Skip to content

feat(skills): package 8 Cloudflare skills - #500

Merged
JAORMX merged 1 commit into
mainfrom
skills/cloudflare
Apr 20, 2026
Merged

feat(skills): package 8 Cloudflare skills#500
JAORMX merged 1 commit into
mainfrom
skills/cloudflare

Conversation

@JAORMX

@JAORMX JAORMX commented Apr 20, 2026

Copy link
Copy Markdown
Collaborator

Summary

Packages 8 Cloudflare platform skills from cloudflare/skills (Apache-2.0) into Dockyard. All skills pinned to upstream commit 0397d7d (main as of 2026-04-16).

Fourth vendor in the per-vendor skills sweep. Cloudflare is an Anthropic skills launch partner.

Tracks #479.

Skills added

Agents and execution

  • agents-sdk — AI agents on Workers (state, callable RPC, workflows, MCP, chat, React hooks)
  • durable-objects — stateful coordination with SQLite storage, alarms, WebSockets
  • sandbox-sdk — secure code-execution sandboxes for AI interpreters and dev environments

Platform

  • cloudflare — comprehensive umbrella skill with product decision trees (Workers, Pages, storage, AI, networking, security, IaC)
  • workers-best-practices — production code review rules for Workers
  • wrangler — CLI for Workers, KV, R2, D1, Vectorize, Hyperdrive, Workers AI, Containers, Queues, Workflows, Pipelines, Secrets Store

Specialized

  • cloudflare-email-service — Email Sending + Email Routing (Workers binding, REST, Agents SDK)
  • web-perf — Chrome DevTools MCP-powered Core Web Vitals audit

Security allowlists

All 8 skills carry MANIFEST_MISSING_LICENSE (INFO) — upstream is Apache-2.0 at the repo root, not as SPDX in per-skill SKILL.md frontmatter.

The cloudflare umbrella skill additionally allowlists EXCESSIVE_FILE_COUNT (LOW): it ships 316 files organized as one references/<product>/ subtree per Cloudflare product. The large file count is upstream's design — the skill functions as a product index that routes to the relevant reference for any Cloudflare task. All files are Cloudflare-authored documentation, not bundled dependencies.

Test plan

  • task validate-skill on all 8 — all VALID
  • Cisco AI Defense skill-scanner 2.0.9 — all pass after allowlist
  • CI: Build Skill Artifacts workflow succeeds
  • CI: skill-scan-report surfaces only allowlisted findings
  • Post-merge: 8 OCI artifacts published

Closes #479

Packages 8 Cloudflare platform skills from cloudflare/skills (Apache-2.0)
into Dockyard, pinned to upstream commit 0397d7d (main as of 2026-04-16).

Fourth vendor in the per-vendor skills sweep. Cloudflare is an Anthropic
skills launch partner.

Agents and execution:
- agents-sdk — AI agents on Workers (state, RPC, workflows, MCP, chat)
- durable-objects — stateful coordination with SQLite storage
- sandbox-sdk — secure code execution environments

Platform:
- cloudflare — umbrella product index with decision trees
- workers-best-practices — production code review rules
- wrangler — CLI for Workers, KV, R2, D1, and the rest

Specialized:
- cloudflare-email-service — Email Sending + Email Routing
- web-perf — Chrome DevTools MCP-powered performance audit

Security allowlists:
All 8 carry MANIFEST_MISSING_LICENSE — upstream Apache-2.0 at the repo
root, not per-skill SPDX in SKILL.md frontmatter.

The `cloudflare` umbrella additionally allowlists EXCESSIVE_FILE_COUNT
(LOW): it ships 316 files organized as one `references/<product>/`
subtree per Cloudflare product, by upstream design — all are
Cloudflare-authored documentation, not bundled dependencies.

All 8 skills pass `task validate-skill` and `task scan-skill`.

Refs #479
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
@github-actions

Copy link
Copy Markdown
Contributor

🛡️ Skill Security Scan Results

✅ agents-sdk

  • Status: Passed
  • Findings: 1
  • Allowed (not blocking): 1
    • MANIFEST_MISSING_LICENSE (Allowed: cloudflare/skills is licensed Apache-2.0 at the repository root; upstream does not embed an SPDX license identifier in per-skill SKILL.md frontmatter.)

✅ cloudflare

  • Status: Passed
  • Findings: 2
  • Allowed (not blocking): 2
    • EXCESSIVE_FILE_COUNT (Allowed: This umbrella skill ships one references/<product>/ subdirectory per Cloudflare product (316 files total). The large file count is by upstream design — the skill functions as a product index that routes to the relevant reference for any Cloudflare task. All files are Cloudflare-authored documentation, not bundled dependencies.)
    • MANIFEST_MISSING_LICENSE (Allowed: cloudflare/skills is licensed Apache-2.0 at the repository root; upstream does not embed an SPDX license identifier in per-skill SKILL.md frontmatter.)

✅ cloudflare-email-service

  • Status: Passed
  • Findings: 1
  • Allowed (not blocking): 1
    • MANIFEST_MISSING_LICENSE (Allowed: cloudflare/skills is licensed Apache-2.0 at the repository root; upstream does not embed an SPDX license identifier in per-skill SKILL.md frontmatter.)

✅ durable-objects

  • Status: Passed
  • Findings: 1
  • Allowed (not blocking): 1
    • MANIFEST_MISSING_LICENSE (Allowed: cloudflare/skills is licensed Apache-2.0 at the repository root; upstream does not embed an SPDX license identifier in per-skill SKILL.md frontmatter.)

✅ sandbox-sdk

  • Status: Passed
  • Findings: 1
  • Allowed (not blocking): 1
    • MANIFEST_MISSING_LICENSE (Allowed: cloudflare/skills is licensed Apache-2.0 at the repository root; upstream does not embed an SPDX license identifier in per-skill SKILL.md frontmatter.)

✅ web-perf

  • Status: Passed
  • Findings: 1
  • Allowed (not blocking): 1
    • MANIFEST_MISSING_LICENSE (Allowed: cloudflare/skills is licensed Apache-2.0 at the repository root; upstream does not embed an SPDX license identifier in per-skill SKILL.md frontmatter.)

✅ workers-best-practices

  • Status: Passed
  • Findings: 1
  • Allowed (not blocking): 1
    • MANIFEST_MISSING_LICENSE (Allowed: cloudflare/skills is licensed Apache-2.0 at the repository root; upstream does not embed an SPDX license identifier in per-skill SKILL.md frontmatter.)

✅ wrangler

  • Status: Passed
  • Findings: 1
  • Allowed (not blocking): 1
    • MANIFEST_MISSING_LICENSE (Allowed: cloudflare/skills is licensed Apache-2.0 at the repository root; upstream does not embed an SPDX license identifier in per-skill SKILL.md frontmatter.)

Summary: Scanned 8 skill(s), all passed security checks. ✅

@JAORMX JAORMX added the skills Skill packaging, vendor skill imports label Apr 20, 2026
@JAORMX
JAORMX merged commit 059334b into main Apr 20, 2026
29 checks passed
@JAORMX
JAORMX deleted the skills/cloudflare branch April 20, 2026 10:13
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

skills Skill packaging, vendor skill imports

Projects

None yet

Development

Successfully merging this pull request may close these issues.

skill: package cloudflare/skills into dockyard

2 participants