Mmcp.market

caching skill

by zebbern·zebbern/claude-code-guide·4.6k stars·MIT

Caching strategies — invalidation, TTL guidelines, cache keys, cache layers, and when not to cache. Use when implementing or reviewing caching logic.

A100/100content scan

Is the caching skill safe?

Clean: nothing in its files matched our rules. We read 1 file in the folder on 2026-09-28.

No findings.

Install the caching skill

A skill is a folder. Copy it into your agent's skills folder and the agent loads it when the task matches its description.

git clone --depth 1 https://github.com/zebbern/claude-code-guide.git /tmp/claude-code-guide
mkdir -p ~/.claude/skills
cp -r /tmp/claude-code-guide/skills/caching ~/.claude/skills/caching
available in every project

In the Claude apps, zip the folder and upload it from the Skills settings. The folder on GitHub

The instructions your agent would load

SKILL.md as published, without the frontmatter. Read it on GitHub

WHENTOUSE

  • When implementing a cache layer (in-memory, Redis, CDN) for an API or service.
  • When choosing TTL values or invalidation strategies for cached data.
  • When designing cache key schemas to avoid collisions or stale-data bugs.
  • When reviewing code that reads from or writes to any cache.
  • When debugging stale data, cache stampedes, or inconsistent responses.
  • When configuring TanStack Query staleTime/gcTime for client-side caching.

INVALIDATION

  • [P0-MUST] Define an invalidation strategy for every cache. Stale data is worse than no cache.
  • [P0-MUST] Invalidate caches when the underlying data changes — do not rely solely on TTL expiry.
  • [P1-SHOULD] Prefer event-driven invalidation (on write/update/delete) over time-based expiry alone.
  • [P1-SHOULD] Use cache versioning (include a version key) when data schemas change.

TTL_GUIDELINES

  • [P1-SHOULD] Set TTLs based on data volatility: static config (hours/days), user profiles (minutes), real-time data (seconds or no cache).
  • [P1-SHOULD] Use stale-while-revalidate: serve stale data immediately while refreshing in the background.
  • [P2-MAY] Use shorter TTLs in development and longer TTLs in production.

CACHE_KEYS

  • [P0-MUST] Include all query parameters that affect the result in the cache key.
  • [P1-SHOULD] Use a consistent key format: :: (e.g., user:123:profile, products:list:page=2).
  • [P1-SHOULD] Namespace keys by service or module to prevent collisions.
  • [P2-MAY] Hash long or complex keys to keep storage efficient.

CACHE_LAYERS

  • [P1-SHOULD] Use the appropriate cache layer for the use case:
  • [P1-SHOULD] Layer caches: check memory → Redis → origin. Write-through on miss.

WHENNOTTO_CACHE

  • [P0-MUST] Do not cache user-specific sensitive data (auth tokens, payment info) in shared caches.
  • [P1-SHOULD] Do not cache rapidly changing data where staleness causes incorrect behavior (inventory counts, real-time pricing).
  • [P1-SHOULD] Do not cache error responses — use short TTL or skip caching on failure.
  • [P2-MAY] Avoid caching when the computation is cheap and the data set is small.

CODE_EXAMPLES

In-memory LRU cache with TTL

const cache = new Map<string, { value: unknown; expires: number }>();
const MAX_SIZE = 500;

export function getOrSet<T>(key: string, ttlMs: number, compute: () => T): T {
  const entry = cache.get(key);
  if (entry && entry.expires > Date.now()) return entry.value as T;

  const value = compute();
  if (cache.size >= MAX_SIZE) {
    // Evict oldest entry (first inserted)
    const oldest = cache.keys().next().value!;
    cache.delete(oldest);
  }
  cache.set(key, { value, expires: Date.now() + ttlMs });
  return value;
}

Redis stale-while-revalidate with ioredis

import Redis from "ioredis";
const redis = new Redis(process.env.REDIS_URL);

export async function swr<T>(
  key: string,
  freshSec: number,
  staleSec: number,
  fetcher: () => Promise<T>,
): Promise<T> {
  const raw = await redis.get(key);
  if (raw) {
    const { value, createdAt } = JSON.parse(raw) as { value: T; createdAt: number };
    const ageMs = Date.now() - createdAt;
    if (ageMs < freshSec * 1000) return value; // Fresh — return immediately
    if (ageMs < staleSec * 1000) {
      // Stale — return cached, refresh in background
      fetcher().then((v) =>
        redis.set(key, JSON.stringify({ value: v, createdAt: Date.now() }), "EX", staleSec),
      );
      return value;
    }
  }
  const value = await fetcher();
  await redis.set(key, JSON.stringify({ value, createdAt: Date.now() }), "EX", staleSec);
  return value;
}

HTTP cache headers in Express/Hono

// Immutable assets (hashed filenames)
app.use("/assets", (_, res, next) => {
  res.setHeader("Cache-Control", "public, max-age=31536000, immutable");
  next();
});

// API responses — short cache with revalidation
app.get("/api/products", (_, res) => {
  res.setHeader("Cache-Control", "public, max-age=60, stale-while-revalidate=300");
  res.json(products);
});

TanStack Query cache configuration

import { QueryClient, QueryClientProvider } from "@tanstack/react-query";

const queryClient = new QueryClient({
  defaultOptions: {
    queries: {
      staleTime: 5 * 60 * 1000, // Data fresh for 5 minutes
      gcTime: 30 * 60 * 1000,   // Garbage-collect after 30 minutes
      retry: 2,
      refetchOnWindowFocus: false,
    },
  },
});

// Usage in a component
const { data } = useQuery({
  queryKey: ["products", { page, category }], // Cache key includes params
  queryFn: () => fetchProducts({ page, category }),
});

ANTI_PATTERNS

  • Cache-and-forget — Caching data with no invalidation strategy. Data goes stale permanently.
  • Instead: define explicit invalidation (event-driven on write, or bounded TTL) for every cache key.
  • Uniform TTL — Using the same TTL (e.g., 1 hour) for all data regardless of volatility.
  • Instead: match TTL to data change frequency — seconds for prices, minutes for profiles, hours for configs.
  • Missing key parameters — Cache key omits user ID, locale, or query params, serving wrong data.
  • Instead: include every parameter that affects the result: products:list:page=2:locale=en.
  • Caching errors — Storing error responses (500s, timeouts) with long TTLs.
  • Instead: skip caching on failure, or use a very short TTL (5-10 seconds) to allow fast retry.
  • Cache stampede — All instances hit the origin simultaneously when a popular key expires.
  • Instead: use stale-while-revalidate, jittered TTLs, or a mutex lock to let one instance refresh.

More skills from zebbern/claude-code-guide

  • Aacademic-paper-reviewerSimulates academic peer review, evaluating papers across Originality, Methodology, Results, and Writing to provide Major/Minor Revision recommendations with actionable feedback. Triggers when a user asks to \"review my paper,\" \"simulate peer review,\" or \"give my paper a peer review.
  • Aactive-directory-attacksThis skill should be used when the user asks to "attack Active Directory", "exploit AD", "Kerberoasting", "DCSync", "pass-the-hash", "BloodHound enumeration", "Golden Ticket", "Silver Ticket", "AS-REP roasting", "NTLM relay", or needs guidance on Windows domain penetration testing.
  • Capi-fuzzing-bug-bountyThis skill should be used when the user asks to "test API security", "fuzz APIs", "find IDOR vulnerabilities", "test REST API", "test GraphQL", "API penetration testing", "bug bounty API testing", or needs guidance on API security assessment techniques.
  • Aapi-shape-explorerGenerate multiple radically different interface designs for a module using parallel sub-agents. Use when user wants to design an API, explore interface options, compare module shapes, or mentions "design it twice".
  • Aaudit-flowInteractive system flow tracing across CODE, API, AUTH, DATA, NETWORK layers with SQLite persistence and Mermaid export. Use for security audits, compliance documentation, flow tracing, feature ideation, brainstorming, debugging, architecture reviews, or incident post-mortems. Triggers on audit, trace flow, document flow, security review, debug flow, brainstorm, architecture review, post-mortem, incident review.
  • Aauthentication-patternsAuthentication patterns: session vs JWT vs OAuth comparison, provider selection (NextAuth, Clerk, Supabase Auth), security checklist, and common mistakes. Use when implementing auth, reviewing auth flows, or choosing auth providers.
  • Aaws-penetration-testingThis skill should be used when the user asks to "pentest AWS", "test AWS security", "enumerate IAM", "exploit cloud infrastructure", "AWS privilege escalation", "S3 bucket testing", "metadata SSRF", "Lambda exploitation", or needs guidance on Amazon Web Services security assessment.
  • Abroken-authenticationThis skill should be used when the user asks to "test for broken authentication vulnerabilities", "assess session management security", "perform credential stuffing tests", "evaluate password policies", "test for session fixation", or "identify authentication bypass flaws". It provides comprehensive techniques for identifying authentication and session management weaknesses in web applications.
  • Cburp-suite-testingThis skill should be used when the user asks to "intercept HTTP traffic", "modify web requests", "use Burp Suite for testing", "perform web vulnerability scanning", "test with Burp Repeater", "analyze HTTP history", or "configure proxy for web testing". It provides comprehensive guidance for using Burp Suite's core features for web application security testing.
  • Achart-imageGenerate publication-quality PNG chart images from data, supporting line, bar, area, candlestick, pie, and heatmap charts. Triggers when the user asks to visualize data, create a graph, plot a time series, or generate a chart for a report, alert, or dashboard. Runs as a lightweight, headless Node.js process without a browser.
  • Dcloud-penetration-testingThis skill should be used when the user asks to "perform cloud penetration testing", "assess Azure or AWS or GCP security", "enumerate cloud resources", "exploit cloud misconfigurations", "test O365 security", "extract secrets from cloud environments", or "audit cloud infrastructure". It provides comprehensive techniques for security assessment across major cloud platforms.
  • Acode-documenterUse when adding docstrings, creating API documentation, or building documentation sites. Invoke for OpenAPI/Swagger specs, JSDoc, doc portals, tutorials, user guides.

All agent skills → · MCP servers