Vercel to Cloudflare Worker Migration

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 9:07 PM UTC
• Version: 1.0.0

Overview

This skill is a coherent migration helper, but users should treat its package-install and Wrangler setup commands with normal dependency and credential care.

Before installing or using this skill, pin @opennextjs/cloudflare and wrangler versions where practical, review lockfile changes, and avoid putting real database passwords directly in reusable shell history. Expect the skill to read project source files and guide code changes for the migration; note that the referenced scripts/migrate.py is not present in the artifact.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:27

Finding

Unpinned Cloudflare adapter installation creates a mutable supply-chain risk

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:27-29
Vulnerability Type: Unpinned third-party package installation
Risk Level: Medium

Complete Code Snippet:

bash

npm install @opennextjs/cloudflare

Technical Analysis

The migration instructions install @opennextjs/cloudflare without specifying an audited version or requiring installation from a verified lockfile. Consequently, the command resolves whichever package version and dependency graph the configured npm registry serves at execution time.

npm installation can execute package lifecycle scripts. If the package, one of its transitive dependencies, the npm account publishing it, or the configured registry is compromised, code that was not present during this audit could execute on the user's machine. The package name itself appears legitimate; the issue is that the instructions leave the installed artifact mutable and do not prescribe integrity or provenance verification.

Attack Path

1. An attacker compromises the package publishing account, a transitive dependency, or the npm registry used by the victim.
2. The attacker publishes a malicious package version or modifies the resolved dependency chain.
3. A user follows the Skill instructions and runs the unpinned npm install command.
4. npm retrieves the attacker-controlled release.
5. Malicious lifecycle scripts or imported package code execute with the permissions of the invoking user.

Impact Assessment

Successful exploitation could provide arbitrary code execution under the invoking user's account. The malicious package could read or alter project source code, environment files, npm credentials, Cloudflare credentials, SSH keys, and other resources accessible to that user. It could also modify build artifacts or application dependencies, potentially extending the compromise to later deployments. The command does not directly grant elevated operating-system privileges, so t ...[truncated 65 chars]

Remediation

View remediation

Remediation Suggestions

• Specify an exact, reviewed adapter version rather than allowing npm to select the current release:

  bash

  npm install --save-exact @opennextjs/cloudflare@<audited-version>
  

• Commit package-lock.json and use npm ci in reproducible installation and deployment workflows.
• Review lockfile changes and package provenance before upgrades.
• Use npm registry integrity metadata and trusted registry configuration.
• Where compatible with the package, consider initially installing with lifecycle scripts disabled:

  bash

  npm ci --ignore-scripts
  

• Enable lifecycle scripts only after reviewing which scripts are required.
• Automate dependency vulnerability and provenance checks in CI, while retaining human review for version updates.

T08 · Insecure Dependencies

Warning

• Location: references/hyperdrive-setup.md:7

Finding

Unpinned npx command may download and execute mutable Wrangler code

Content

View full analysis

Vulnerability Details

File Location: references/hyperdrive-setup.md:7-9
Vulnerability Type: Dynamic execution of an unpinned third-party package
Risk Level: Medium

Complete Code Snippet:

bash

npx wrangler hyperdrive create my-hyperdrive \
  --connection-string="postgresql://postgres.[project-ref]:[password]@aws-0-[region].pooler.supabase.com:5432/postgres"

Technical Analysis

The documented command invokes npx wrangler without requiring a locally installed, version-pinned Wrangler package. If Wrangler is not already available locally, npx may resolve, download, install, and execute code from the configured npm registry. The effective executable can therefore change after the Skill has been reviewed.

Unlike a command that invokes a locked local dependency, this instruction combines package retrieval and execution. The command also receives a database connection string as an argument. Although the documented value is only a placeholder, a real invocation will commonly contain database credentials, increasing the consequences of executing a compromised CLI.

Attack Path

1. An attacker compromises the Wrangler publishing account, a transitive dependency, or the npm registry configured on the victim's machine.
2. The attacker publishes or serves a malicious Wrangler release or dependency.
3. The user substitutes real Supabase connection details into the documented command.
4. The user runs npx wrangler without a trusted local pinned installation.
5. npx downloads and executes the attacker-controlled code.
6. The malicious process captures the database connection string and may access other files, environment variables, tokens, or credentials available to the invoking user.

Impact Assessment

Successful exploitation could result in arbitrary code execution with the invoking user's permissions. In addition to project files and local credentials, the attacker could obtain the da ...[truncated 423 chars]

Remediation

View remediation

Remediation Suggestions

• Add Wrangler to the project using an exact, audited version:

  bash

  npm install --save-dev --save-exact wrangler@<audited-version>
  

• Commit the resulting lockfile and install dependencies with npm ci.
• Invoke only the locked local binary, preferably without allowing network fallback:

  bash

  npm exec --offline -- wrangler hyperdrive create my-hyperdrive \
    --connection-string="$HYPERDRIVE_DATABASE_URL"
  

• Verify package provenance, integrity, maintainers, and release notes before updating the pinned version.
• Avoid placing real database passwords directly in reusable shell history. Supply sensitive values through a protected environment variable or another Wrangler-supported secret-input mechanism.
• Use narrowly scoped database credentials and Cloudflare tokens, and rotate them immediately if execution of a compromised package is suspected.
• Run dependency tooling from a constrained development environment with access only to resources required for the migration.

SkillSpector

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 82% confidence

Finding

The skill instructs the agent to read project files and analyze or migrate code, which implies file-read capability, and it also discusses rewriting environment-variable access patterns, indicating interaction with environment/binding data. Because the skill does not declare an explicit tool scope such as allowed-tools or permissions, an agent may execute with broader-than-intended access, violating least privilege and increasing the blast radius if the skill is misused or chained with other prompts.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.