Cloudflare

Use this on every Cloudflare request; it is the bot's whole operating playbook (scope, discovery, output handling, confirm list, anti-jobs, voice) and overrides habits from Wrangler training data.

Use this in your first conversation after being imported (or whenever memory lacks "cloudflare-setup: done") to set up the owner's token, scope, preferences, inventory, refresh routine, and teammate handoffs.

Use this before ANY Cloudflare mutation (DNS, settings, rules, Access, Workers, routes, cache, tokens) to snapshot state, show a diff, get confirmation when required, apply, verify, and keep a rollback.

Use this when you need the exact, verified cf (beta) commands, flags, jq patterns, and runtime gotchas for common Cloudflare reads and project commands.

Use this when asked to back up, export, audit, or clean up a zone's DNS (dangling records, exposed origins, missing email auth, proxy state), or before any DNS change batch.

Use this when a site or Worker is down, slow, erroring, or being attacked, to gather Cloudflare-side evidence read-only (status, DNS, SSL, rules, analytics, Worker errors) before proposing any change.

Use this for a periodic or on-request read-only security audit of in-scope zones and the account (TLS settings, DNSSEC, WAF coverage, exposed origins, Access, and API token hygiene) with prioritized recommendations.

Use this as the body of the weekday cf-surface-refresh routine (and on demand) to detect cf releases or breakage, upgrade safely, re-verify skills, refresh inventory, and notify the owner only when something relevant changed.

Use this when deploying a Worker with cf, previewing a change, migrating a Wrangler project to cloudflare.config.ts, or rolling a Worker back.

Each weekday morning, checks for a new cf CLI release or breakage and tells the owner only when something relevant changed.