Exécutez n'importe quel Skill dans Manus
en un clic

Exécutez n'importe quel Skill dans Manus en un clic

cloudflare-leaky-paths

Étoiles6

Forks0

Mis à jour13 juin 2026 à 11:01

Generate and apply a Cloudflare WAF custom rule that blocks common scanner/leaky paths (.env, .git, wp-login, phpMyAdmin, backups, infra config) at the edge before they reach the origin. Use when the user wants to block scanner traffic, harden a Cloudflare zone, stop .env/.git probing, reduce bot/scanner load, or asks about "leaky paths" or WAF custom rules.

Installation

Installer avec Codex ou Claude Copiez ce prompt, collez-le dans Codex, Claude ou un autre assistant, puis laissez-le vérifier la page du skill et l'installer pour vous.

Exécuter dans Manus

Source

seangeng

seangeng/skills

Ouvrir le dépôt GitHub Voir les dépôts du créateur

Téléchargement

Exécuter dans Manus

Métiers associésSOC

Basé sur la classification professionnelle SOC

Développeurs de logicielsProfessions informatiques et mathématiques·SOC 15-1252

SKILL.md

readonly

name	cloudflare-leaky-paths
description	Generate and apply a Cloudflare WAF custom rule that blocks common scanner/leaky paths (.env, .git, wp-login, phpMyAdmin, backups, infra config) at the edge before they reach the origin. Use when the user wants to block scanner traffic, harden a Cloudflare zone, stop .env/.git probing, reduce bot/scanner load, or asks about "leaky paths" or WAF custom rules.

Cloudflare leaky-paths WAF rule

Block high-signal scanner paths at Cloudflare's edge so they never hit the origin. Cuts log noise, origin load, and the risk of an exposed secret being fetched. Inspired by the leaky-paths wordlist (github.com/ayoubfathi/leaky-paths).

When to use

"Block scanners / bots at the edge"
"Stop .env / .git probing"
"Harden my Cloudflare zone / add a WAF rule"
"These scanner hits are spamming my logs"

The rule

Build a single Cloudflare custom-rule expression by OR-ing the path groups the user wants. Each clause is (http.request.uri.path contains "<path>").

Path groups

Dotfiles & secrets /.env /.git /.svn /.aws /.ssh /.config /.DS_Store /.htaccess /.htpasswd

WordPress /wp-login /wp-admin /wp-includes /wp-content /xmlrpc

Admin & DB tools /phpmyadmin /adminer /server-status /server-info

Backups & dumps /backup /backup.zip /dump.sql /db.sql /database.sql

Infra & CI config /docker-compose.yml /.dockerenv /.terraform /.github /.vscode /.idea

Only include WordPress / admin groups if the site actually has none of those — otherwise you may block legitimate /wp-admin logins. Confirm the stack first.

Example expression

(http.request.uri.path contains "/.env")
or (http.request.uri.path contains "/.git")
or (http.request.uri.path contains "/.aws")
or (http.request.uri.path contains "/wp-login")
or (http.request.uri.path contains "/phpmyadmin")
or (http.request.uri.path contains "/xmlrpc")

How to apply

Option A — Dashboard (fastest)

Cloudflare dashboard → your zone → Security → WAF → Custom rules.
Create rule, name it block-leaky-paths.
Switch the expression editor to Edit expression and paste the expression.
Action: Block. Deploy.

Option B — API

curl -X POST \
  "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/firewall/rules" \
  -H "Authorization: Bearer $CF_API_TOKEN" \
  -H "Content-Type: application/json" \
  -d '[{
    "filter": { "expression": "<EXPRESSION>" },
    "action": "block",
    "description": "block-leaky-paths"
  }]'

Option C — Terraform

resource "cloudflare_ruleset" "block_leaky_paths" {
  zone_id = var.zone_id
  name    = "block-leaky-paths"
  kind    = "zone"
  phase   = "http_request_firewall_custom"

  rules {
    action     = "block"
    expression = "<EXPRESSION>"
    description = "Block scanner/leaky paths at the edge"
    enabled    = true
  }
}

Verify

curl -s -o /dev/null -w "%{http_code}\n" https://example.com/.env   # expect 403
curl -s -o /dev/null -w "%{http_code}\n" https://example.com/        # expect 200

Notes

Prefer Block over Managed Challenge for these — there's no legitimate reason to request /.env.
contains matches anywhere in the path, so /foo/.git/config is caught too.
Keep the list lean; chasing every CVE path is a losing game. These are the high-signal "quick win" endpoints scanners hit first.

Credit: trick popularized by @vikingmute; paths distilled from ayoubfathi/leaky-paths.

Plus depuis ce dépôt

même dépôt

remark-mermaid-tldraw

seangeng/skills

Integrate the `remark-mermaid-tldraw` package so a project's ```mermaid code fences render as tldraw's warm, hand-drawn SVGs at build time (light + dark variants, zero client JS). Use this skill whenever the user wants their mermaid diagrams to look hand-drawn / sketched / less generic, mentions tldraw + mermaid together, wants build-time or pre-rendered diagrams in a blog or docs site, asks to "make my diagrams look better", or is wiring diagrams into MDX, Astro, Next.js, Eleventy, Vite, or React Router markdown. It encodes the exact install (including the headless-browser peer deps), the four wiring steps, the per-framework recipes, and — most importantly — the MDX-only `rehype-raw` gotcha that silently breaks the build if you miss it, plus how caching, light/dark, and the unsupported-diagram fallback work. Reach for it proactively when adding diagrams to any markdown/MDX pipeline; the default mermaid output is fine but flat, and this swaps it for the tldraw aesthetic without shipping any runtime JS.

2026-06-156

input-anticipation

seangeng/skills

Implement anticipatory UI — interfaces that react to pointer intent *before* the click. Three patterns: a proximity focus ring that warms as the cursor nears a field, a magnetic target that leans toward the cursor, and trajectory prediction that arms/prefetches the element the cursor is heading toward. Use this skill whenever the user wants a UI to "feel alive / responsive / fast", asks for a glow or focus ring that reacts to the mouse, a magnetic or cursor-attracting button, hover-intent or predictive prefetch, "make the chat box feel premium", or mentions input anticipation / anticipatory design / reacting to cursor proximity. Also reach for it proactively when building a hero CTA, an AI chat input, or a primary nav and the user wants polish. It bakes in the performance budget (reserve it for 1-2 high-value targets, never every button) and the accessibility rules (pointer-only effects must stay pure decoration, never become the only way to reach a control), so the result is tasteful and safe rather than a g

2026-06-136

block-disposable-emails

seangeng/skills

Reject throwaway/disposable email addresses at signup by checking the domain against a maintained list, so spam accounts, trial-abuse, and fake signups drop sharply. Use this whenever the user is building or hardening a signup / registration / waitlist flow and mentions fake accounts, throwaway emails, mailinator / 10minutemail / temp-mail, trial abuse, bot signups, junk users, or wants to "improve signup quality" or "stop disposable emails." Reach for it when adding an auth/signup endpoint even if the user hasn't named disposable email yet — it's a cheap, high-leverage guard. Produces a server-side check (works on Node, edge runtimes like Cloudflare Workers, etc.) and the rules for layering it with a CAPTCHA and email verification.

2026-06-136

boil-the-ocean

seangeng/skills

Raise the effort and completeness bar on agent work so it ships the finished thing, not a plan to build it. Use this when the user wants an agent to "do the whole thing", "go all the way", "don't stop at good enough", "ship it complete", "stop handing me plans", or is frustrated that previous output was half-done, left dangling threads, shipped a workaround, or offered to "table it for later." Also load it when setting up a coding agent's standing instructions (system prompt, SOUL.md, CLAUDE.md, AGENTS.md) and you want a reusable "completeness" directive. It's a prompt to paste into the agent's persistent config, plus the judgment to know when to dial it back.

2026-06-136

plan-optimizer

seangeng/skills

Iteratively optimize a plan by scoring it against a rubric, critiquing it, and rewriting it until the score plateaus. Use this skill whenever the user wants to refine, improve, harden, stress-test, or "make the best possible" version of a plan of any kind — project plans, execution/rollout plans, code implementation plans, research plans, strategy memos, study plans, training plans, go-to-market plans, or proposals. Trigger it when the user says things like "improve this plan", "iterate on this until it can't get better", "score and refine my approach", "find the holes in this plan", "make this plan bulletproof", or describes wanting an automatic improve-and-score loop. Also use it proactively when the user shares a draft plan and asks "is this good?" or "what would make this better?" — the loop produces a measurably stronger plan than a single critique pass.

2026-06-136

write-like-a-human

seangeng/skills

Strip the AI tells out of generated prose so it reads like a person wrote it. Use this skill whenever you're asked to write or rewrite human-facing copy — a blog post, landing page, marketing email, newsletter, README intro, product announcement, social post, or any content a reader will actually read — and especially when the user says it sounds "robotic", "like AI", "too corporate", "soulless", or asks to "humanize", "make it sound natural", "less AI", or "punchier". Reach for it proactively before drafting any substantial piece of copy, not just when fixing existing text. It applies a voice (conversational, varied rhythm, real opinion) and a hard ban-list of buzzwords and filler that give machine writing away.

2026-06-136

name	cloudflare-leaky-paths
description	Generate and apply a Cloudflare WAF custom rule that blocks common scanner/leaky paths (.env, .git, wp-login, phpMyAdmin, backups, infra config) at the edge before they reach the origin. Use when the user wants to block scanner traffic, harden a Cloudflare zone, stop .env/.git probing, reduce bot/scanner load, or asks about "leaky paths" or WAF custom rules.

Cloudflare leaky-paths WAF rule

When to use

"Block scanners / bots at the edge"
"Stop .env / .git probing"
"Harden my Cloudflare zone / add a WAF rule"
"These scanner hits are spamming my logs"

The rule

Build a single Cloudflare custom-rule expression by OR-ing the path groups the user wants. Each clause is (http.request.uri.path contains "<path>").

Path groups

Dotfiles & secrets /.env /.git /.svn /.aws /.ssh /.config /.DS_Store /.htaccess /.htpasswd

WordPress /wp-login /wp-admin /wp-includes /wp-content /xmlrpc

Admin & DB tools /phpmyadmin /adminer /server-status /server-info

Backups & dumps /backup /backup.zip /dump.sql /db.sql /database.sql

Infra & CI config /docker-compose.yml /.dockerenv /.terraform /.github /.vscode /.idea

Only include WordPress / admin groups if the site actually has none of those — otherwise you may block legitimate /wp-admin logins. Confirm the stack first.

Example expression

(http.request.uri.path contains "/.env")
or (http.request.uri.path contains "/.git")
or (http.request.uri.path contains "/.aws")
or (http.request.uri.path contains "/wp-login")
or (http.request.uri.path contains "/phpmyadmin")
or (http.request.uri.path contains "/xmlrpc")

How to apply

Option A — Dashboard (fastest)

Cloudflare dashboard → your zone → Security → WAF → Custom rules.
Create rule, name it block-leaky-paths.
Switch the expression editor to Edit expression and paste the expression.
Action: Block. Deploy.

Option B — API

curl -X POST \
  "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/firewall/rules" \
  -H "Authorization: Bearer $CF_API_TOKEN" \
  -H "Content-Type: application/json" \
  -d '[{
    "filter": { "expression": "<EXPRESSION>" },
    "action": "block",
    "description": "block-leaky-paths"
  }]'

Option C — Terraform

resource "cloudflare_ruleset" "block_leaky_paths" {
  zone_id = var.zone_id
  name    = "block-leaky-paths"
  kind    = "zone"
  phase   = "http_request_firewall_custom"

  rules {
    action     = "block"
    expression = "<EXPRESSION>"
    description = "Block scanner/leaky paths at the edge"
    enabled    = true
  }
}

Verify

curl -s -o /dev/null -w "%{http_code}\n" https://example.com/.env   # expect 403
curl -s -o /dev/null -w "%{http_code}\n" https://example.com/        # expect 200

Notes

Prefer Block over Managed Challenge for these — there's no legitimate reason to request /.env.
contains matches anywhere in the path, so /foo/.git/config is caught too.
Keep the list lean; chasing every CVE path is a losing game. These are the high-signal "quick win" endpoints scanners hit first.

Credit: trick popularized by @vikingmute; paths distilled from ayoubfathi/leaky-paths.