stacklok · danbarr · Aug 27, 2026 · Aug 27, 2026 · Aug 27, 2026
diff --git a/skills/cloudflare-one-migrations/spec.yaml b/skills/cloudflare-one-migrations/spec.yaml
@@ -0,0 +1,25 @@
+# Cloudflare One Migrations Skill
+# Source: https://github.com/cloudflare/skills
+# Will publish as: ghcr.io/stacklok/dockyard/skills/cloudflare-one-migrations:0.1.0
+
+metadata:
+  name: cloudflare-one-migrations
+  description: >-
+    Plans migrations from Zscaler ZIA/ZPA, Palo Alto, legacy VPN, SWG, or SASE
+    stacks to Cloudflare One. Use for migration assessments, policy mapping,
+    rollout plans, and parity/gap analysis.
+
+spec:
+  repository: "https://github.com/cloudflare/skills"
+  ref: "f96bff754e428838818017f75817f0f9428acd48"  # main as of 2026-08-07
+  path: "skills/cloudflare-one-migrations"
+  version: "0.1.0"
+
+provenance:
+  repository_uri: "https://github.com/cloudflare/skills"
+  repository_ref: "refs/heads/main"
+
+security:
+  allowed_issues:
+    - rule_id: MANIFEST_MISSING_LICENSE
+      reason: "cloudflare/skills is licensed Apache-2.0 at the repository root; upstream does not embed an SPDX license identifier in per-skill SKILL.md frontmatter."
diff --git a/skills/cloudflare-one/spec.yaml b/skills/cloudflare-one/spec.yaml
@@ -0,0 +1,27 @@
+# Cloudflare One Skill
+# Source: https://github.com/cloudflare/skills
+# Will publish as: ghcr.io/stacklok/dockyard/skills/cloudflare-one:0.1.0
+
+metadata:
+  name: cloudflare-one
+  description: >-
+    Guides Cloudflare One Zero Trust and SASE work across Access, Gateway, WARP,
+    Tunnel, Cloudflare WAN, DLP, CASB, device posture, and identity. Use when
+    designing, configuring, troubleshooting, or reviewing Cloudflare One
+    deployments. Retrieval-first: use current Cloudflare docs/API schemas
+    instead of embedded product docs.
+
+spec:
+  repository: "https://github.com/cloudflare/skills"
+  ref: "f96bff754e428838818017f75817f0f9428acd48"  # main as of 2026-08-07
+  path: "skills/cloudflare-one"
+  version: "0.1.0"
+
+provenance:
+  repository_uri: "https://github.com/cloudflare/skills"
+  repository_ref: "refs/heads/main"
+
+security:
+  allowed_issues:
+    - rule_id: MANIFEST_MISSING_LICENSE
+      reason: "cloudflare/skills is licensed Apache-2.0 at the repository root; upstream does not embed an SPDX license identifier in per-skill SKILL.md frontmatter."
diff --git a/skills/sandbox-migrate-to-next/spec.yaml b/skills/sandbox-migrate-to-next/spec.yaml
@@ -0,0 +1,26 @@
+# Cloudflare Sandbox Migrate to Next Skill
+# Source: https://github.com/cloudflare/skills
+# Will publish as: ghcr.io/stacklok/dockyard/skills/sandbox-migrate-to-next:0.1.0
+
+metadata:
+  name: sandbox-migrate-to-next
+  description: >-
+    Use when porting a Cloudflare Sandbox app from stable @cloudflare/sandbox
+    to @cloudflare/sandbox@next (Sandbox SDK 1.0 preview), or when the user asks
+    to migrate or upgrade to Sandbox 1.0 / @next. Not for day-to-day stable work
+    (sandbox-stable) or new @next apps (sandbox-next).
+
+spec:
+  repository: "https://github.com/cloudflare/skills"
+  ref: "f96bff754e428838818017f75817f0f9428acd48"  # main as of 2026-08-07
+  path: "skills/sandbox-migrate-to-next"
+  version: "0.1.0"
+
+provenance:
+  repository_uri: "https://github.com/cloudflare/skills"
+  repository_ref: "refs/heads/main"
+
+security:
+  allowed_issues:
+    - rule_id: MANIFEST_MISSING_LICENSE
+      reason: "cloudflare/skills is licensed Apache-2.0 at the repository root; upstream does not embed an SPDX license identifier in per-skill SKILL.md frontmatter."
diff --git a/skills/sandbox-next/spec.yaml b/skills/sandbox-next/spec.yaml
@@ -0,0 +1,28 @@
+# Cloudflare Sandbox Next Skill
+# Source: https://github.com/cloudflare/skills
+# Will publish as: ghcr.io/stacklok/dockyard/skills/sandbox-next:0.1.0
+
+metadata:
+  name: sandbox-next
+  description: >-
+    Use when building or changing Cloudflare Sandbox apps on
+    @cloudflare/sandbox@next (Sandbox SDK 1.0 preview)—code execution, AI
+    runners, interpreters, CI-like jobs, terminals, files, mounts, tunnels,
+    preview URLs, lifecycle, or errors. Not for the default stable package (use
+    sandbox-stable) or for porting stable to @next (use
+    sandbox-migrate-to-next).
+
+spec:
+  repository: "https://github.com/cloudflare/skills"
+  ref: "f96bff754e428838818017f75817f0f9428acd48"  # main as of 2026-08-07
+  path: "skills/sandbox-next"
+  version: "0.1.0"
+
+provenance:
+  repository_uri: "https://github.com/cloudflare/skills"
+  repository_ref: "refs/heads/main"
+
+security:
+  allowed_issues:
+    - rule_id: MANIFEST_MISSING_LICENSE
+      reason: "cloudflare/skills is licensed Apache-2.0 at the repository root; upstream does not embed an SPDX license identifier in per-skill SKILL.md frontmatter."
diff --git a/skills/sandbox-stable/spec.yaml b/skills/sandbox-stable/spec.yaml
@@ -0,0 +1,27 @@
+# Cloudflare Sandbox Stable Skill
+# Source: https://github.com/cloudflare/skills
+# Will publish as: ghcr.io/stacklok/dockyard/skills/sandbox-stable:0.1.0
+
+metadata:
+  name: sandbox-stable
+  description: >-
+    Use when building or changing Cloudflare Sandbox apps on the current stable
+    @cloudflare/sandbox package (default npm tag)—commands, sessions, files,
+    ports, tunnels, terminals, bridge, production, or deprecated-API cleanup
+    while staying on stable. Not for @cloudflare/sandbox@next (use
+    sandbox-next) or for porting to 1.0 (use sandbox-migrate-to-next).
+
+spec:
+  repository: "https://github.com/cloudflare/skills"
+  ref: "f96bff754e428838818017f75817f0f9428acd48"  # main as of 2026-08-07
+  path: "skills/sandbox-stable"
+  version: "0.1.0"
+
+provenance:
+  repository_uri: "https://github.com/cloudflare/skills"
+  repository_ref: "refs/heads/main"
+
+security:
+  allowed_issues:
+    - rule_id: MANIFEST_MISSING_LICENSE
+      reason: "cloudflare/skills is licensed Apache-2.0 at the repository root; upstream does not embed an SPDX license identifier in per-skill SKILL.md frontmatter."
diff --git a/skills/turnstile-spin/spec.yaml b/skills/turnstile-spin/spec.yaml
@@ -0,0 +1,32 @@
+# Cloudflare Turnstile Spin Skill
+# Source: https://github.com/cloudflare/skills
+# Will publish as: ghcr.io/stacklok/dockyard/skills/turnstile-spin:0.1.0
+
+metadata:
+  name: turnstile-spin
+  description: >-
+    Set up Cloudflare Turnstile end-to-end in a project. Scan the codebase,
+    create the widget via the Cloudflare API, embed it where user requests need
+    bot verification (form submissions, SPA actions, API endpoints, download
+    links, comment or vote submissions, etc.), wire canonical server-side
+    siteverify in the customer's existing backend, validate, and persist the
+    skill. Load this when a user asks to add Turnstile, set up CAPTCHA, protect
+    a form or endpoint from bots, or fix a Turnstile integration. Mirrors
+    developers.cloudflare.com/turnstile/spin.
+
+spec:
+  repository: "https://github.com/cloudflare/skills"
+  ref: "f96bff754e428838818017f75817f0f9428acd48"  # main as of 2026-08-07
+  path: "skills/turnstile-spin"
+  version: "0.1.0"
+
+provenance:
+  repository_uri: "https://github.com/cloudflare/skills"
+  repository_ref: "refs/heads/main"
+
+security:
+  allowed_issues:
+    - rule_id: MANIFEST_MISSING_LICENSE
+      reason: "cloudflare/skills is licensed Apache-2.0 at the repository root; upstream does not embed an SPDX license identifier in per-skill SKILL.md frontmatter."
+    - rule_id: LLM_DATA_EXFILTRATION
+      reason: "Accepted trust boundary: SKILL.md:42 and SKILL.md:158-160 require the user to explicitly approve a canonical absolute Wrangler path outside the project and its exact version; repository text and project-local binaries cannot select it. scripts/auth-probe.sh:54-84 enforces those path, location, and version constraints before passing the token only to the approved Wrangler's `whoami --json` command at line 86. Without an approved Wrangler, the flow requires an explicit CLOUDFLARE_ACCOUNT_ID and does not invoke an external executable."