Sandbox Stable skill for Claude Code: Cloudflare Sandbox apps on the stable SDK

Cloudflare's skill that makes Claude build and maintain Cloudflare Sandbox apps on the stable SDK, for Workers developers.

Installs: 73.9K; on skills.sh
Stars: 3.2K; on GitHub
Files: 1; besides SKILL.md
Updated: Oct 2026; last repo commit

Before it writes any code, Claude checks which package line your app uses. If your app is on the default @cloudflare/sandbox package, it follows this skill's stable rules, such as exec taking a command string and returning only when the command finishes. If it finds @next, it stops and loads the sandbox-next skill. If you want to move to 1.0, it loads sandbox-migrate-to-next.

The skill is a short rulebook plus a map of Cloudflare docs pages to open for each task. Its own text says to trust the installed stable types over memory. It bundles one reference file and no scripts.

Good for

Developers running code in Cloudflare Sandbox from a Worker
Teams with an existing app on the default @cloudflare/sandbox package
Developers cleaning up deprecated Sandbox APIs without upgrading

Install sandbox-stable

Claude Code

Copy this prompt.

Install the sandbox-stable skill in Claude Code. Run this command:

/plugin marketplace add cloudflare/skills
/plugin install cloudflare@cloudflare

Then check that it loaded and tell me how to use it.

2
Paste it into Claude Code. It shows the change and asks before running it.

The three Sandbox skills hand over to each other: each one stops and loads another when it finds the wrong package line, so install all three. The plugin installs every Cloudflare skill plus Cloudflare's main remote MCP server (README). Pick one route, not both. Start a new session afterwards.

From the project README. Source.

What's in the skill

When it loads

Build or maintain Cloudflare Sandbox apps on the stable @cloudflare/sandbox package. Use sandbox-next for preview apps and sandbox-migrate-to-next for stable-to-preview migrations.

Sections in SKILL.md

1. Gate — confirm the package line
2. Contract — non-negotiables
3. Retrieve — open the doc for the task
Deprecated-API cleanup (stay on stable)
4. Before you ship
Skill feedback

Key facts

Author: Cloudflare
Repository: cloudflare/skills
Installs on skills.sh: 73,872 (2 Nov 2026)
GitHub stars (repo): 3,244 (2 Nov 2026)
License: Apache-2.0
Last commit (repo): 31 Oct 2026
What installs: SKILL.md and references/skill-feedback.md (2 files); bundles no scripts
Works in: Claude Code, Codex, Cursor and VS Code / GitHub Copilot (install routes listed in the README)
skills.sh audits: Gen Agent Trust Hub pass, Socket pass, Snyk warn

What it includes

Check npm dependency and container image before coding
Claude checks that the app uses the default `@cloudflare/sandbox` package and the matching stable image. If it sees `@next` it stops and uses sandbox-next.
Read · Gate: confirm the package line
exec takes a command string and finishes before it returns
Claude follows the stable rules: buffered stdout, stderr and exit code, sessions for shared working directory, and `startProcess` or `execStream` for long jobs.
Try: “Add a Sandbox to my Worker that runs python3 and returns the output.”
Read · Contract: stable rules
A table of Cloudflare docs pages for each task
Claude looks up the right docs page for commands, sessions, files, ports, tunnels, backups, terminals and more before it implements.
Network · Retrieve: open the doc first
Search for old transport and session helpers, stay on stable
The skill gives a search command for deprecated names. Claude runs it to find them and follows Cloudflare's deprecation guide. This is not a move to @next.
Runs code · Deprecated-API cleanup
Same stable line for package and image, typecheck, no live secrets
A checklist: Worker package and container image on the same stable line, types checked, and no live secrets in the sandbox environment.
Read · Before you ship
Draft a public GitHub issue about the skill, only with your approval
If you say the skill gave wrong or outdated advice, Claude can draft an issue for you to review before anything is posted.
Network · Skill feedback

From the official docs

Permissions

Low risk

The skill is guidance plus a code search. The outward action it describes is a feedback issue that Claude posts publicly after you approve its text.

What it can do

Read your data
Create and change things
Delete things
Read-only mode

Watch out for

Feedback can open a public GitHub issue
The skill's feedback steps ask permission, show you the exact title and body, and post to cloudflare/skills only after you say yes. Keep secrets, account IDs and private code out of that text. github.com

Security advisories

No published security advisories as of Nov 2, 2026.

Technical details

Turning on read-only	The skill defines no read-only switch. It is instructions plus a code search.
Talks to	Cloudflare docs pages at developers.cloudflare.com. GitHub, only if you approve a feedback issue
Scopes	Claude reads your package.json and container image setting and may run a search command over your code Claude fetches Cloudflare docs pages

Questions

What does the Sandbox Stable skill do?

It makes Claude check which Cloudflare Sandbox package line your app uses, then follow the stable rules for that line. It also gives Claude a map of the right Cloudflare docs page for each task.

Sandbox Stable vs sandbox-next vs sandbox-migrate-to-next?

Use sandbox-stable for apps on the default @cloudflare/sandbox package. Use sandbox-next for apps on @cloudflare/sandbox@next (the 1.0 preview), which the skills recommend for new projects. Use sandbox-migrate-to-next to port a stable app to the preview. Each skill tells Claude to hand over to the right one.

How do I install it?

Use the install box at the top of this page. The README also documents a Claude Code plugin (/plugin marketplace add cloudflare/skills, then /plugin install cloudflare@cloudflare) that installs all of Cloudflare's skills together with Cloudflare's main MCP server. Start a new session afterwards.

Does it work in Codex, Cursor or Copilot?

Yes. The README lists install routes for Codex, VS Code with GitHub Copilot, Cursor and the skills CLI. Skills load on their own when your request matches. The README does not describe a Claude app install.

Does it need an API key?

The SKILL.md names no API key. It tells Claude to keep live credentials in the Worker and only non-secret settings in the sandbox environment.

Is it safe to install?

It is low risk. It bundles no scripts, only a rulebook and a feedback instruction. Claude can open a public GitHub issue about the skill only after you approve the exact text. As with any code Claude writes, review it before you deploy.

Information

updated Nov 2, 2026

Repository: cloudflare/skills
Folder: skills/sandbox-stable

cloudflare/skills skills.sh

Sources

Docs, issue trackers and discussions this page is built from.

Show all 4

cloudflare/skills README · github.com
skills CLI commands · github.com
sandbox-stable SKILL.md · github.com
sandbox-stable skill-feedback.md · github.com