Cloudflare, safely

Cloudflare usually sits in front of production traffic, so treat it like a production database: read freely, change only with a human in the loop. The scripts beside this file handle the credentials; you never see a token.

They need Node.js 18 or newer and nothing else, and run the same on Linux, macOS and Windows. <skill-dir> below is the folder containing this file. Quote script paths, because install locations can contain spaces.

Credentials: check that the file exists, never read it

The credentials live in ~/.config/cloudflare/tokens.env (or the path in CLOUDFLARE_TOKENS_FILE). The user may keep a list of extra values to hide in redact.txt next to it; treat that file exactly like the credentials file.

• You may check that the file exists. Never open, print, search, copy or edit it, by any tool, and never run a command that would display its contents.
• Never ask the user to paste a token into the chat, and never put one in a command, file or log. If the user pastes one anyway, tell them to revoke it in the dashboard and create a new one.
• If the file is missing, or a script reports a missing or rejected token, stop and ask the user to run the setup themselves in their own terminal: node "<skill-dir>/scripts/setup-tokens.mjs". It refuses to run without an interactive terminal, so do not try to run it for them. First-time users need the setup guide to create the token; read it and walk them through it.

Reading

node "<skill-dir>/scripts/cf-read.mjs" <api-path>