Agent skill · software engineering · secondsky
cloudflare-sandbox
Cloudflare Sandboxes SDK for secure code execution in Linux containers at edge. Use for untrusted code, Python/Node.js scripts, AI code interpreters, git operations.
Why this skill is useful
Provides specific commands and patterns for executing untrusted code securely in Cloudflare's container environment, which the AI wouldn't reliably generate on its own.
What it needs
Requires bun, docker installed locally. Requires cloudflare account access. About 8k tokens when loaded. Last updated 2026-08-06. 204 stars on the source repository.
What this skill does
Cloudflare Sandboxes SDK Status: Production Ready (Open Beta) Last Updated: 2025-12-10 Dependencies: cloudflare-worker-base, cloudflare-durable-objects (recommended for understanding) Latest Versions: @cloudflare/sandbox@0.6.3, Docker image: cloudflare/sandbox:0.6.3-python ⚠️ BREAKING CHANGE (v0.6.0): Python is no longer included in the default image. Use cloudflare/sandbox:<version>-python for Python support (~1.3GB with data science packages). The lean variant (~600-800MB) excludes Python. --- Quick Start (15 Minutes) 1. Install SDK and Setup Wrangler wrangler.jsonc: Why this matters: nodejscompat enables Node.js APIs required by SDK containers defines the Ubuntu container image durableobjects binding enables persistent routing migrations registers the Sandbox class 2. Create Your First Sandbox Worker CRITICAL: MUST export { Sandbox } from @cloudflare/sandbox in your Worker Sandbox ID determines routing (same ID = same container) First request creates container (~2-3 min cold start) Subsequent requests are fast (<1s) 3. Deploy and Test Expected output: Secure Installation Sandbox SDK packages grant container access — verify before installing to prevent unauthorized code execution. Follow supply chain security best practices: Block post-install scripts — npm config set ignore-scripts true (or Bun: disabled by default) Cooldown period — Wait 7 days for new package versions to be vetted by the community Audit before installing — Run socket package score npm <pkg> or use socket npm install <pkg> to check packages Load the dependency-upgrade skill for full security configuration including Socket CLI integration, cooldown setup, lockfile validation, and CI enforcement. --- Architecture (Understanding the 3-Layer Model) How Sandboxes Work Key Insight: Workers handle API logic (fast), Durable Objects route requests (persistent identity), Containers execute code (full capabilities). …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills secondsky/cloudflare-sandbox