cloudflare-hygienelisted

# Cloudflare Hygiene Periodic posture sweep over live zones: preflight -> sweep (read-only) -> report -> confirm -> apply -> verify. Optimization = real wins only: TLS strict, HTTPS forced, modern protocols on, DNS proxied + mail auth complete. No theater (no settings churned that already match optimal, no proxying records that must stay direct). Building on Cloudflare (Workers/Pages/KV/D1) -> `cloudflare`, hand off. ## Preflight 1. Permission scope - this skill mutates zone settings + DNS, needs an authorized session that can write them. Probe once: `GET /zones/{id}/settings/ssl`. 9109/10000 (Unauthorized) -> scope too narrow, STOP and surface the upgrade path (see Access setup below) before sweeping. Don't limp through a settings-blind run 2. Enumerate zones - `GET /zones` (paginate). List name · id · plan. Warn: full sweep across N zones takes a moment 3. All work goes through `mcp__cloudflare__execute`, which runs a JS async arrow function - not a plain REST caller. Every call in this skill is shorthand for that shape: ```js async () => cloudflare.request({ method: "GET", path: `/zones/${zoneId}/settings/ssl` }) ``` `accountId` is pre-injected; zone ids come from step 2. Returns `{success, status, result, errors, result_info}` - read `errors[0].code` for the 9109 probe, `result_info.total_pages` to paginate. Batch a whole category's GETs into one `execute` call (loop inside the function, return an object) - one round-trip per category beats one per settin