Skip to content
skillsafebeta
← Report library
Purpose / Other

Sandbox Next Skill Security Audit

What the author says it does (original text)

Build or maintain Cloudflare Sandbox apps on @cloudflare/sandbox@next (SDK 1.0 preview). Use sandbox-migrate-to-next when porting a stable app.

Independent security check

Low-risk issues found

Files checked
3
Risks found
1
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.No risks found
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.No risks found
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.No risks found
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.No risks found
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.Risks found: 1
Low risk

Implementation relies on mutable external documentation and examples fetched at runtime

Source references: 6
What we found

The Skill requires fetching pages before implementation and prefers a remote repository tree and documentation. That material is outside the audited Skill files and can change after installation.

Why this matters

If a linked destination, repository branch, or upstream page is mistakenly altered or compromised, the agent could introduce unaudited instructions or code into the user's project. Installed type checking catches only some API-shape problems and does not validate the security intent of external code.

Legitimate use of this code

This is a normal documentation-checking workflow for a fast-changing preview SDK. It points to Cloudflare’s official documentation and repository and says installed `@next` types take precedence, which reduces the risk of mutable remote guidance. Remote pages can change, but the visible source does not direct the agent to execute downloaded scripts, install unknown software, or disclose credentials. These links alone therefore do not establish a concrete user risk. A user can still restrict network access and require sources and proposed changes to be shown before remote examples are used.

This assessment concerns the code and conditions shown, not proof that harm has occurred.
SKILL.md:64In the instructionsOpen original file
## 3. Retrieve — open the doc for the taskFetch the page before implementing. Installed `@next` types win over guesses.
Show 5 other places
references/examples.md:3In the instructionsOpen original file
Pointers only—not a full catalog. Prefer the repo tree and docs.https://github.com/cloudflare/sandbox-sdk/tree/next/examples
references/examples.md:15In the instructionsOpen original file
Use the **`next`** branch for `@cloudflare/sandbox@next`.
SKILL.md:10In the instructionsOpen original file
**Prefer preview docs and installed `@next` types over memory.** APIs change; this skill is a gate, a contract, and a retrieval map—not a full manual.
SKILL.md:66In the instructionsOpen original file
Fetch the page before implementing. Installed `@next` types win over guesses.
references/api-quick-ref.md:5In the instructionsOpen original file
Fetch the page for the task before implementing and check signatures against installed `@cloudflare/sandbox@next` types.
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.No risks found

Inside this skill

4 instruction sections

This Skill is limited to new projects using the `@cloudflare/sandbox@next` preview and requires checking that the npm dependency and container image use the same release line; stable applications and migration work are redirected to other Skills.

View source
SKILL.md:20In the instructionsOpen original file
| ----- | ---------- || npm dependency | `@cloudflare/sandbox@next` (or another preview tag) || Container image | Same line (e.g. `cloudflare/sandbox:next`, `next-python`) |
SKILL.md:25In the instructionsOpen original file
| ------------ | ------ || Default `@cloudflare/sandbox` (no `@next`) | **Stop.** Load **`sandbox-stable`**. Do not apply this skill’s APIs. || User wants to port stable → `@next` | **Stop.** Load **`sandbox-migrate-to-next`**. || Self-deployed **bridge** only | Bridge is **not** on the 1.0 preview line yet. Keep bridge on stable package + image. [Bridge (stable)](https://developers.cloudflare.com/sandbox/bridge/) |Never mix an `@next` Worker package with a stable container image (or the reverse).

It instructs the agent to launch argv-based processes inside isolated containers and explains startup, waiting, termination, and interactive-terminal behavior; the included example runs only a fixed Python arithmetic command.

View source
SKILL.md:35In the instructionsOpen original file
- `sandbox.exec(argv)` takes an **argv** list and resolves when the process **starts**. It returns a **handle**, not a finished command result.- Collect results with handle methods: `output()`, `logs()`, `waitForExit()`, `waitForPort()`, `waitForLog()`, `kill(signal?)`.- No implicit shell. Shell syntax needs an explicit shell, e.g. `["/bin/bash", "-lc", script]`.- Each launch is independent. A `cd` / `export` in one `exec` is not visible to the next. Pass `cwd` and `env` per launch, or one shell script.- Process handles have **no stdin**. Interactive use → terminals (`createTerminal` + `connect`).- Local wait `timeout` / `AbortSignal` cancel the **wait only**. They do not kill the process. Use `kill` or `exec`’s remote `timeout`.- `getProcess` / `listProcesses` / `getTerminal` / `listTerminals` do **not** start a container; they return `null` / `[]` when none is up.
SKILL.md:54In the instructionsOpen original file
const sandbox = getSandbox(env.Sandbox, "user-123");const process = await sandbox.exec(["python3", "-c", "print(2 + 2)"]);const result = await process.output({ encoding: "utf8" });// result.stdout, result.exitCode```

The Skill explicitly prohibits placing live credentials in sandbox environment variables and recommends retaining them in the Worker while using outbound handlers for sandbox calls to external APIs.

View source
SKILL.md:43In the instructionsOpen original file
- Process and terminal IDs belong to the **current container**, not forever to a sandbox ID. For work that must survive replace, store the full job (argv, cwd, env, app state)—not only an id.- Non-secret config only in `setEnvVars` / launch `env`. Live credentials stay in the Worker; use outbound handlers when the sandbox calls external APIs.- Do **not** invent removed stable APIs (`gitCheckout` on core, string-`exec` completion, session execution, `sandbox.terminal(request)`).
SKILL.md:89In the instructionsOpen original file
- Lockfile and Dockerfile on the **same** `@next` line  - Typecheck against installed `@next` types  - No live secrets in sandbox env  - Production preview hostnames need wildcard DNS on a custom domain when using those URL patterns

Before implementation, it directs the agent to consult external Cloudflare documentation and examples from GitHub's `next` branch, while using locally installed `@next` types to validate signatures.

View source
SKILL.md:64In the instructionsOpen original file
## 3. Retrieve — open the doc for the taskFetch the page before implementing. Installed `@next` types win over guesses.
SKILL.md:83In the instructionsOpen original file
| Files, mounts, backups, ports, tunnels, `proxyToSandbox` | Main docs for shared surfaces (ignore stable-only session/transport/`sandbox.terminal`): [Files](https://developers.cloudflare.com/sandbox/api/files/) · [Storage / mounts](https://developers.cloudflare.com/sandbox/api/storage/) · [Ports](https://developers.cloudflare.com/sandbox/api/ports/) · [Tunnels](https://developers.cloudflare.com/sandbox/api/tunnels/) · [Backups](https://developers.cloudflare.com/sandbox/api/backups/) · [Outbound traffic](https://developers.cloudflare.com/sandbox/guides/outbound-traffic/) · [Expose services](https://developers.cloudflare.com/sandbox/guides/expose-services/) · [Production](https://developers.cloudflare.com/sandbox/guides/production-deployment/) || Example apps | [examples on `next`](https://github.com/cloudflare/sandbox-sdk/tree/next/examples) || Still on stable package | **`sandbox-stable`** · [Main Sandbox docs](https://developers.cloudflare.com/sandbox/) || Porting an existing stable app | **`sandbox-migrate-to-next`** · [Migrate](https://developers.cloudflare.com/sandbox/1-0-preview/migrate/) |
references/examples.md:3In the instructionsOpen original file
Pointers only—not a full catalog. Prefer the repo tree and docs.https://github.com/cloudflare/sandbox-sdk/tree/next/examples
Start here · InstructionsSKILL.md
sandbox-next
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source.

File reference map

References: 2
Files making referencesReferenced content
Lines show actual file references, not execution order. Select a node to highlight its connections and inspect the files and source locations. Dashed lines include files that still need locating.
Files and check records3 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included
  • references/api-quick-ref.mdFull text included
  • references/examples.mdFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions
  • references/api-quick-ref.mdSupporting file
  • references/examples.mdSupporting file

Operations mentioned in code and instructions

Connect to websites
SKILL.md:8In the instructionsOpen original file
Isolated Linux environments on [Cloudflare Containers](https://developers.cloudflare.com/containers/), driven from Workers.
SKILL.md:27In the instructionsOpen original file
| User wants to port stable → `@next` | **Stop.** Load **`sandbox-migrate-to-next`**. || Self-deployed **bridge** only | Bridge is **not** on the 1.0 preview line yet. Keep bridge on stable package + image. [Bridge (stable)](https://developers.cloudflare.com/sandbox/bridge/) |
SKILL.md:31In the instructionsOpen original file
Skills install: [Agent setup](https://developers.cloudflare.com/agent-setup/) · [cloudflare/skills](https://github.com/cloudflare/skills)
Run commands
SKILL.md:37In the instructionsOpen original file
- Collect results with handle methods: `output()`, `logs()`, `waitForExit()`, `waitForPort()`, `waitForLog()`, `kill(signal?)`.- No implicit shell. Shell syntax needs an explicit shell, e.g. `["/bin/bash", "-lc", script]`.- Each launch is independent. A `cd` / `export` in one `exec` is not visible to the next. Pass `cwd` and `env` per launch, or one shell script.
Read keys or account settings
SKILL.md:43In the instructionsOpen original file
- Process and terminal IDs belong to the **current container**, not forever to a sandbox ID. For work that must survive replace, store the full job (argv, cwd, env, app state)—not only an id.- Non-secret config only in `setEnvVars` / launch `env`. Live credentials stay in the Worker; use outbound handlers when the sandbox calls external APIs.- Do **not** invent removed stable APIs (`gitCheckout` on core, string-`exec` completion, session execution, `sandbox.terminal(request)`).
references/api-quick-ref.md:15In the instructionsOpen original file
| Set sandbox or per-launch environment | [Environment variables](https://developers.cloudflare.com/sandbox/1-0-preview/environment/) || Keep external API credentials in the Worker | [Outbound traffic](https://developers.cloudflare.com/sandbox/guides/outbound-traffic/) || Handle startup failures, interrupted work, stale handles, or local wait cancellation | [Errors and recovery](https://developers.cloudflare.com/sandbox/1-0-preview/errors/) and [Errors API](https://developers.cloudflare.com/sandbox/1-0-pre …
Lines read
128
File checksum (to compare versions)
ea54b955dbc608f9ec8916c8543e9717a12d15d145ab3dbf66ed0578f120e31e