Carlos Ospina Releases Agent Skills to Set Up Drupal Backends for Next.js

Seeking to reduce custom backend development for Next.js applications, Drupal contributor Carlos Ospina has released vibe-config, an open-source collection of skills for AI coding agents. The project uses Drupal as a configurable backend that provides content management, API access, authentication, permissions and an administrative interface. Carlos has shared the project publicly and invited developers to help test it across operating systems.

The approach differs from AI-assisted workflows that generate custom backend application code. Instead, the agent configures existing Drupal modules and uses configuration files to define the application's backend functionality. Configuration is stored in config/sync, while dependency versions are recorded in composer.lock. Carlos argues that this reduces the amount of custom code developers must maintain, although configuration changes, dependencies and security updates still require review.

The toolkit provides four skills. machine-check verifies local development requirements, backend-setup creates a Drupal installation using DDEV, and frontend-connect prepares a Next.js application connected to the backend. The fourth skill, safe-delete, provides instructions for resetting or removing test projects without allowing the agent to delete them automatically. The accompanying backend template, pinned at version v0.1.1 by the setup skill, uses Drupal 11.4.10 alongside modules including Simple OAuth and JSON:API. It supports OAuth authentication with PKCE and provides a read-only content API.

The backend template currently documents Simple OAuth 6.1.1, a version affected by the 21 October 2026 Drupal security advisory SA-CONTRIB-2026-242. The advisory describes an access-bypass vulnerability involving cached OAuth token permissions in versions 6.1.0 through 6.1.2 and directs administrators to update to version 6.1.3. Developers evaluating the template should verify the installed dependency and apply the corrected release before using it with sensitive accounts or data. The advisory does not establish that this project has been exploited.

The project remains limited to local development and does not yet include a production hosting or deployment workflow. API writing is disabled by default, and the documented limitations include the absence of built-in real-time subscriptions and authentication constraints in multi-process deployments. Carlos acknowledged that his initial testing was limited and that he lacked access to macOS and Windows for testing. The documentation identifies macOS as untested and requires WSL2 for Windows users. He has invited community members to test the toolkit and report their findings.