Skills nextjs-on-cloudflare
📦

nextjs-on-cloudflare

Content revision r1 High Risk ⚙️ External commands🌐 Network access📁 Filesystem access

Deploy Next.js Apps on Cloudflare Workers

Moving Next.js applications to Cloudflare Workers requires current compatibility and deployment guidance. This skill selects vinext workflows for new projects, migrations, development, and deployment.

Supports: Claude Codex Code(CC)
⚠️ 38 Poor

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request
Review the Skillstore skill "nextjs-on-cloudflare" from https://skillstore.io/skills/cloudflare-nextjs-on-cloudflare.md and its manifest at https://skillstore.io/api/skills/cloudflare-nextjs-on-cloudflare/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/cloudflare-nextjs-on-cloudflare.md Signed manifest GET /api/skills/cloudflare-nextjs-on-cloudflare/manifest Signed lockfile GET /api/skills/cloudflare-nextjs-on-cloudflare/lockfile

Test it

Using "nextjs-on-cloudflare". Should a new Cloudflare Workers project use vinext or OpenNext?

Expected outcome:

Use vinext for a new project unless project requirements or an explicit decision require OpenNext. Confirm required Next.js features before implementation.

Using "nextjs-on-cloudflare". Migrate my existing Next.js application to Cloudflare Workers.

Expected outcome:

  • Confirm that the repository contains an existing Next.js application.
  • Run the vinext compatibility assessment and document unsupported features.
  • Apply the migration workflow with Cloudflare selected as the target.
  • Test local Workers behavior before deployment.

Security Audit

High Risk
v1 • 9/6/2026 Open versioned report

Three command-related findings are confirmed because the skill directs agents to run external packages for installation and project creation. Documentation links, inline identifiers, and remote .agents paths are false positives, but the mutable upstream delegation creates a separate supply-chain risk.

1
Files scanned
34
Lines analyzed
3
Review items
0
False positives ignored

Confirmed security concerns (1)

High
SKILL.md:21-30
Unpinned External Skill Delegation
The skill installs cloudflare/vinext through npx and tells agents to follow instructions from the mutable main branch. A compromised package or later repository change could introduce unaudited commands.
Lines 21 through 30 explicitly combine external installation with instructions loaded from unpinned GitHub main paths. The current source appears legitimate, but its future contents are outside this audit.
Capability review items (3)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Medium
SKILL.md:3
Ruby/shell backtick execution
description: Build, migrate, and deploy Next.js apps on Cloudflare Workers with vinext. Use when sta
The description explicitly directs the agent to run `npx skills add cloudflare/vinext`. This executes an external package and installs unaudited content.
Medium
SKILL.md:23-25
Ruby/shell backtick execution
```sh
The shell block runs `npx skills add cloudflare/vinext`, which downloads and executes an external package. This creates package and instruction supply-chain exposure.
Medium
SKILL.md:29-30
Ruby/shell backtick execution
- **New project:** follow vinext's [new-project setup](https://github.com/cloudflare/vinext#starting
The workflow directs agents to use the external `create-vinext-app` executable. Running that package can create files and execute package lifecycle behavior.

Risk Factors

⚙️ External commands (7)
SKILL.md:3 SKILL.md:14 SKILL.md:23-25 SKILL.md:25-27 SKILL.md:27-29 SKILL.md:29-30 SKILL.md:30-33
🌐 Network access (7)
SKILL.md:8 SKILL.md:12 SKILL.md:21 SKILL.md:27 SKILL.md:29 SKILL.md:30 SKILL.md:31
📁 Filesystem access (2)
SKILL.md:21 SKILL.md:30
Audited by: codex
Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report
Security Assessment

Copy report link

https://skillstore.io/skills/cloudflare-nextjs-on-cloudflare/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/cloudflare-nextjs-on-cloudflare/security.svg)](https://skillstore.io/skills/cloudflare-nextjs-on-cloudflare?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/cloudflare-nextjs-on-cloudflare?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/cloudflare-nextjs-on-cloudflare/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/cloudflare-nextjs-on-cloudflare.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>
Academic citations (APA · BibTeX · CFF)

APA citation

cloudflare. (2026). nextjs-on-cloudflare security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/cloudflare-nextjs-on-cloudflare/audits/1

BibTeX citation

@techreport{cloudflare-cloudflare-nextjs-on-cloudflare-2026, author = {cloudflare}, title = {nextjs-on-cloudflare security audit report (audit version 1)}, institution = {Skillstore}, year = {2026}, number = {1}, url = {https://skillstore.io/skills/cloudflare-nextjs-on-cloudflare/audits/1}, note = {Author version unspecified} }

CITATION.cff

cff-version: 1.2.0 message: "If you use this Skill, cite its author and this versioned security audit report." title: "nextjs-on-cloudflare security audit report (audit version 1)" version: "unspecified" type: report authors: - name: "cloudflare" date-released: "2026-09-06" url: "https://skillstore.io/skills/cloudflare-nextjs-on-cloudflare/audits/1" identifiers: - type: other value: "skillstore:cloudflare-nextjs-on-cloudflare:audit:1" description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium
55
Architecture
85
Maintainability
87
Content
65
Community
91
Spec Compliance

What You Can Build

Start a Workers Project

Create a new Next.js application with vinext and select Cloudflare Workers as the deployment target.

Migrate an Existing Application

Assess compatibility and move an established Next.js project to vinext without treating an empty directory as a migration.

Standardize Deployment Guidance

Apply current vinext and Workers documentation while preserving existing OpenNext choices during unrelated work.

Try These Prompts

Choose a Project Path 
I am starting a Next.js application on Cloudflare Workers. Choose the appropriate vinext setup path and list the required decisions.
Plan a Migration 
Review this existing Next.js project for a vinext migration. Identify compatibility checks, likely blockers, and the Cloudflare target configuration.
Preserve OpenNext 
Update this Cloudflare Next.js project without replacing its existing OpenNext setup. Explain which changes remain within the requested maintenance scope.
Design a Deployment Workflow 
Create a vinext development and deployment plan for this repository. Cover Workers bindings, local workerd testing, compatibility validation, and rollback checks.

Best Practices

  • Confirm required Next.js features against current vinext compatibility information.
  • Preserve an existing OpenNext setup unless the user explicitly requests migration.
  • Review external skill sources and request approval before installing packages.

Avoid

  • Do not apply the migration workflow to an empty directory.
  • Do not assume complete parity with every Next.js feature.
  • Do not replace OpenNext during unrelated maintenance.

Frequently Asked Questions

Which runtime does this skill target?
It targets Next.js applications running on Cloudflare Workers through vinext.
Does it support new projects?
Yes. It directs new projects to create-vinext-app with Cloudflare selected as the target.
Can it migrate an existing Next.js application?
Yes. It directs existing applications through the upstream migration skill and compatibility checks.
Will it replace an existing OpenNext setup?
No. It preserves OpenNext during unrelated maintenance unless the user explicitly chooses migration.
Does vinext support every Next.js feature?
No guarantee is provided. Check current compatibility for every feature the application requires.
Does this skill install external tools?
Its workflow may install upstream vinext skills with npx. Review the source and approve execution before installation.

Developer Details

Author

cloudflare

License

MIT

Skillstore revision

r1

Version notice

The author did not declare a version.

Repository

https://github.com/cloudflare/skills/tree/d924cd8f59e75e08fd3dd52843bb2776de35c77e/skills/nextjs-on-cloudflare

Ref

e5464e662405de6361fdde6b984f9ea865635f64

Maintenance freshness

9/8/2026

Usage

0 downloads · 0 views

File structure

📄 SKILL.md