360 Secure SkillHub
360 安全技能中心

Cloudflare

基于内置 scripts/cf.sh（依赖 curl、jq、openssl），使用 CLOUDFLARE_API_TOKEN 调用 Cloudflare API，管理域名 Zone、DNS 记录增删改查与导入导出、SSL 模式、缓存清理、页面规则、防火墙规则、Tunnel 及站点分析；删除记录、改 SSL、改防火墙等破坏性操作前要求用户确认。

insipidpoint
insipidpoint
热度 65.48
最近更新 2026-05-11 17:25:52
分类：自动化依赖：代码执行 / 第三方 API / 读写文件应用场景：DevOps / 自动化脚本 / API 集成 / 工作流

安装技能

复制下面的话术发给你的 Agent，它会通过 secure-skills 检索并安装该技能。

执行命令安装此 skill： npx secure-skills-cli add cloudflare-toolkit
Metadata
name
cloudflare
description
Manage Cloudflare domains, DNS records, SSL settings, zone configuration, firewall rules, tunnels, and analytics via the Cloudflare API. Use when the user asks to set up a domain, add/edit/delete DNS records, configure SSL, check zone settings, manage Cloudflare Tunnels, view analytics, or any Cloudflare account management task.
metadata
{"openclaw":{"primaryEnv":"CLOUDFLARE_API_TOKEN","requires":{"env":["CLOUDFLARE_API_TOKEN"],"bins":["curl","jq","openssl"]}}}

Cloudflare

Manage Cloudflare zones, DNS, SSL, tunnels, and settings via the bundled scripts/cf.sh bash script.

Prerequisites

  • curl, jq, and openssl must be available on the system
  • Set CLOUDFLARE_API_TOKEN environment variable
  • Optionally set CLOUDFLARE_ACCOUNT_ID for tunnel operations

CLI: scripts/cf.sh

All operations go through the bundled scripts/cf.sh bash script (included in this skill). No external downloads needed.

# Run from skill directory
./scripts/cf.sh <command> [args...]
# Or reference by absolute path
/path/to/skills/cloudflare/scripts/cf.sh <command> [args...]

Commands

Command Args Description
help Show all commands
verify Verify API token is valid
zones [domain] List zones (optionally filter by domain name)
zone-get <zone_id> Get zone details
zone-id <domain> Get zone ID from domain name
dns-list <zone_id> [type] [name] List DNS records
dns-create <zone_id> <type> <name> <content> [proxied] [ttl] Create DNS record
dns-update <zone_id> <record_id> <type> <name> <content> [proxied] [ttl] Update DNS record
dns-delete <zone_id> <record_id> Delete DNS record
dns-export <zone_id> Export all records as JSON
dns-import <zone_id> <file.json> Import records from JSON
settings-list <zone_id> List all zone settings
setting-get <zone_id> <setting> Get specific setting
setting-set <zone_id> <setting> <value> Update a setting
ssl-get <zone_id> Get current SSL mode
ssl-set <zone_id> <mode> Set SSL mode (off/flexible/full/strict)
cache-purge <zone_id> [url1 url2 ...] Purge specific URLs or everything
pagerules-list <zone_id> List page rules
firewall-list <zone_id> List firewall rules
tunnels-list List Cloudflare Tunnels (needs ACCOUNT_ID)
tunnel-get <tunnel_id> Get tunnel details
tunnel-create <name> Create a tunnel (needs ACCOUNT_ID)
tunnel-delete <tunnel_id> Delete a tunnel (needs ACCOUNT_ID)
analytics <zone_id> [since_minutes] Zone analytics (default: last 24h)

Proxied flag

  • true — orange cloud, traffic through Cloudflare (CDN, WAF, DDoS)
  • false — grey cloud, DNS-only (use for MX, non-HTTP services)

TTL

  • 1 = automatic (Cloudflare-managed)
  • Set explicit seconds for DNS-only records (e.g., 3600)

Typical workflows

Point domain to server

# Find zone ID
cf zones example.com
# Create A record (proxied)
cf dns-create <zone_id> A example.com 1.2.3.4 true
# Create www CNAME
cf dns-create <zone_id> CNAME www.example.com example.com true

Set up email (MX + SPF)

cf dns-create <zone_id> MX example.com "mx.provider.com" false 1
cf dns-create <zone_id> TXT example.com "v=spf1 include:provider.com ~all" false

Enable strict SSL

cf ssl-set <zone_id> strict

Safety rules

Always confirm with the user before:

  • Deleting DNS records (dns-delete)
  • Changing SSL mode
  • Modifying firewall rules
  • Any destructive operation

Safe to do freely:

  • Listing/reading zones, records, settings, analytics
  • Verifying token

Reference

For DNS record types, SSL modes, and API details: see references/api-guide.md