Purpose / Other

Sandbox Migrate To Next Skill Security Audit

What the author says it does (original text)

Migrate Cloudflare Sandbox apps from stable @cloudflare/sandbox to @cloudflare/sandbox@next (SDK 1.0 preview). Use sandbox-next for apps already on the preview.

Independent security check

Security risks found

Files checked: 1
Risks found: 4

Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.Risks found: 1

Medium risk

Floating `next` package and image tags can resolve to different code later

Source references: 4

What we found

The upgrade installs `@cloudflare/sandbox@next`, uses `cloudflare/sandbox:next`, and explicitly permits remaining on floating `next`. The container tag can move to a new image on a later pull, and a fresh dependency resolution can select a newer preview release.

Why this matters

Builds at different times may execute dependency or image code that was not reviewed in this migration, introducing compatibility failures, supply-chain exposure, or production drift.

Both the package and image use floating `next` tags, so later installs or pulls may resolve to different preview releases. Requiring the same release line does not make builds reproducible over time. The user can require both to be pinned to one tested exact prerelease, with a lockfile or image digest retained.

SKILL.md:76In the instructionsOpen original file

7576```sh77npm install @cloudflare/sandbox@next78```7980```dockerfile81FROM cloudflare/sandbox:next82# Python: cloudflare/sandbox:next-python83```8485Same prerelease tag on Worker and image when not on floating `next`.86

Show 3 other places

SKILL.md:77In the instructionsOpen original file

76```sh77npm install @cloudflare/sandbox@next78```

SKILL.md:81In the instructionsOpen original file

80```dockerfile81FROM cloudflare/sandbox:next82# Python: cloudflare/sandbox:next-python83```

SKILL.md:85In the instructionsOpen original file

8485Same prerelease tag on Worker and image when not on floating `next`.86

Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.No risks found

Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.No risks found

Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.Risks found: 1

Low risk

The install command does not pin a dependency version

Source references: 4

What we found

The installation command does not specify dependency versions. The same command may download different code later, so what you install can differ from what was checked.

Why this matters

A later install may download different code even though the command and this report have not changed.

This install step uses the floating `@next` tag rather than an exact prerelease version. A future reinstall may retrieve different code, affecting reproducibility and dependency supply-chain exposure. The user can ask for a tested exact version and a lockfile that pins the resolved package.

Legitimate use of this code

The cited command does not install a dependency; it deploys the existing project with Wrangler. `--containers-rollout=immediate` is a rollout-policy option, so the unpinned-install rule does not apply to this line. The command does have production impact, but that is the cutover risk covered by candidate m-0.

This assessment concerns the code and conditions shown, not proof that harm has occurred.

SKILL.md:77In the instructionsOpen original file

76```sh77npm install @cloudflare/sandbox@next78```

Show 3 other places

SKILL.md:85In the instructionsOpen original file

8485Same prerelease tag on Worker and image when not on floating `next`.86

SKILL.md:157In the instructionsOpen original file

156```sh157npx wrangler deploy --containers-rollout=immediate158```

SKILL.md:152In the instructionsOpen original file

151152### Deploy cutover153154Staging/branch first. Production is **one** deploy of matching Worker + image:155156```sh157npx wrangler deploy --containers-rollout=immediate158```

Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.Risks found: 1

Medium risk

Migration behavior depends on mutable web content fetched at run time

Source references: 3

What we found

The Skill tells the agent to fetch linked pages for details and implement changes from those pages. That content is outside the supplied, audited Skill source and can change later; if a page or its content supply chain is compromised, embedded instructions could influence what the agent edits or runs.

Why this matters

The agent could follow newly introduced, unaudited directions that execute extra commands, alter files, or expand the migration scope.

The Skill directs the agent to fetch external pages and implement changes from them. Those pages are absent from the audited source and may change, so part of the agent's behavior depends on unaudited content retrieved at execution time. The user can restrict use to dated or archived official documentation and require proposed edits and commands to be shown for approval.

SKILL.md:8In the instructionsOpen original file

78**Perform** the port. Follow the steps in order. Depth lives in docs—fetch the linked page when a step needs detail.910Human guide: [Migrate](https://developers.cloudflare.com/sandbox/1-0-preview/migrate/) · [1.0 preview](https://developers.cloudflare.com/sandbox/1-0-preview/)11

Show 2 other places

SKILL.md:89In the instructionsOpen original file

8889Apply replacements from the map. For each area, implement from the doc—not from stable habits:9091| Area | Doc |92| ---- | --- |93| Commands / handles / waits | [Processes](https://developers.cloudflare.com/sandbox/1-0-preview/processes/) · [Processes API](https://developers.cloudflare.com/sandbox/1-0-preview/api/processes/) |94| `cwd` / `env` / secrets | [Environment](https://developers.cloudflare.com/sandbox/1-0-preview/environment/) · [Outbound traffic](https://developers.cloudflare.com/sandbox/guides/outbound-traffic/) |95| Drop sessions | [Migrate](https://developers.cloudflare.com/sandbox/1-0-preview/migrate/) · [Lifecycle](https://developers.cloudflare.com/sandbox/1-0-preview/lifecycle/) |96| Terminals | [Terminals](https://developers.cloudflare.com/sandbox/1-0-preview/terminals/) |97| Interpreter | [Interpreter](https://developers.cloudflare.com/sandbox/1-0-preview/interpreter/) |98| Errors | [Errors](https://developers.cloudflare.com/sandbox/1-0-preview/errors/) |99| Durable job across requests | [Process execution — lifetime / durability](https://developers.cloudflare.com/sandbox/1-0-preview/processes/) |

SKILL.md:16In the instructionsOpen original file

1516**Prefer installed `@next` types and the migrate doc over memory.**17

Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.Risks found: 1

Medium risk

Production cutover immediately replaces containers and may interrupt active work

Source references: 5

What we found

The Skill directs production to use an immediate rollout and states that in-flight container work may stop and old process or terminal IDs become invalid. It requires user consent, but execution after consent still creates a specific service-continuity risk.

Why this matters

Active terminals, streams, background jobs, or requests may be interrupted; applications relying on old process IDs may fail, causing downtime or lost work.

The Skill explicitly requires an immediate container rollout for production and says in-flight work may stop and old process/terminal IDs become invalid. This remains an availability risk even after consent, although the Skill requires agreement and staging/branch first. The user should ask for a maintenance window, rollback plan, and handling of active work.

SKILL.md:30In the instructionsOpen original file

2930- Worker package and container image must be the **same** `@next` line.  31- Production cutover uses **immediate** container rollout. Stable and `@next` control protocols are incompatible both ways; gradual rollout leaves a broken mixed window. In-flight container work can stop.  32- After cutover, `await sandbox.exec(...)` means process **started**, not command **finished**.

Show 4 other places

SKILL.md:154In the instructionsOpen original file

153154Staging/branch first. Production is **one** deploy of matching Worker + image:155156```sh157npx wrangler deploy --containers-rollout=immediate158```159160Leave `rollout_active_grace_period` at default `0` (or set `0` if raised). After cutover, pre-deploy process/terminal IDs are invalid. Details: [Migrate](https://developers.cloudflare.com/sandbox/1-0-preview/migrate/) · [Container rollouts](https://developers.cloudflare.com/containers/platform-details/rollouts/)161

SKILL.md:14In the instructionsOpen original file

1314Existing apps should migrate **when you can**, so you are ready when 1.0 becomes the stable release. Do **not** force production cutover without the user agreeing.15

SKILL.md:31In the instructionsOpen original file

30- Worker package and container image must be the **same** `@next` line.  31- Production cutover uses **immediate** container rollout. Stable and `@next` control protocols are incompatible both ways; gradual rollout leaves a broken mixed window. In-flight container work can stop.  32- After cutover, `await sandbox.exec(...)` means process **started**, not command **finished**.

SKILL.md:160In the instructionsOpen original file

159160Leave `rollout_active_grace_period` at default `0` (or set `0` if raised). After cutover, pre-deploy process/terminal IDs are invalid. Details: [Migrate](https://developers.cloudflare.com/sandbox/1-0-preview/migrate/) · [Container rollouts](https://developers.cloudflare.com/containers/platform-details/rollouts/)161

Inside this skill

8 instruction sections

The Skill is intended to migrate an existing Cloudflare Sandbox app to the 1.0 preview, with a code audit and user decisions before upgrade and validation.

View source

SKILL.md:20In the instructionsOpen original file

19201. **Review** hard rules and the replacement map  212. **Audit** the codebase; list hits and target shapes  223. **Clarify** with the user (cutover, bridge, Python image, unclear sites)  234. **Upgrade** package, image, and code  245. **Validate**  2526Stop after any step that needs a user decision.27

It explicitly forbids forcing a production cutover without user agreement and requires confirmation that an immediate rollout may terminate running work.

View source

SKILL.md:14In the instructionsOpen original file

1314Existing apps should migrate **when you can**, so you are ready when 1.0 becomes the stable release. Do **not** force production cutover without the user agreeing.15

SKILL.md:67In the instructionsOpen original file

6667- OK to cut production with `--containers-rollout=immediate` (live processes/terminals/streams may stop)?  68- Self-deployed bridge? Leave on stable.

The command examples use argument arrays and invoke Bash explicitly when shell behavior is needed; the Git example also separates options from the repository address with `--`, reducing shell-interpretation and option-injection risk.

View source

SKILL.md:32In the instructionsOpen original file

31- Production cutover uses **immediate** container rollout. Stable and `@next` control protocols are incompatible both ways; gradual rollout leaves a broken mixed window. In-flight container work can stop.  32- After cutover, `await sandbox.exec(...)` means process **started**, not command **finished**.  33- Argv is as-is (no implicit shell). Shell syntax needs an explicit shell binary.  34- Process handles have **no stdin** → terminals for interactive input.

SKILL.md:143In the instructionsOpen original file

142```ts143const clone = await sandbox.exec(144  ["git", "clone", "--depth", "1", "--", repoUrl, "/workspace/repo"],145  { cwd: "/workspace" },146);147const result = await clone.output({ encoding: "utf8" });148```

The validation checklist calls for matching dependency and image versions, testing migrated behavior, removing obsolete APIs, and keeping live secrets out of the sandbox environment.

View source

SKILL.md:164In the instructionsOpen original file

1631641. Lockfile + Dockerfile on the same `@next` line  1652. Typecheck against `@next`  1663. Smoke argv `exec` + `output({ encoding: "utf8" })`  1674. Smoke long process / terminal / interpreter if used  1685. Errors distinguished: unavailable / interrupted-RPC / stale / local wait  1696. No live secrets in sandbox env  1707. Grep again for removed APIs  1718. Production used `--containers-rollout=immediate`  172

Start here · InstructionsSKILL.md

sandbox-migrate-to-next

Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source.

Files and check records1 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

SKILL.mdFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

SKILL.mdInstructions

Operations mentioned in code and instructions

Connect to websites

SKILL.md:10In the instructionsOpen original file

910Human guide: [Migrate](https://developers.cloudflare.com/sandbox/1-0-preview/migrate/) · [1.0 preview](https://developers.cloudflare.com/sandbox/1-0-preview/)11

SKILL.md:12In the instructionsOpen original file

1112**New projects** should start on `@next` (**`sandbox-next`**), not this skill. **Day-to-day stable work** → **`sandbox-stable`**. Deprecated-API cleanup **without** moving to `@next` → [2026 deprecation guide](https://developers.cloudflare.com/sandbox/guides/2026-deprecation/) first if needed.13

SKILL.md:55In the instructionsOpen original file

5455Depth: [Migrate](https://developers.cloudflare.com/sandbox/1-0-preview/migrate/) · after port, day-to-day → **`sandbox-next`**56

Install extra software packages

SKILL.md:77In the instructionsOpen original file

76```sh77npm install @cloudflare/sandbox@next78```

SKILL.md:157In the instructionsOpen original file

156```sh157npx wrangler deploy --containers-rollout=immediate158```

Run commands

SKILL.md:108In the instructionsOpen original file

107// After (@next)108const process = await sandbox.exec(["/bin/bash", "-lc", "npm test"]);109const result = await process.output({ encoding: "utf8" });

SKILL.md:113In the instructionsOpen original file

112```ts113const server = await sandbox.exec(["/bin/bash", "-lc", "npm run dev"], {114  cwd: "/workspace/app",

SKILL.md:123In the instructionsOpen original file

122```ts123const terminal = await sandbox.createTerminal({ command: ["bash"], cwd: "/workspace" });124const t = await sandbox.getTerminal(terminal.id);

Lines read: 186
File checksum (to compare versions): 2da01e787d0cd4f88db2f06e884a81995ce9b0b4efdb9b225aa5957c196ffe75

Related skill security audits

Compare the source, risk signals and checked scope in these related reports.

Skill / source	What we found	Last checked
sandbox-next github.com/cloudflare/skills/tree/…/skills/sandbox-next	No obvious risks found in this check	07 Sept 202614:52 UTC+8
sandbox-stable github.com/cloudflare/skills/tree/…/skills/sandbox-stable	Security risks found	07 Sept 202614:52 UTC+8
caveman github.com/juliusbrussee/caveman/tree/…/skills/caveman	Security risks found	07 Sept 202618:31 UTC+8
azure-compliance github.com/microsoft/azure-skills/tree/…/skills/azure-compliance	Do not install or run it yet	07 Sept 202618:28 UTC+8
appinsights-instrumentation github.com/microsoft/azure-skills/tree/…/skills/appinsights-instrumentation	Security risks found	07 Sept 202618:27 UTC+8