skills.rest
jikig-ai
jikig-aiOFFICIAL
Explore all skills by this author →
GitHub

infra-security

Audit Cloudflare DNS, SSL/TLS, WAF, Workers, Zero Trust zone settings via MCP with CLI fallbacks.

12|2|Updated Jan 27, 2026
Search Tags:#security#audit#mcp#cloudflare#dns#waf#tls
One-click install
npx skills add https://github.com/jikig-ai/soleur --skill infra-security
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: infra-security
Source: https://github.com/jikig-ai/soleur/tree/main/.openhands/skills/infra-security
Command: npx skills add https://github.com/jikig-ai/soleur --skill infra-security

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill removes the complexity and risk of manually auditing and configuring Cloudflare zones, DNS records, SSL/TLS, and security features so teams can reliably harden domain posture and recover from misconfigurations.

Core Features & Use Cases

  • Live Cloudflare management: Authenticate via Cloudflare MCP to list zones, inspect and change DNS, SSL/TLS mode, HSTS, proxy settings, WAF rules, Workers, and Zero Trust policies.
  • Robust auditing with fallbacks: Run authenticated MCP API queries when available and fall back to CLI checks (dig, openssl s_client, curl) to verify DNS delegation, certificate chains, and security headers.
  • Safe mutating operations: Idempotent DNS CRUD, proxying defaults (orange cloud for web records, grey for mail), explicit user confirmation for any change, and careful handling of sensitive outputs.
  • Practical recipes: Includes common wiring flows such as GitHub Pages domain wiring and stepwise certificate provisioning to avoid breaking routing or ACME validation.

Quick Start

Audit example.com for DNS, SSL/TLS, HSTS, WAF configuration and provide a prioritized list of findings and recommended Cloudflare MCP actions.

Frequently Asked Questions about infra-security

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I audit Cloudflare DNS and SSL/TLS configuration for my domain?▼

Audit Cloudflare DNS and SSL/TLS configuration by authenticating via MCP to inspect zones, records, and security settings, using CLI fallbacks like dig and openssl to verify DNS delegation and certificate chains for a prioritized findings report.

How do I safely change DNS records and WAF rules without breaking domain routing?▼

Safely change DNS records and WAF rules using idempotent DNS CRUD operations and explicit user confirmation before mutations, applying proxying defaults like orange cloud for web records and grey cloud for mail to prevent routing breaks.

What's the best way to wire a GitHub Pages custom domain through Cloudflare?▼

Wire a GitHub Pages custom domain through Cloudflare by configuring DNS records and SSL/TLS mode stepwise, verifying certificate provisioning and ACME validation via MCP API queries and curl CLI fallbacks to avoid breaking domain routing.

Can I verify Cloudflare HSTS and security headers without direct dashboard access?▼

Verify Cloudflare HSTS and security headers without dashboard access by running MCP API queries to inspect zone settings, falling back to curl CLI checks to validate security header responses directly from the domain endpoint.

Does Cloudflare MCP OAuth authentication support automated DDoS mitigation configuration?▼

Cloudflare MCP OAuth authentication supports automated DDoS mitigation configuration by enabling authenticated API execute calls to inspect and modify zone-level security features and WAF rules with explicit user confirmation.

Why does my Cloudflare SSL/TLS certificate chain show errors after switching DNS providers?▼

Cloudflare SSL/TLS certificate chain errors after switching DNS providers indicate incomplete delegation or mismatched SSL/TLS modes, diagnosed via openssl s_client CLI fallbacks to verify certificate chains and dig checks for DNS propagation.

Related Skills

Explore More Software Engineering Skills→
mrudmrud

zrok

Expose local services over secure self-hosted tunnels with public and private sharing.

Community
Advanced
vercel-labsvercel-labs
246

vercel-firewall

Configure Vercel Firewall WAF rules, rate limiting, and bot management.

Official
Advanced
danieldev24danieldev24

ci-cd-and-automation

Automates CI/CD pipeline setup and quality gates for code verification.

Community
Advanced
majesticlabs-devmajesticlabs-dev
47

cloudflare-coder

Automate Cloudflare provisioning with OpenTofu/Terraform for zones, DNS, SSL, WAF, and caching.

Official
Advanced