{
  "schemaVersion": "1.0",
  "item": {
    "slug": "cloudflare-guard",
    "name": "Cloudflare Guard",
    "source": "tencent",
    "type": "skill",
    "category": "其他",
    "sourceUrl": "https://clawhub.ai/guifav/cloudflare-guard",
    "canonicalUrl": "https://clawhub.ai/guifav/cloudflare-guard",
    "targetPlatform": "OpenClaw"
  },
  "install": {
    "downloadMode": "redirect",
    "downloadUrl": "/downloads/cloudflare-guard",
    "sourceDownloadUrl": "https://wry-manatee-359.convex.site/api/v1/download?slug=cloudflare-guard",
    "sourcePlatform": "tencent",
    "targetPlatform": "OpenClaw",
    "installMethod": "Manual import",
    "extraction": "Extract archive",
    "prerequisites": [
      "OpenClaw"
    ],
    "packageFormat": "ZIP package",
    "includedAssets": [
      "SKILL.md",
      "claw.json"
    ],
    "primaryDoc": "SKILL.md",
    "quickSetup": [
      "Download the package from Yavira.",
      "Extract the archive and review SKILL.md first.",
      "Import or place the package into your OpenClaw setup."
    ],
    "agentAssist": {
      "summary": "Hand the extracted package to your coding agent with a concrete install brief instead of figuring it out manually.",
      "steps": [
        "Download the package from Yavira.",
        "Extract it into a folder your agent can access.",
        "Paste one of the prompts below and point your agent at the extracted folder."
      ],
      "prompts": [
        {
          "label": "New install",
          "body": "I downloaded a skill package from Yavira. Read SKILL.md from the extracted folder and install it by following the included instructions. Tell me what you changed and call out any manual steps you could not complete."
        },
        {
          "label": "Upgrade existing",
          "body": "I downloaded an updated skill package from Yavira. Read SKILL.md from the extracted folder, compare it with my current installation, and upgrade it while preserving any custom configuration unless the package docs explicitly say otherwise. Summarize what changed and any follow-up checks I should run."
        }
      ]
    },
    "sourceHealth": {
      "source": "tencent",
      "status": "healthy",
      "reason": "direct_download_ok",
      "recommendedAction": "download",
      "checkedAt": "2026-04-23T16:43:11.935Z",
      "expiresAt": "2026-04-30T16:43:11.935Z",
      "httpStatus": 200,
      "finalUrl": "https://wry-manatee-359.convex.site/api/v1/download?slug=4claw-imageboard",
      "contentType": "application/zip",
      "probeMethod": "head",
      "details": {
        "probeUrl": "https://wry-manatee-359.convex.site/api/v1/download?slug=4claw-imageboard",
        "contentDisposition": "attachment; filename=\"4claw-imageboard-1.0.1.zip\"",
        "redirectLocation": null,
        "bodySnippet": null
      },
      "scope": "source",
      "summary": "Source download looks usable.",
      "detail": "Yavira can redirect you to the upstream package for this source.",
      "primaryActionLabel": "Download for OpenClaw",
      "primaryActionHref": "/downloads/cloudflare-guard"
    },
    "validation": {
      "installChecklist": [
        "Use the Yavira download entry.",
        "Review SKILL.md after the package is downloaded.",
        "Confirm the extracted package contains the expected setup assets."
      ],
      "postInstallChecks": [
        "Confirm the extracted package includes the expected docs or setup files.",
        "Validate the skill or prompts are available in your target agent workspace.",
        "Capture any manual follow-up steps the agent could not complete."
      ]
    },
    "downloadPageUrl": "https://openagent3.xyz/downloads/cloudflare-guard",
    "agentPageUrl": "https://openagent3.xyz/skills/cloudflare-guard/agent",
    "manifestUrl": "https://openagent3.xyz/skills/cloudflare-guard/agent.json",
    "briefUrl": "https://openagent3.xyz/skills/cloudflare-guard/agent.md"
  },
  "agentAssist": {
    "summary": "Hand the extracted package to your coding agent with a concrete install brief instead of figuring it out manually.",
    "steps": [
      "Download the package from Yavira.",
      "Extract it into a folder your agent can access.",
      "Paste one of the prompts below and point your agent at the extracted folder."
    ],
    "prompts": [
      {
        "label": "New install",
        "body": "I downloaded a skill package from Yavira. Read SKILL.md from the extracted folder and install it by following the included instructions. Tell me what you changed and call out any manual steps you could not complete."
      },
      {
        "label": "Upgrade existing",
        "body": "I downloaded an updated skill package from Yavira. Read SKILL.md from the extracted folder, compare it with my current installation, and upgrade it while preserving any custom configuration unless the package docs explicitly say otherwise. Summarize what changed and any follow-up checks I should run."
      }
    ]
  },
  "documentation": {
    "source": "clawhub",
    "primaryDoc": "SKILL.md",
    "sections": [
      {
        "title": "Cloudflare Guard",
        "body": "You are an infrastructure engineer managing Cloudflare configurations for web applications deployed on Vercel. You handle DNS, caching, security, and edge logic. Always use the Cloudflare API v4 via curl. Never store API tokens in files."
      },
      {
        "title": "Planning Protocol (MANDATORY — execute before ANY action)",
        "body": "Before making any API call to Cloudflare, you MUST complete this planning phase:\n\nUnderstand the request. Determine: (a) what DNS/caching/security change is needed, (b) which domain and zone it affects, (c) whether this is a new configuration or a modification to an existing one.\n\n\nSurvey the current state. List existing DNS records, current SSL settings, active page rules, and rate limiting rules by querying the Cloudflare API. Never assume the current state — always check first.\n\n\nBuild an execution plan. Write out: (a) each API call you will make, (b) the expected response, (c) the order of operations (e.g., DNS must be set before SSL can be verified). Present this plan before executing.\n\n\nIdentify risks. Flag: (a) DNS changes that could cause downtime (changing proxied records, removing A/CNAME records), (b) SSL changes that could break HTTPS, (c) WAF rules that could block legitimate traffic. For DNS changes, note the propagation time.\n\n\nExecute sequentially. Make one API call at a time, verify the response, then proceed. For DNS changes, verify propagation with a lookup before moving on.\n\n\nSummarize. Report all changes made, current state after changes, and any propagation delays the user should expect.\n\nDo NOT skip this protocol. A wrong DNS record or SSL setting can take the entire site offline."
      },
      {
        "title": "API Base",
        "body": "All requests use:\n\nhttps://api.cloudflare.com/client/v4\n\nAuth header:\n\nAuthorization: Bearer $CLOUDFLARE_API_TOKEN"
      },
      {
        "title": "List DNS records",
        "body": "curl -s -X GET \\\n  \"https://api.cloudflare.com/client/v4/zones/$CLOUDFLARE_ZONE_ID/dns_records\" \\\n  -H \"Authorization: Bearer $CLOUDFLARE_API_TOKEN\" \\\n  -H \"Content-Type: application/json\" | jq '.result[] | {id, type, name, content, proxied}'"
      },
      {
        "title": "Add CNAME for Vercel",
        "body": "curl -s -X POST \\\n  \"https://api.cloudflare.com/client/v4/zones/$CLOUDFLARE_ZONE_ID/dns_records\" \\\n  -H \"Authorization: Bearer $CLOUDFLARE_API_TOKEN\" \\\n  -H \"Content-Type: application/json\" \\\n  --data '{\n    \"type\": \"CNAME\",\n    \"name\": \"<subdomain>\",\n    \"content\": \"cname.vercel-dns.com\",\n    \"ttl\": 1,\n    \"proxied\": true\n  }' | jq ."
      },
      {
        "title": "Add root domain A record (if needed)",
        "body": "curl -s -X POST \\\n  \"https://api.cloudflare.com/client/v4/zones/$CLOUDFLARE_ZONE_ID/dns_records\" \\\n  -H \"Authorization: Bearer $CLOUDFLARE_API_TOKEN\" \\\n  -H \"Content-Type: application/json\" \\\n  --data '{\n    \"type\": \"A\",\n    \"name\": \"@\",\n    \"content\": \"76.76.21.21\",\n    \"ttl\": 1,\n    \"proxied\": true\n  }' | jq ."
      },
      {
        "title": "Delete a DNS record",
        "body": "curl -s -X DELETE \\\n  \"https://api.cloudflare.com/client/v4/zones/$CLOUDFLARE_ZONE_ID/dns_records/<record-id>\" \\\n  -H \"Authorization: Bearer $CLOUDFLARE_API_TOKEN\" | jq ."
      },
      {
        "title": "Set SSL mode to Full (Strict)",
        "body": "This is required when proxying through Cloudflare to Vercel:\n\ncurl -s -X PATCH \\\n  \"https://api.cloudflare.com/client/v4/zones/$CLOUDFLARE_ZONE_ID/settings/ssl\" \\\n  -H \"Authorization: Bearer $CLOUDFLARE_API_TOKEN\" \\\n  -H \"Content-Type: application/json\" \\\n  --data '{\"value\": \"strict\"}' | jq ."
      },
      {
        "title": "Enable Always Use HTTPS",
        "body": "curl -s -X PATCH \\\n  \"https://api.cloudflare.com/client/v4/zones/$CLOUDFLARE_ZONE_ID/settings/always_use_https\" \\\n  -H \"Authorization: Bearer $CLOUDFLARE_API_TOKEN\" \\\n  -H \"Content-Type: application/json\" \\\n  --data '{\"value\": \"on\"}' | jq ."
      },
      {
        "title": "Set Browser Cache TTL",
        "body": "curl -s -X PATCH \\\n  \"https://api.cloudflare.com/client/v4/zones/$CLOUDFLARE_ZONE_ID/settings/browser_cache_ttl\" \\\n  -H \"Authorization: Bearer $CLOUDFLARE_API_TOKEN\" \\\n  -H \"Content-Type: application/json\" \\\n  --data '{\"value\": 14400}' | jq ."
      },
      {
        "title": "Purge All Cache",
        "body": "Use after major deployments:\n\ncurl -s -X POST \\\n  \"https://api.cloudflare.com/client/v4/zones/$CLOUDFLARE_ZONE_ID/purge_cache\" \\\n  -H \"Authorization: Bearer $CLOUDFLARE_API_TOKEN\" \\\n  -H \"Content-Type: application/json\" \\\n  --data '{\"purge_everything\": true}' | jq ."
      },
      {
        "title": "Purge Specific URLs",
        "body": "curl -s -X POST \\\n  \"https://api.cloudflare.com/client/v4/zones/$CLOUDFLARE_ZONE_ID/purge_cache\" \\\n  -H \"Authorization: Bearer $CLOUDFLARE_API_TOKEN\" \\\n  -H \"Content-Type: application/json\" \\\n  --data '{\"files\": [\"https://example.com/path\"]}' | jq ."
      },
      {
        "title": "Create Rate Limiting Rule",
        "body": "Protect API routes from abuse:\n\ncurl -s -X POST \\\n  \"https://api.cloudflare.com/client/v4/zones/$CLOUDFLARE_ZONE_ID/rulesets/phases/http_ratelimit/entrypoint\" \\\n  -H \"Authorization: Bearer $CLOUDFLARE_API_TOKEN\" \\\n  -H \"Content-Type: application/json\" \\\n  --data '{\n    \"rules\": [{\n      \"expression\": \"(http.request.uri.path matches \\\"^/api/\\\")\",\n      \"description\": \"Rate limit API routes\",\n      \"action\": \"block\",\n      \"ratelimit\": {\n        \"characteristics\": [\"ip.src\"],\n        \"period\": 60,\n        \"requests_per_period\": 100,\n        \"mitigation_timeout\": 600\n      }\n    }]\n  }' | jq ."
      },
      {
        "title": "Enable Bot Fight Mode",
        "body": "curl -s -X PUT \\\n  \"https://api.cloudflare.com/client/v4/zones/$CLOUDFLARE_ZONE_ID/bot_management\" \\\n  -H \"Authorization: Bearer $CLOUDFLARE_API_TOKEN\" \\\n  -H \"Content-Type: application/json\" \\\n  --data '{\"fight_mode\": true}' | jq ."
      },
      {
        "title": "Cache static assets aggressively",
        "body": "curl -s -X POST \\\n  \"https://api.cloudflare.com/client/v4/zones/$CLOUDFLARE_ZONE_ID/pagerules\" \\\n  -H \"Authorization: Bearer $CLOUDFLARE_API_TOKEN\" \\\n  -H \"Content-Type: application/json\" \\\n  --data '{\n    \"targets\": [{\"target\": \"url\", \"constraint\": {\"operator\": \"matches\", \"value\": \"*.<domain>/_next/static/*\"}}],\n    \"actions\": [{\"id\": \"cache_level\", \"value\": \"cache_everything\"}, {\"id\": \"edge_cache_ttl\", \"value\": 2592000}],\n    \"status\": \"active\"\n  }' | jq ."
      },
      {
        "title": "Standard Setup for New Projects",
        "body": "When setting up Cloudflare for a new project on Vercel:\n\nAdd CNAME record pointing to cname.vercel-dns.com.\nSet SSL to Full (Strict).\nEnable Always Use HTTPS.\nAdd rate limiting for /api/* routes.\nEnable Bot Fight Mode.\nSet browser cache TTL to 4 hours.\nCreate a page rule to cache _next/static/* aggressively.\n\nRun all steps in sequence and report the result of each."
      },
      {
        "title": "522 errors (Connection Timed Out)",
        "body": "Check that SSL is set to Full (Strict), not Flexible.\nVerify Vercel domain is configured correctly.\nCheck if Cloudflare is proxying (orange cloud) — it should be."
      },
      {
        "title": "Mixed content warnings",
        "body": "Enable Always Use HTTPS.\nCheck that all internal links use relative paths or https://."
      },
      {
        "title": "Cache not updating after deploy",
        "body": "Purge cache after deployment.\nCheck that Cache-Control headers are set correctly in vercel.json."
      }
    ],
    "body": "Cloudflare Guard\n\nYou are an infrastructure engineer managing Cloudflare configurations for web applications deployed on Vercel. You handle DNS, caching, security, and edge logic. Always use the Cloudflare API v4 via curl. Never store API tokens in files.\n\nPlanning Protocol (MANDATORY — execute before ANY action)\n\nBefore making any API call to Cloudflare, you MUST complete this planning phase:\n\nUnderstand the request. Determine: (a) what DNS/caching/security change is needed, (b) which domain and zone it affects, (c) whether this is a new configuration or a modification to an existing one.\n\nSurvey the current state. List existing DNS records, current SSL settings, active page rules, and rate limiting rules by querying the Cloudflare API. Never assume the current state — always check first.\n\nBuild an execution plan. Write out: (a) each API call you will make, (b) the expected response, (c) the order of operations (e.g., DNS must be set before SSL can be verified). Present this plan before executing.\n\nIdentify risks. Flag: (a) DNS changes that could cause downtime (changing proxied records, removing A/CNAME records), (b) SSL changes that could break HTTPS, (c) WAF rules that could block legitimate traffic. For DNS changes, note the propagation time.\n\nExecute sequentially. Make one API call at a time, verify the response, then proceed. For DNS changes, verify propagation with a lookup before moving on.\n\nSummarize. Report all changes made, current state after changes, and any propagation delays the user should expect.\n\nDo NOT skip this protocol. A wrong DNS record or SSL setting can take the entire site offline.\n\nAPI Base\n\nAll requests use:\n\nhttps://api.cloudflare.com/client/v4\n\n\nAuth header:\n\nAuthorization: Bearer $CLOUDFLARE_API_TOKEN\n\nDNS Management\nList DNS records\ncurl -s -X GET \\\n  \"https://api.cloudflare.com/client/v4/zones/$CLOUDFLARE_ZONE_ID/dns_records\" \\\n  -H \"Authorization: Bearer $CLOUDFLARE_API_TOKEN\" \\\n  -H \"Content-Type: application/json\" | jq '.result[] | {id, type, name, content, proxied}'\n\nAdd CNAME for Vercel\ncurl -s -X POST \\\n  \"https://api.cloudflare.com/client/v4/zones/$CLOUDFLARE_ZONE_ID/dns_records\" \\\n  -H \"Authorization: Bearer $CLOUDFLARE_API_TOKEN\" \\\n  -H \"Content-Type: application/json\" \\\n  --data '{\n    \"type\": \"CNAME\",\n    \"name\": \"<subdomain>\",\n    \"content\": \"cname.vercel-dns.com\",\n    \"ttl\": 1,\n    \"proxied\": true\n  }' | jq .\n\nAdd root domain A record (if needed)\ncurl -s -X POST \\\n  \"https://api.cloudflare.com/client/v4/zones/$CLOUDFLARE_ZONE_ID/dns_records\" \\\n  -H \"Authorization: Bearer $CLOUDFLARE_API_TOKEN\" \\\n  -H \"Content-Type: application/json\" \\\n  --data '{\n    \"type\": \"A\",\n    \"name\": \"@\",\n    \"content\": \"76.76.21.21\",\n    \"ttl\": 1,\n    \"proxied\": true\n  }' | jq .\n\nDelete a DNS record\ncurl -s -X DELETE \\\n  \"https://api.cloudflare.com/client/v4/zones/$CLOUDFLARE_ZONE_ID/dns_records/<record-id>\" \\\n  -H \"Authorization: Bearer $CLOUDFLARE_API_TOKEN\" | jq .\n\nSSL/TLS Configuration\nSet SSL mode to Full (Strict)\n\nThis is required when proxying through Cloudflare to Vercel:\n\ncurl -s -X PATCH \\\n  \"https://api.cloudflare.com/client/v4/zones/$CLOUDFLARE_ZONE_ID/settings/ssl\" \\\n  -H \"Authorization: Bearer $CLOUDFLARE_API_TOKEN\" \\\n  -H \"Content-Type: application/json\" \\\n  --data '{\"value\": \"strict\"}' | jq .\n\nEnable Always Use HTTPS\ncurl -s -X PATCH \\\n  \"https://api.cloudflare.com/client/v4/zones/$CLOUDFLARE_ZONE_ID/settings/always_use_https\" \\\n  -H \"Authorization: Bearer $CLOUDFLARE_API_TOKEN\" \\\n  -H \"Content-Type: application/json\" \\\n  --data '{\"value\": \"on\"}' | jq .\n\nCaching Rules\nSet Browser Cache TTL\ncurl -s -X PATCH \\\n  \"https://api.cloudflare.com/client/v4/zones/$CLOUDFLARE_ZONE_ID/settings/browser_cache_ttl\" \\\n  -H \"Authorization: Bearer $CLOUDFLARE_API_TOKEN\" \\\n  -H \"Content-Type: application/json\" \\\n  --data '{\"value\": 14400}' | jq .\n\nPurge All Cache\n\nUse after major deployments:\n\ncurl -s -X POST \\\n  \"https://api.cloudflare.com/client/v4/zones/$CLOUDFLARE_ZONE_ID/purge_cache\" \\\n  -H \"Authorization: Bearer $CLOUDFLARE_API_TOKEN\" \\\n  -H \"Content-Type: application/json\" \\\n  --data '{\"purge_everything\": true}' | jq .\n\nPurge Specific URLs\ncurl -s -X POST \\\n  \"https://api.cloudflare.com/client/v4/zones/$CLOUDFLARE_ZONE_ID/purge_cache\" \\\n  -H \"Authorization: Bearer $CLOUDFLARE_API_TOKEN\" \\\n  -H \"Content-Type: application/json\" \\\n  --data '{\"files\": [\"https://example.com/path\"]}' | jq .\n\nSecurity Rules\nCreate Rate Limiting Rule\n\nProtect API routes from abuse:\n\ncurl -s -X POST \\\n  \"https://api.cloudflare.com/client/v4/zones/$CLOUDFLARE_ZONE_ID/rulesets/phases/http_ratelimit/entrypoint\" \\\n  -H \"Authorization: Bearer $CLOUDFLARE_API_TOKEN\" \\\n  -H \"Content-Type: application/json\" \\\n  --data '{\n    \"rules\": [{\n      \"expression\": \"(http.request.uri.path matches \\\"^/api/\\\")\",\n      \"description\": \"Rate limit API routes\",\n      \"action\": \"block\",\n      \"ratelimit\": {\n        \"characteristics\": [\"ip.src\"],\n        \"period\": 60,\n        \"requests_per_period\": 100,\n        \"mitigation_timeout\": 600\n      }\n    }]\n  }' | jq .\n\nEnable Bot Fight Mode\ncurl -s -X PUT \\\n  \"https://api.cloudflare.com/client/v4/zones/$CLOUDFLARE_ZONE_ID/bot_management\" \\\n  -H \"Authorization: Bearer $CLOUDFLARE_API_TOKEN\" \\\n  -H \"Content-Type: application/json\" \\\n  --data '{\"fight_mode\": true}' | jq .\n\nPage Rules (Legacy but useful)\nCache static assets aggressively\ncurl -s -X POST \\\n  \"https://api.cloudflare.com/client/v4/zones/$CLOUDFLARE_ZONE_ID/pagerules\" \\\n  -H \"Authorization: Bearer $CLOUDFLARE_API_TOKEN\" \\\n  -H \"Content-Type: application/json\" \\\n  --data '{\n    \"targets\": [{\"target\": \"url\", \"constraint\": {\"operator\": \"matches\", \"value\": \"*.<domain>/_next/static/*\"}}],\n    \"actions\": [{\"id\": \"cache_level\", \"value\": \"cache_everything\"}, {\"id\": \"edge_cache_ttl\", \"value\": 2592000}],\n    \"status\": \"active\"\n  }' | jq .\n\nStandard Setup for New Projects\n\nWhen setting up Cloudflare for a new project on Vercel:\n\nAdd CNAME record pointing to cname.vercel-dns.com.\nSet SSL to Full (Strict).\nEnable Always Use HTTPS.\nAdd rate limiting for /api/* routes.\nEnable Bot Fight Mode.\nSet browser cache TTL to 4 hours.\nCreate a page rule to cache _next/static/* aggressively.\n\nRun all steps in sequence and report the result of each.\n\nTroubleshooting\n522 errors (Connection Timed Out)\nCheck that SSL is set to Full (Strict), not Flexible.\nVerify Vercel domain is configured correctly.\nCheck if Cloudflare is proxying (orange cloud) — it should be.\nMixed content warnings\nEnable Always Use HTTPS.\nCheck that all internal links use relative paths or https://.\nCache not updating after deploy\nPurge cache after deployment.\nCheck that Cache-Control headers are set correctly in vercel.json."
  },
  "trust": {
    "sourceLabel": "tencent",
    "provenanceUrl": "https://clawhub.ai/guifav/cloudflare-guard",
    "publisherUrl": "https://clawhub.ai/guifav/cloudflare-guard",
    "owner": "guifav",
    "version": "0.1.1",
    "license": null,
    "verificationStatus": "Indexed source record"
  },
  "links": {
    "detailUrl": "https://openagent3.xyz/skills/cloudflare-guard",
    "downloadUrl": "https://openagent3.xyz/downloads/cloudflare-guard",
    "agentUrl": "https://openagent3.xyz/skills/cloudflare-guard/agent",
    "manifestUrl": "https://openagent3.xyz/skills/cloudflare-guard/agent.json",
    "briefUrl": "https://openagent3.xyz/skills/cloudflare-guard/agent.md"
  }
}