cloudflare-one

An agent skill by cloudflare, from cloudflare/skills. Tags: cloudflare, cloudflare-one, security, setup, troubleshooting.

What it does

Design, configure, troubleshoot, or review Cloudflare One Zero Trust and SASE deployments. Use cloudflare-one-migrations for migration planning from other vendors.

Install

With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:

npx skills add cloudflare/skills --skill cloudflare-one

Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):

git clone --depth 1 https://github.com/cloudflare/skills
cp -r skills/skills/cloudflare-one ~/.claude/skills/cloudflare-one

Safety box score

Grade C, moderate risk: 39 of 100 risk points, rated 2026-10-18. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.

This skill is a Cloudflare One operations playbook: it can inspect and configure Access, Gateway, Tunnel/Mesh, WAN, DLP, CASB, device posture, and identity settings. The main risk is broad org-level blast radius—traffic can be rerouted or blocked, and sensitive tokens/secrets may be exposed during setup.

Category levels, from 0 (none) to 3 (high)
Category	Level	Why
Code & shell execution	0 (none)	No scripts, shell commands, or code evaluators are shipped; the file is plain guidance for Cloudflare docs/API work.
Network access	2 (moderate)	It requires remote lookups to Cloudflare docs/MCP/API and can change tunnels, routes, Gateway policies, and DNS resolution that move traffic through Cloudflare.
Filesystem reach	0 (none)	The skill does not read, write, or delete local files or dotfiles; it only discusses Cloudflare-managed resources and documentation.
Secrets & credentials	2 (moderate)	It explicitly mentions handling service tokens, SCIM/IdP setup, and that "Generated IPsec PSKs and some OAuth/client secrets are returned once."
Privilege & persistence	2 (moderate)	It is meant to administer privileged Cloudflare org settings like Access, Gateway, tunnels, DLP, and MDM/root CA deployment, which requires elevated account permissions.
Instruction hijack surface	0 (none)	No hidden instructions or prompt-injection content; the line "Do not enable broad production policies without explicit approval" is a safety guardrail, not a bypass.
Irreversible actions	3 (high)	Its purpose is to design and configure Cloudflare One deployments, including policies and rollouts that can affect authentication and network access across an organization.
Transparency	0 (none)	All shipped content is readable Markdown; there are no binaries, minified blobs, or decoded-at-runtime payloads.

Before installing

Confirm which Cloudflare account and IdP groups this will manage before letting the agent run.
Read the sections for the products you will use (Access, Gateway, Tunnel, DLP, WAN) and verify the intended rollout is piloted first.
Check whether any existing tunnels, policies, MDM profiles, or one-time secrets will be overwritten or exposed.

Rated 2026-10-18 by an automated review of 1 file from the skill's repository.

Source

Repository: cloudflare/skills (all skills from this repository)
Path: skills/cloudflare-one/SKILL.md
Branch: main
Updated: 2026-09-20

X MCP guide — ALWAYS read this when a user connects the X plugin or any X MCP, before using any X connection, and again on any X error.
cloudflare-one-migrations — Assess and plan migrations from existing VPN, SWG, or SASE platforms to Cloudflare One, including policy mapping, parity gaps, and rollout.
amazon-ses — Guides Amazon SES onboarding for domain-based email sending.
cloudflare-troubleshooting — Investigate and resolve Cloudflare configuration issues using API-driven evidence gathering.
aws-networking — Routes AWS networking requests to the correct service skill for implementation.
expo-upgrade — Framework (OSS). Guidelines for upgrading Expo SDK versions and fixing dependency issues