sandbox-migrate-to-next

An agent skill by cloudflare, from cloudflare/skills. Tags: cloudflare, migration, sandbox, setup, upgrade.

What it does

Migrate Cloudflare Sandbox apps from stable @cloudflare/sandbox to @cloudflare/sandbox@next (SDK 1.0 preview). Use sandbox-next for apps already on the preview.

Install

With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:

npx skills add cloudflare/skills --skill sandbox-migrate-to-next

Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):

git clone --depth 1 https://github.com/cloudflare/skills
cp -r skills/skills/sandbox-migrate-to-next ~/.claude/skills/sandbox-migrate-to-next

Safety box score

Grade C, moderate risk: 37 of 100 risk points, rated 2026-10-20. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.

This is a Cloudflare Sandbox migration skill that edits app code, package/image config, and deployment settings, then can deploy the result. The main risks are broad shell/network activity during migration and an irreversible production cutover with immediate container rollout.

Category levels, from 0 (none) to 3 (high)
Category	Level	Why
Code & shell execution	2 (moderate)	It directs shell/package execution such as `npm install @cloudflare/sandbox@next`, `npx wrangler deploy --containers-rollout=immediate`, and audit commands like `rg ...` plus `bash -lc` examples.
Network access	2 (moderate)	It relies on external fetches and registry traffic: `fetch the linked page when a step needs detail`, `npm install @cloudflare/sandbox@next`, and `npx wrangler deploy` to Cloudflare.
Filesystem reach	2 (moderate)	It changes project files and config in place, including `Lockfile + Dockerfile on the same @next line` and code edits to remove/add APIs and images.
Secrets & credentials	1 (low)	It mentions environment-variable handling and warns `No live secrets in sandbox env` / `Putting live secrets in setEnvVars / launch env`, but it does not directly read credential stores or key files.
Privilege & persistence	0 (none)	There is no sudo, global install, service registration, or OS/shell startup modification in the skill text.
Instruction hijack surface	0 (none)	No prompt-injection behavior is requested; it says to follow the migrate docs and stop for user decisions, not to ignore instructions or hide anything.
Irreversible actions	3 (high)	It explicitly authorizes a production cutover with `npx wrangler deploy --containers-rollout=immediate`, and notes live processes/terminals/streams may stop during the cutover.
Transparency	0 (none)	All provided content is plain markdown; there are no binaries, encoded blobs, or downloaded installers in the skill files.

Before installing

Confirm you are okay with an immediate production rollout if this migration reaches prod.
Review `SKILL.md` for the exact files it expects to change: package lockfile, Dockerfile, and sandbox API call sites.
Run the migration first in a scratch branch or staging environment with live secrets removed from sandbox env config.
Check whether your app uses the Python image variant or any bridge/self-deployed setup before applying the `@next` switch.

Rated 2026-10-20 by an automated review of 1 file from the skill's repository.

Source

Repository: cloudflare/skills (all skills from this repository)
Path: skills/sandbox-migrate-to-next/SKILL.md
Branch: main
Updated: 2026-09-20

nextjs-on-cloudflare — Build, migrate, and deploy Next.js apps on Cloudflare Workers with vinext. Use when starting a Next.js project on Cloudflare.
sandbox-next — Build or maintain Cloudflare Sandbox apps on @cloudflare/sandbox@next (SDK 1.0 preview). Use sandbox-migrate-to-next when porting a stable app.
sandbox-stable — Build or maintain Cloudflare Sandbox apps on the stable @cloudflare/sandbox package.
expo-upgrade — Framework (OSS). Guidelines for upgrading Expo SDK versions and fixing dependency issues
cloudflare-one — Design, configure, troubleshoot, or review Cloudflare One Zero Trust and SASE deployments.
cloudflare-one-migrations — Assess and plan migrations from existing VPN, SWG, or SASE platforms to Cloudflare One, including policy mapping, parity gaps, and rollout.