayhan (@imtiazrayhan) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Cache Policy Designer by imtiazrayhan

Name: Cache Policy Designer
Author: imtiazrayhan

Cache Policy Designer

Design a cache policy from data ownership, freshness, privacy, invalidation, and failure requirements across browser, CDN, reverse-proxy, application, and data caches. Use when adding caching, debugging stale responses, reviewing Cache-Control behavior, reducing origin load, or deciding whether a value can be cached safely at all.

imtiazrayhan 38c3f27 2.6 KB Updated Sep 17, 2026

File contents

Design caching as a correctness contract with a performance benefit.

Workflow

Inventory the cacheable object. Name the response or value, authoritative source, readers, writers, sensitivity, size, cost to recompute, and consequence of serving it stale.
Map every cache layer. Trace browser, service worker, CDN, gateway, reverse proxy, framework, application, ORM, and database caches. Record which layer currently owns freshness and invalidation.
Define identity and variation. Specify the complete cache key: resource, tenant, user or authorization class, locale, encoding, version, query shape, and any header that changes representation. Remove unnecessary variants but never collapse security boundaries.
Choose freshness semantics. Set max age from the business freshness bound, not a convenient round number. Decide whether revalidation, stale-while-revalidate, or stale-if-error preserves acceptable behavior.
Design invalidation. Identify every write or event that changes the object. Choose purge, versioned keys, tag invalidation, write-through, or bounded expiration, and state how missed events heal.
Control concurrency. Prevent cold-key stampedes with request coalescing, locks with bounded leases, probabilistic early refresh, or jitter. Define behavior when the origin is slow or unavailable.
Specify privacy and failure rules. Mark values that must never enter a shared cache. Define fail-open versus fail-closed, negative caching, error caching, and the maximum stale age during outages.
Verify and observe. Test hit, miss, revalidation, invalidation, authorization variation, purge failure, origin failure, and concurrent expiry. Measure hit ratio by status, age, evictions, origin savings, stale serves, and key cardinality.

[!WARNING] Do not add public caching or omit authorization from a key merely to improve hit rate. Cross-user cache leakage is a security failure, not a tuning tradeoff.

Output

Return a layer-by-layer policy with key dimensions, freshness directives, invalidation events, stampede controls, outage behavior, privacy exclusions, implementation locations, verification cases, and metrics. Call out unknown writers or variation inputs that block safe caching.

---name: cache-policy-designerdescription: Design a cache policy from data ownership, freshness, privacy, invalidation, and failure requirements across browser, CDN, reverse-proxy, application, and data caches. Use when adding caching, debugging stale responses, reviewing Cache-Control behavior, reducing origin load, or deciding whether a value can be cached safely at all.---Design caching as a correctness contract with a performance benefit.## Workflow1. **Inventory the cacheable object.** Name the response or value, authoritative source, readers, writers, sensitivity, size, cost to recompute, and consequence of serving it stale.2. **Map every cache layer.** Trace browser, service worker, CDN, gateway, reverse proxy, framework, application, ORM, and database caches. Record which layer currently owns freshness and invalidation.3. **Define identity and variation.** Specify the complete cache key: resource, tenant, user or authorization class, locale, encoding, version, query shape, and any header that changes representation. Remove unnecessary variants but never collapse security boundaries.4. **Choose freshness semantics.** Set max age from the business freshness bound, not a convenient round number. Decide whether revalidation, `stale-while-revalidate`, or `stale-if-error` preserves acceptable behavior.5. **Design invalidation.** Identify every write or event that changes the object. Choose purge, versioned keys, tag invalidation, write-through, or bounded expiration, and state how missed events heal.6. **Control concurrency.** Prevent cold-key stampedes with request coalescing, locks with bounded leases, probabilistic early refresh, or jitter. Define behavior when the origin is slow or unavailable.7. **Specify privacy and failure rules.** Mark values that must never enter a shared cache. Define fail-open versus fail-closed, negative caching, error caching, and the maximum stale age during outages.8. **Verify and observe.** Test hit, miss, revalidation, invalidation, authorization variation, purge failure, origin failure, and concurrent expiry. Measure hit ratio by status, age, evictions, origin savings, stale serves, and key cardinality.> [!WARNING]> Do not add `public` caching or omit authorization from a key merely to improve hit rate. Cross-user cache leakage is a security failure, not a tuning tradeoff.## OutputReturn a layer-by-layer policy with key dimensions, freshness directives, invalidation events, stampede controls, outage behavior, privacy exclusions, implementation locations, verification cases, and metrics. Call out unknown writers or variation inputs that block safe caching.

Frequently asked questions