CLOUD OPERATIONS / Cloudflare
Cloudflare Sandbox preview migration
Pins Cloudflare's stable-to-preview Sandbox migration, which refuses an unagreed production cutover and forbids invented APIs and live secrets in the sandbox environment.
“Migrate Cloudflare Sandbox apps from stable @cloudflare/sandbox to @cloudflare/sandbox@next (SDK 1.0 preview). Use sandbox-next for apps already on the preview.”
01 / THE REASONING
Why this made the selection.
- The catalogue has sandbox-stable from this commit and not the migration off that stable package.
- The file separates this port from new preview work and from day-to-day stable work, and it stops when a user decision is required.
02 / THE REVIEW RECORD
What we actually inspected.
Source review has boundaries.
A clear record is more useful than a “safe” badge.
Material inspected
- skills/sandbox-migrate-to-next/SKILL.md
- README.md
- LICENSE
Our findings
- The skill says not to force a production cutover without the user agreeing, and that production uses --containers-rollout=immediate because stable and @next protocols are incompatible.
- It says not to invent gitCheckout, process stdin, or a string-exec completion helper, and that a self-deployed bridge stays on stable.
- The validation list says no live secrets in the sandbox environment, and the red-flag list repeats that for setEnvVars and launch env.
Not established by this review
- The resource was not executed and its tools were not called.
- No package was installed and wrangler deploy was not run.
- The Cloudflare Sandbox documentation links were not opened.
- No Worker was typechecked.
- Not executed: it was not installed or run.
The review applies to the material and revision named here. A newer upstream release can change its behavior.
03 / PUT IT TO WORK
Add a skill to your workflow.
DOCUMENTED COMMAND
npx skills add cloudflare/skillsRun in your terminal to choose your AI tools, project or global scope, and installation method. This short command follows the current upstream version; the review covers the revision shown above.
Optional: install the reviewed revision
Keeps the original source and installer version where recorded, while leaving your AI tools and installation scope for you to choose.
npx skills add https://github.com/cloudflare/skills- The README's npx skills section is the command above and installs the repository's skills.
- The skill table names sandbox-migrate-to-next as the port from stable Sandbox to @cloudflare/sandbox@next.
- The same README also shows /plugin install cloudflare@cloudflare, which installs the plugin group.
Before you start
- A skills-compatible agent
- An existing stable Sandbox app if the port is performed, which this review did not modify
04 / FOLLOW THE EVIDENCE
The source trail.
Our notes are separate from the original resource.
Check upstream before adopting a new version.
https://github.com/cloudflare/skills/blob/53395984c3ea1925d00fce03b266112302f050e6/skills/sandbox-migrate-to-next/SKILL.md
Supports: cutover consent, invented-API refusal, and secret red flag
- Repository README ↗Checked
https://github.com/cloudflare/skills/blob/53395984c3ea1925d00fce03b266112302f050e6/README.md
Supports: npx skills install line and sandbox-migrate-to-next table row
- Repository LICENSE ↗Checked
https://github.com/cloudflare/skills/blob/53395984c3ea1925d00fce03b266112302f050e6/LICENSE
Supports: Apache License Version 2.0
https://raw.githubusercontent.com/cloudflare/skills/53395984c3ea1925d00fce03b266112302f050e6/skills/sandbox-migrate-to-next/SKILL.md
Supports: upstreamDescription, review.notTested, review.reviewedAt
https://raw.githubusercontent.com/cloudflare/skills/53395984c3ea1925d00fce03b266112302f050e6/README.md
Supports: install.command