Cloudflare skills on GitHub: repo, Claude install, and security gaps

The Cloudflare skills repository is github.com/cloudflare/skills. It holds 19 skills for building on Workers, the Agents SDK, and other Cloudflare products. It had about 3,200 stars on November 1, 2026, and it uses the Apache-2.0 license.

To install it in Claude Code, run these commands one at a time:

/plugin marketplace add cloudflare/skills
/plugin install cloudflare@cloudflare

This repository does not hold the security audit skill. If you want that skill, go to cloudflare/security-audit-skill. The two projects do different jobs.

cloudflare/skills or security-audit-skill?

Many people search for one and want the other. Use this table.

Use cloudflare/skills when your agent writes code for Cloudflare. Use security-audit-skill when you want to find defects in a repository. You can install both.

Two other results can cause confusion. Threat Signals is a Cloudflare dashboard feature for threat intelligence. Its “agentic skills” are not a package that you install in Claude. Also, the search results show community projects with Cloudflare in the name, such as santmun/cloudflare-security-skill and the secondsky/claude-skills collection. Cloudflare does not own these projects. Treat them as third-party code.

What skills are in cloudflare/skills?

The skills load automatically when a request matches their triggers. This table groups the 19 skills at commit 1a33048.

Each skill tells the agent how to use a product. The skills do not audit your account. Some of them include security rules, and the next section shows these rules.

How do I install Cloudflare skills?

The repository supports many agents. Choose your agent.

Claude Code

Use the plugin. The first command must finish before you run the second. The Cloudflare Claude Code page gives the same steps.

/plugin marketplace add cloudflare/skills
/plugin install cloudflare@cloudflare

Run claude mcp list to confirm that the server is connected.

Codex

codex plugin marketplace add cloudflare/skills
codex plugin add cloudflare@cloudflare

Start a new Codex session after the install.

Skills only, with no MCP server

Use this method if you want the instructions but no API access.

npx skills add https://github.com/cloudflare/skills

Manual copy

Clone the repository and copy only the skill folders that you need. For Claude Code, the path is ~/.claude/skills/. For Cursor, the path is ~/.cursor/skills/.

The README lists ~/.codex/skills/ for Codex. The current OpenAI documentation lists $HOME/.agents/skills. If Codex does not show the skill, use the OpenAI path.

Which Cloudflare skills should I install?

You do not need all 19 skills for every project. Each installed skill adds a description that the agent reads, and each skill adds text that you must review. The plugin installs the full set, so use a manual copy if you want a small set.

The cloudflare skill helps the agent choose products. Its text also tells the agent to check the current documentation before it relies on limits, prices, or security requirements. Use this rule for your own work too, because Cloudflare changes its products often.

Update the skills on a schedule. Do not accept updates without a review. The repository changes often, and an update can add new instructions, new examples, and new hosts. Record the commit that you reviewed, and compare the next commit with it. The repository also uses Semgrep in its GitHub workflows, but that check protects the project and does not replace your own review.

Claude reads the description field of each skill to decide when to use it. If a skill does not start, name the skill in your request.

Use the turnstile-spin skill. Add Turnstile to the signup form in ./src/signup.
Add the server-side Siteverify check. Do not put the secret key in the code.

The last sentence in this prompt is important. A CAPTCHA widget in the browser gives no protection without the check on the server. Ask for both parts by name.

What does the Cloudflare MCP server add?

The plugin connects your agent to https://mcp.cloudflare.com/mcp. The README says that it gives access to the Cloudflare API and to the current developer documentation.

This changes the security of your setup. A skill is text. An MCP connection with API rights can read and change your account.

The Cloudflare documentation says that the server uses OAuth, and that you choose which permissions to grant. For CI, you can pass an API token as a bearer token.

Do these steps when you connect the server.

1. Grant the lowest rights. Choose read-only permissions if the task needs only information.
2. Use a separate account for tests. Do not connect production first.
3. Keep approval prompts on. Do not allow all MCP tools by default.
4. Use a scoped token in CI. Limit the token to one account and one zone.
5. Revoke access when you finish. Remove the connection if you do not use it often.

Warning: Text that the agent reads can contain instructions. A log, a ticket, or a web page can attempt to control an agent that has API rights. The guide on indirect prompt injection explains this attack.

Are the Cloudflare skills safe to install?

We scanned the repository with Skillisus at commit 1a33048. Skillisus is a static scanner for skills. Disclosure: Skillisus and VibeEval have the same author.

skillisus -min low cloudflare/skills

The largest groups of matches were:

We read the samples in the two smallest groups. The one leak-generic match is a labeled example of a bad practice: // Secret in version control. The one cred-dotenv match is documentation about a local token file.

This is a normal result for an API platform. It does not prove that the skills are safe, because a scanner can miss plain-English instructions. The GitHub security skills guide shows that test. The result gives you a list of hosts and a short list of lines to read.

What security rules do the Cloudflare skills include?

The workers-best-practices skill is the most useful skill for security. Its anti-pattern table includes these rules:

Use the skill as a review step with this prompt.

Use workers-best-practices to review this Worker.
Report only rules that this code breaks, with the file and line.
Then list the security facts that you cannot see from this repository.
Do not change any file.

These rules help the agent write better code. A code review still cannot show which settings are active on your account.

What can a skill not see on a deployed Worker?

A Worker can have more public addresses than your code suggests. Your repository can show the intended setup. Your Cloudflare account holds the active setup. These facts come from the Cloudflare documentation.

Think about this example. You put a Worker on a custom domain. You add Cloudflare Access or a security rule to that domain. You test the custom domain, and you see the login page. The same Worker can still answer on another hostname if that hostname is enabled.

A code audit cannot close this gap. The audit reads wrangler.toml. It cannot see a dashboard change, and it cannot send a request to the live hostname. The Cloudflare audit skill has a clear rule: “Do not probe deployed endpoints.”

The result is a blind spot between two correct parts. The code is correct, the custom domain is correct, and a second hostname is open.

How do I check a live Worker?

Warning: Test only Workers that you own or have written permission to test.

Do these steps after each change to routes or access rules.

1. List each hostname. Include the custom domain, the workers.dev URL, and any Preview URLs.
2. Set the value in the config. Add workers_dev = false if you do not need the route. Add the same decision for previews.
3. Deploy with Wrangler. The file now controls the setting.
4. Send a request to each hostname with no credentials.

curl -sI https://<worker>.<subdomain>.workers.dev | head -5
curl -sI https://app.example.com | head -5

5. Compare the responses. A hostname that you closed must not return your app. If it returns 200, it is public.
6. Test a protected route with no token. Then test it with a token from a second account.
7. Read the response headers. Check CORS, cache, and security headers on each hostname.

Prompt 1: list what to check, with no API calls.

Read wrangler.toml and the routing code. Do not call any API.
List each public hostname that this Worker can have.
For each hostname, state which protection the code assumes
(Access, WAF, auth middleware) and how I can test it from outside.
Mark each item that you cannot prove from this repository.

Prompt 2: compare the config with the account, read-only.

Use the Cloudflare MCP server with read-only actions only.
Do not change any setting. For the Worker <name>, list the active routes,
custom domains, workers.dev state, and preview state.
Compare this with wrangler.toml, and report each difference.

Prompt 2 is a good use of the MCP server. It compares two sources, and it changes nothing. Make sure that the token has no write rights.

How do I prove that my Cloudflare app is secure?

You cannot prove that any app is secure. You can collect evidence for each layer, and each layer needs a different tool.

The last layer is the only one that tests the complete system. Cloudflare knows this problem. Its harness post describes a stage that works to determine “if the code path is reachable in prod.” That stage uses deployment, environment, and config context that a repository does not have.

VibeEval tests the deployed URL with no source code, and each finding includes the actual response. It does not see hostnames that you do not give it, so include each hostname in your test list. It also cannot read server code, so it does not replace the source audit.

For the checks that you can do today, start with the security headers checker and the token leak checker. If you use Claude, the Claude Code audit guide gives the full workflow.