cloudflare-waf-author

What problem does it solve?

This Skill prevents broken or overly broad Cloudflare WAF changes by enforcing a safe, docs-first, evidence-backed authoring workflow for both custom WAF rules and managed-rule exceptions.

Core Features & Use Cases

• Rule-type correct workflow: Forces an explicit branch between Custom Rules (custom actions like block/challenge/log/skip-as-allow) and Managed-Rule Exceptions (skip) so the ruleset phase and behavior are correct.
• Docs-first predicate drafting: Requires reading the authoritative Cloudflare Ruleset Engine docs and copying field/operator details accurately before writing expressions.
• Peer-rule mirroring: Mandates surveying the closest existing rules for the same zone so the new rule matches house patterns and evaluation shape.
• Requester confirmation gate: Collects required inputs (hosts/paths/methods, source IP shape, soak plan, and—when applicable—specific OWASP child-rule IDs) before any expression is drafted.
• Provenance + consistency requirements: Enforces mandatory rationale artifacts (Terraform comments, Dashboard runbook entries, or API sibling .md files) plus four-source consistency checks to prevent title/body/code drift.
• Self-checks and anti-pattern avoidance: Includes per-interface and cross-cutting checklists (e.g., allow-before-block ordering, multi-value header correctness, safe API ETag + test validation, and soak-first block promotion).

Quick Start

Use cloudflare-waf-author to draft a Cloudflare WAF Custom Rule (or a Managed-Rule Exception) that blocks or skips specific traffic on a given host and path using the chosen interface (Terraform, Dashboard, or API).