[kvz]

Why

The public Next.js Smart CDN skill silently fell back to a fictitious demo/serve-preview/example.jpg contract. That could generate a correctly signed URL without proving that the application had selected a real, workspace-owned and origin-constrained delivery Template. It would also leave stale serve-preview guidance behind while API2 retires the arbitrary-origin Built-in.

What

• require workspace, Template, and input alongside the server-only credentials
• remove all serve-preview and serve-image references from the live Skills repository
• document the fixed-input/origin-constrained security contract
• make the reference scenario load all required local env values deterministically
• assert the configured Smart CDN hostname and full encoded path in E2E

Verified

• yarn check
• focused Smart CDN scenario npm run test:e2e
• focused scenario npm run build
• skill-creator quick_validate.py
• council review: no issues found
• repository-wide scan: no remaining serve-preview or serve-image references