cloudflare-governance
Use as the default entrypoint for broad Cloudflare requests when the user has not already named a narrower specialist. Covers Cloudflare governance, family-wide audit, WARP and Zero Trust device polic
SKILL.mdregistry/skills/cloudflare-governance/SKILL.md
GitHubCloudflare Governance
Purpose
This is the default routing skill for Cloudflare-related work in this workspace.
First 60 Seconds
- Decide whether the request is broad or already narrow.
- Identify whether the active evidence is local, account-level, zone-level, or mixed.
- Confirm what credentials are available.
- Route to one primary specialist and only add a secondary specialist when the issue is clearly mixed-scope.
Use This Skill When
- You need to decide which Cloudflare sub-skill should handle the task.
- You want a broad baseline check before a narrower action.
- You need a dry-run summary that spans more than one Cloudflare layer.
- You need to discover which Cloudflare script should run first.
Do Not Use This Skill When
- The user already named a specialist skill and the request is clearly within that scope.
- The task is purely
wranglerCLI or Cloudflare platform product selection rather than governance.
Route To
- WARP client, Zero Trust device policy, split tunnel vs full tunnel, or API auth: cloudflare-zerotrust-device
- Access and OAuth or DCR: cloudflare-access-mcp
- Tunnel and DNS: cloudflare-tunnel-dns
- Edge security and WAF: cloudflare-edge-security
- Local runtime sync and release state: cloudflare-runtime-sync
Baseline
- current-baseline.md
- dry-run-report.md
- workflow-guide.md
- routing-matrix.md
- script-catalog.md
- cloudflare-family-review-checklist.md
- family-review-2026-04-17.md
- scripts/inventory-cloudflare-scope.ps1
Handoff Rule
- Start here when the task touches more than one Cloudflare layer.
- Route to
cloudflare-zerotrust-devicewhen the task is primarily about local WARP state, Zero Trust device policy, split tunnel vs full tunnel, or Cloudflare API credential checks. - Route down to a focused sub-skill once the active change surface is clear.
- Route back here if the task expands across Access, Tunnel, DNS, edge security, and runtime state.
- Keep governance thin: classify, route, and summarize. Do not duplicate the deep operational procedures that live in the specialist skills or scripts.