cloudflare-one-migrations

An agent skill by cloudflare, from cloudflare/skills. Tags: cloudflare, cloudflare-one, migration, planning, security.

What it does

Assess and plan migrations from existing VPN, SWG, or SASE platforms to Cloudflare One, including policy mapping, parity gaps, and rollout.

Install

With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:

npx skills add cloudflare/skills --skill cloudflare-one-migrations

Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):

git clone --depth 1 https://github.com/cloudflare/skills
cp -r skills/skills/cloudflare-one-migrations ~/.claude/skills/cloudflare-one-migrations

Safety box score

Grade A, minimal risk: 9 of 100 risk points, rated 2026-10-20. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.

This is a planning-only Cloudflare One migration assessment skill. It mainly reads vendor exports and live documentation to map policies and rollout steps; the main risks are exposing sensitive operational data in those exports and depending on external docs, but it does not ship code or make changes itself.

Category levels, from 0 (none) to 3 (high)
Category	Level	Why
Code & shell execution	0 (none)	No shell commands, scripts, or code evaluation are included; the file is only Markdown guidance.
Network access	1 (low)	It explicitly says to "Retrieve current Cloudflare docs, Cloudflare API schemas, and source-vendor export docs," so it depends on outbound access to external documentation sources.
Filesystem reach	0 (none)	The skill does not direct reads, writes, or deletes on local files or system paths outside the working context.
Secrets & credentials	1 (low)	It asks for exports and logs from ZIA/ZPA/Palo Alto, which can contain sensitive identities, policies, and traffic data, though it does not request passwords or API tokens directly.
Privilege & persistence	0 (none)	There is no request for sudo, service installation, scheduled tasks, shell startup changes, or other privilege escalation.
Instruction hijack surface	0 (none)	The text does not tell the agent to ignore its rules, hide actions, or follow untrusted remote instructions; it only references docs to consult.
Irreversible actions	0 (none)	It is limited to assessment and planning and does not itself deploy, publish, send messages, pay, or delete anything.
Transparency	0 (none)	Everything is plain, readable Markdown; there are no binaries, installers, minified blobs, or hidden code.

Before installing

Confirm you are comfortable sharing source exports/logs that may contain sensitive policy and traffic data.
Verify the agent has only read access to the docs it needs and no access to production credentials or secrets.
Check whether any downstream automation will apply the generated plan, since this skill itself is planning-only.

Rated 2026-10-20 by an automated review of 1 file from the skill's repository.

Source

Repository: cloudflare/skills (all skills from this repository)
Path: skills/cloudflare-one-migrations/SKILL.md
Branch: main
Updated: 2026-09-20

cloudflare-one — Design, configure, troubleshoot, or review Cloudflare One Zero Trust and SASE deployments.
figure-it-out — Design an auditable playbook when no narrower one fits: a large migration, an ambitious multi-part change, or work a human reviews after stepping away.
principle-outcome-oriented-execution — Apply during planned rewrites and migrations with explicit phase boundaries.
cloudflare — Discover and choose Cloudflare products for apps, APIs, AI agents, storage, networking, and security.
nextjs-on-cloudflare — Build, migrate, and deploy Next.js apps on Cloudflare Workers with vinext. Use when starting a Next.js project on Cloudflare.
sandbox-migrate-to-next — Migrate Cloudflare Sandbox apps from stable @cloudflare/sandbox to @cloudflare/sandbox@next (SDK 1.0 preview). Use sandbox-next for apps already on the preview.