Run any Skill in Manus with one click

cloudflare-hygiene

Stars2

Forks0

UpdatedJune 13, 2026 at 15:03

Audit + harden + optimize live Cloudflare zones/domains — read-only sweep of each zone (SSL/TLS mode, HSTS, min TLS, TLS 1.3, Always-Use-HTTPS, Brotli, HTTP/3, 0-RTT, Early Hints, caching, security level, Bot Fight Mode, WAF, DNS proxy/TTL + SPF/DKIM/DMARC hygiene, DNSSEC) → ok/attention/action report grouped by category → per-category confirm → apply via Cloudflare MCP. Use when the user says "harden my cloudflare", "optimize my cloudflare zones", "audit my domains", "check my cloudflare settings", "secure my dns", "harden my dns", "hide my origin IP", "set up HSTS/DNSSEC", "am I leaking my origin", "is my cloudflare config optimal", or "tune cloudflare". For BUILDING on Cloudflare (Workers/Pages/KV/D1/Terraform) use the cloudflare skill instead.

Installation

Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.

Run Skill in Manus

Source

pivoshenko

pivoshenko/pivoshenko.ai

View GitHub Repository View Creator Repositories

Download

Run Skill in Manus

Related occupationsSOC

Based on SOC occupation classification

Network and Computer Systems AdministratorsComputer and Mathematical Occupations·SOC 15-1244

File Explorer

3 files

SKILL.md

readonly

More from this repository

same repository

vercel-hygiene

pivoshenko/pivoshenko.ai

Audit and harden the 4 pivoshenko brand sites on Vercel (pivoshenko.dev, pivoshenko.startpage, pivoshenko.wallpapers, pivoshenko.ai), team `pivoshenko`. Read-only sweep → per-site report (ok/attention/action) → confirmed fixes. Emphasizes security headers and analytics coverage. Use when the user says "audit vercel", "check vercel hygiene", "harden the sites", "vercel security", "check analytics coverage", "vercel health check", or wants a periodic once-over of the Vercel setup. Delegates perf/cost → `vercel-optimize`, CLI ops → `vercel-cli`, deployments → `deploy-to-vercel`.

2026-06-132

wiki-lint

pivoshenko/pivoshenko.ai

Maintenance sweep of the Obsidian vault — orphan notes, missing/invalid frontmatter, dead wikilinks, stale project statuses, INDEX.md drift, unprocessed inbox. Use when the user says "lint my wiki", "vault health check", "clean up my vault", "is my wiki up to date", or on a periodic review.

2026-06-122

wiki-project

pivoshenko/pivoshenko.ai

Create or update project pages in the Obsidian vault's 03 PROJECTS — status changes, decision log entries, milestones, meeting notes, future-project ideas. Use when the user says "log a decision for <project>", "update <project> status", "new project page", "what's the state of <project>", "we had a meeting about <project>", "add a project idea", or finishes a chunk of project work worth recording in the wiki.

2026-06-122

macos-cleanup

pivoshenko/pivoshenko.ai

Deep-clean macOS — user/system junk (caches, logs, trash, iOS backups), leftovers from deleted apps, dev-tool junk (brew, docker, Xcode, npm/pnpm/uv/cargo caches, stale node_modules), disk-space breakdown + login-items audit. Use when the user says "clean my mac", "free up disk space", "disk is full", "what's eating my storage", "remove app leftovers", "my mac is slow", or any macOS storage/cleanup complaint. Health checks, updates, tune-up ("optimize/maintain my mac") → macos-maintenance instead. Always scans read-only first, reports sizes, deletes only after explicit per-category confirmation.

2026-06-122

macos-maintenance

pivoshenko/pivoshenko.ai

Periodic macOS maintenance + optimization — read-only health sweep (pending OS/brew updates, disk health + SMART, memory pressure + swap, battery condition, Time Machine recency, Spotlight indexing state, crash/panic reports, uptime, login-item load) → ok/attention/action report → confirmed fixes. Use when the user says "maintain my mac", "mac health check", "tune up my mac", "optimize my mac", "run maintenance", "is my mac healthy", "update everything", or wants a periodic once-over. Also covers targeted fixes when a check or the user flags an issue — Spotlight reindex, Launch Services rebuild, DNS/font cache flush, frozen Finder/Dock, runaway process triage. Storage/junk/leftovers/disk-space → macos-cleanup instead.

2026-06-122

blog-write

pivoshenko/pivoshenko.ai

Write and edit blog posts for pivoshenko.dev — interrogate for raw material, outline as a dependency graph, confirm sections, draft section-by-section, run anti-slop edit passes, ship as MDX. Use when the user says "write a blog post", "draft a post about X", "edit/revise/improve this article", "tighten this draft", "turn this into a post", "publish to my blog", or shares notes/an experience meant for pivoshenko.dev. The goal is bespoke practitioner writing, not generic AI prose.

2026-06-112

name	cloudflare-hygiene
description	Audit + harden + optimize live Cloudflare zones/domains — read-only sweep of each zone (SSL/TLS mode, HSTS, min TLS, TLS 1.3, Always-Use-HTTPS, Brotli, HTTP/3, 0-RTT, Early Hints, caching, security level, Bot Fight Mode, WAF, DNS proxy/TTL + SPF/DKIM/DMARC hygiene, DNSSEC) → ok/attention/action report grouped by category → per-category confirm → apply via Cloudflare MCP. Use when the user says "harden my cloudflare", "optimize my cloudflare zones", "audit my domains", "check my cloudflare settings", "secure my dns", "harden my dns", "hide my origin IP", "set up HSTS/DNSSEC", "am I leaking my origin", "is my cloudflare config optimal", or "tune cloudflare". For BUILDING on Cloudflare (Workers/Pages/KV/D1/Terraform) use the cloudflare skill instead.
tags	["cloudflare","optimization","security"]
updated_at	"2026-06-13T00:00:00.000Z"

Cloudflare Hygiene

Periodic posture sweep over live zones: preflight → sweep (read-only) → report → confirm → apply → verify. Optimization = real wins only: TLS strict, HTTPS forced, modern protocols on, DNS proxied + mail auth complete. No theater (no settings churned that already match optimal, no proxying records that must stay direct). Building on Cloudflare (Workers/Pages/KV/D1) → cloudflare, hand off.

Preflight

Token scope — this skill mutates zone settings + DNS, needs a broad-scope token. Probe once: GET /zones/{id}/settings/ssl. 9109/10000 (Unauthorized) → token too narrow, STOP and surface the upgrade path (see Token setup below) before sweeping. Don't limp through a settings-blind run.
Enumerate zones — GET /zones (paginate). List name · id · plan. Warn: full sweep across N zones takes a moment.
All work goes through mcp__cloudflare-api__execute (REST). mcp__cloudflare-api__docs / search for endpoint/shape lookups. mcp__cloudflare__authenticate = OAuth fallback if no API token configured.

Sweep (read-only)

Per zone, every category below — each shows in the report, clean ones as "ok", never silently dropped. GETs only here; no mutation. Full endpoint + optimal-value matrix lives in references/best-practices.md; scripts/audit.mjs is the reference read-only sweep logic (GETs + verdict classifier).

SSL/TLS — settings/ssl (want strict); settings/always_use_https (on); settings/min_tls_version (≥1.2); settings/tls_1_3 (on); settings/automatic_https_rewrites (on); settings/security_header HSTS (enabled, max-age ≥6mo, includeSubDomains; preload = opt-in only).
Security / WAF / bot — rulesets phases (http_request_firewall_managed deployed? ddos_l7 present?); settings/security_level (medium); bot_management (Bot Fight Mode on — Free tier); settings/email_obfuscation (on); settings/browser_check (on); custom firewall ruleset (http_request_firewall_custom — any bespoke rules?); rate limiting ruleset (http_ratelimit phase — login/API endpoints protected?); IP access rules / Zone Lockdown (firewall/access_rules/rules — stale allowlists?); Page Shield (page_shield — client-side/Magecart, plan-gated); Authenticated Origin Pulls (settings/tls_client_auth — mTLS edge→origin so origin only trusts CF); Leaked Credential Check (leaked-credential-checks — alerts on breached creds, plan-gated). Under Attack mode = situational (incident only), never default-on.
Performance / caching — settings/brotli (on); settings/early_hints (on); settings/cache_level (aggressive/standard); settings/browser_cache_ttl; settings/rocket_loader (case-by-case — can break JS, report don't force).
Network protocols — settings/http3 (on); settings/0rtt (on, idempotent-GET caveat); settings/ipv6 (on); settings/websockets (on); HTTP/2 (on).
DNS hygiene — dns_records: proxiable A/AAAA/CNAME should be proxied (orange) unless intentionally direct (flag grey-cloud = origin exposed); dnssec (active); parse TXT for SPF (root v=spf1), DKIM (*._domainkey), DMARC (_dmarc.<zone> — flag missing as action); dangling CNAMEs → takeover risk; low TTLs on stable records.
Analytics / observability — Web Analytics (/accounts/{acct}/rum/site_info/list — privacy-first, free; enabled for this zone?); Security Events summary (GraphQL firewallEventsAdaptive — last 24h threats blocked, top rules/countries → posture context, not a setting); Logpush (logpush/jobs — paid/Enterprise, report gap only). Pull the security-events summary read-only so the report shows what the WAF is actually catching, not just whether it's on.

Report

Table per zone × category: check · current · optimal · verdict (ok / attention = watch / action = fix available, named). Lead per zone: "Zone X: N ok, N attention, N actions". Then AskUserQuestion multiSelect over the actions only. Anything that can break traffic gets its own option, side effects stated first.

Actions (each confirmed, side effects stated first)

SSL mode → Full (strict): PATCH settings/ssl {value:"strict"} — breaks if origin lacks a valid cert. Confirm origin has a cert (Cloudflare Origin CA or real CA) before flipping.
Always Use HTTPS / Auto HTTPS Rewrites / min TLS 1.2 / TLS 1.3 on: PATCH each — low risk; min-TLS bump can lock out ancient clients, name it.
HSTS: PATCH settings/security_header {value:{strict_transport_security:{enabled,max_age,include_subdomains}}} (single-setting body wraps in value; nosniff also available). Hard to undo — browsers cache it; preload is near-permanent. Default no preload unless user explicitly opts in.
Brotli / Early Hints / HTTP/3 / 0-RTT / IPv6 / WebSockets on: PATCH settings/{id} {value:"on"} each — safe, idempotent.
email obfuscation / browser check on: PATCH settings/{id} {value:"on"} — safe.
Bot Fight Mode on: PUT bot_management {fight_mode:true} (whole-object PUT, not a setting PATCH) — safe; can challenge some automation.
Rate limiting rule: PUT rulesets/phases/http_ratelimit/entrypoint — protect login/API/expensive endpoints. Set thresholds from real traffic (use the analytics summary) — too tight = legit 429s. Confirm the matched path + threshold.
Authenticated Origin Pulls: PATCH settings/tls_client_auth {value:"on"} — origin must be configured to require the CF client cert first, else all traffic 502s. Two-step, origin-side change owned by user.
Page Shield: PUT page_shield {enabled:true} — plan-gated (Pro+); if Free errors, report the gap, don't churn.
Leaked Credential Check: POST leaked-credential-checks {enabled:true} — plan-gated; same fallback.
Prune stale IP access rules: DELETE firewall/access_rules/rules/{id} — confirm each; an old allow-rule can be a bypass hole.
Enable Web Analytics: POST /accounts/{acct}/rum/site_info for the zone — free, privacy-first, no cookie banner; gives RUM without GA. Safe.
Enable DNSSEC: PATCH dnssec {status:"active"} → returns DS record; incomplete until user adds the DS record at the registrar — give them the DS values, it's a two-step.
Proxy a grey-cloud record: PATCH dns_records/{id} {proxied:true} — never proxy mail (MX/its A), verification, or services needing direct origin. Confirm per record.
Add DMARC: propose _dmarc.<zone> TXT (start v=DMARC1; p=none; rua=mailto:... for monitoring), confirm value, POST dns_records.

Token setup (when preflight fails)

Narrow token → either (a) mint a scoped API token: dashboard → My Profile → API Tokens → Zone.Settings:Edit + DNS:Edit + Zone:Read (+ Bot Management, SSL/TLS where plan allows) for the target zones, then wire it into the cloudflare-api MCP env; or (b) mcp__cloudflare__authenticate OAuth flow if available. Re-run preflight after.

Rules

Sweep = read-only. Change state only via confirmed actions, one at a time → verify (re-GET, confirm new value) → next.
Side effects before confirm, always: SSL-mode origin break, min-TLS client lockout, HSTS/preload permanence, DNSSEC two-step, proxying a direct-only record.
No churn: a setting already at optimal is ok, not an action — don't PATCH it to look busy. Clean zone → "posture optimal", stop.
Report-only is valid — fixing is optional, never assumed.
Free-plan limits: some managed-WAF rules, Bot Management depth, and Page Rules count are plan-gated — report the gap, don't pretend it's fixable on Free.
Boundaries: Workers/Pages/KV/D1/R2/Terraform → cloudflare; registrar-side DNS, origin-server config, email DNS content policy → out of scope, name it.