Is cloudflare-dns-deploy safe to install?

SaferSkills independently audited cloudflare-dns-deploy (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.

CategoryWeightCategory scoreContribution

Securityprompt, exec, net, exfil, eval

35%

100

35.0 pts

Supply chainhash, typosquat, maintainer, lockfile

20%

100

20.0 pts

Maintenancestaleness, pinning, CI

15%

100

15.0 pts

TransparencySKILL.md, perms, README

15%

100

15.0 pts

Communityinstalls, verify, response

15%

100

15.0 pts

Findings & checks · 0 flagged

Securityscore 100 · 0 findings

✓—All security checks passedNo findings in this category for the latest scan.pass

Supply chainscore 100 · 0 findings

✓—All supply chain checks passedNo findings in this category for the latest scan.pass

Maintenancescore 100 · 0 findings

✓—All maintenance checks passedNo findings in this category for the latest scan.pass

Transparencyscore 100 · 0 findings

✓—All transparency checks passedNo findings in this category for the latest scan.pass

Communityscore 100 · 0 findings

✓—All community checks passedNo findings in this category for the latest scan.pass

The primary manifest — the file an agent reads to learn what this artifact does.

cloudflare-dns-deploy/SKILL.md · 1 file

cloudflare-dns-deploy/SKILL.md2.0 KB · Markdown

name: cloudflare-dns-deploy

description: Reconcile DNS records from a declared YAML catalog to Cloudflare via the API, and optionally run the companion nginx + certbot bootstrap for records pointing at your server. Idempotent. --dry-run by default, --apply hits the API, --server-setup also wires nginx + obtains Let's Encrypt cert. Use when the user says "deploy DNS", "add a subdomain", "stand up <X>.example.com", or before any subdomain launch.

cloudflare-dns-deploy

YAML → Cloudflare DNS → nginx → certbot, in one command.

When to use

New subdomain launches (replaces dashboard click + SSH + nginx + certbot dance)
DNS audits (--dry-run shows drift between YAML and live)
Multi-zone management (one YAML covers all your zones)
Pruning stale records (--prune deletes A/AAAA/CNAME/TXT/MX not in YAML)

How it works

Reads dns_records.yaml
For each zone, lists current Cloudflare records
For each declared record: matches by (zone, type, name). Creates if absent; patches if drift in content/TTL/proxied.
With --server-setup: waits for DNS propagation, enables nginx site, runs certbot, verifies HTTPS.

Env vars required

Var	Required for	Notes
`CLOUDFLARE_API_TOKEN`	all	Scoped Token (Zone:Read + DNS:Edit on target zones)

Token creation: dash.cloudflare.com → My Profile → API Tokens → Create Token → "Edit zone DNS" template.

Safety

Default is dry-run. No API write until --apply.
Doesn't delete by default. --prune is the explicit opt-in to remove records.
Server-setup is opt-in. Default --apply only touches Cloudflare; you don't accidentally invoke certbot.
Cert renewal stays under certbot.timer — this skill issues; renewal is automatic via the system service.

Hosted version

Aria Code runs this with:

Multi-zone team management
Scheduled drift checks (alerts on manual dashboard changes)
Approval workflow for --prune and --server-setup
Free tier · BYOK · no credit card

License

Apache 2.0

cloudflare-dns-deploy— agent skill

Is cloudflare-dns-deploy safe to install?

cloudflare-dns-deploy

When to use

How it works

Env vars required

Safety

Hosted version

License

Audit the pieces. Scan the whole. Decide.