Borrowing it
Nothing to install: this file belongs to djbelieny/nova. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/djbelieny/nova/main/.claude/skills/cloudflare-dns/SKILL.mdgit clone --depth 1 https://github.com/djbelieny/novaWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/djbelieny/nova/cloudflare-dns)<a href="https://agentmods.dev/skills/djbelieny/nova/cloudflare-dns"><img src="https://agentmods.dev/badge/skills/djbelieny/nova/cloudflare-dns.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00043 | $0.00403 |
| Opus 5 | $0.00022 | $0.00201 |
| Sonnet 5 | $0.00009 | $0.00081 |
| Haiku 4.5 | $0.00004 | $0.00040 |
Grade A, and why
cloudflare-dns scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 6d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
Cloudflare DNS & Domains
When to Use
- List or inspect domains and zones
- Manage routes
- Custom domain configuration (Workers for Platforms)
- Analytics and monitoring
Available Tools
Fetch these MCP tools using ToolSearch before calling them:
| Tool | Purpose |
|---|---|
mcp__cloudflare__domain_list |
List domains |
mcp__cloudflare__zones_list |
List zones |
mcp__cloudflare__zones_get |
Get zone details |
mcp__cloudflare__route_list |
List routes |
mcp__cloudflare__route_create |
Create route |
mcp__cloudflare__route_update |
Update route |
mcp__cloudflare__route_delete |
Delete route |
mcp__cloudflare__wfp_list_dispatch_namespaces |
List dispatch namespaces |
mcp__cloudflare__wfp_create_dispatch_namespace |
Create dispatch namespace |
mcp__cloudflare__wfp_delete_dispatch_namespace |
Delete dispatch namespace |
mcp__cloudflare__wfp_list_custom_domains |
List custom domains |
mcp__cloudflare__wfp_add_custom_domain |
Add custom domain |
mcp__cloudflare__wfp_remove_custom_domain |
Remove custom domain |
mcp__cloudflare__analytics_get |
Get analytics |
Usage Pattern
- Use
ToolSearchwith query"select:mcp__cloudflare__zones_list"(or whichever tool you need) - Call the fetched tool with required parameters
- Account ID and API token come from environment configuration
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 6d ago First seen · 40 lines · 43 tokens per session scan A c6b5a9e8ebfe
cloudflare-dns is a skill published in the GitHub repository djbelieny/nova (5 stars, last pushed 1mo ago), licensed MIT. It adds 43 tokens to every session and 403 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
install
Drive an end-to-end bento install on a FRESH Ubuntu/Debian VPS via SSH — pre-flight checks, unattended one-liner, post-hardening reboot, infra + app deploys, recovery from the failure modes that historically required manual operator intervention, and a final report with URLs + invite links. Use for a brand-new server.…
update
Update an existing bento install to the latest code and redeploy its managed stacks, via SSH. Re-runs the bento bootstrap unattended (re-clones the chosen ref, re-applies idempotently, redeploys BENTOMANAGED stacks). Use when the user says "update bento", "pull the latest bento", "redeploy my stacks". Causes brief…
status
Read-only health check of a VPS running bento, via SSH. Reports Swarm service replicas for every BENTOMANAGED stack, HTTPS reachability of each app, host resources (disk/memory/uptime), and any services stuck below desired replicas. Use when the user says "is my server ok", "check my bento VPS", "what's running"…
businesses
Business lifecycle skill (DOMAIN-AGNOSTIC). Creates, lists, inspects, validates, and migrates businesses — autonomous multi-agent organizations — following the Business Protocol v2 (v1 businesses still load unchanged). Works for ANY domain: marketing, healthcare, engineering, legal, real-estate, gaming, foodtech…
deploy
Add or redeploy application stacks on a VPS that ALREADY runs bento, via SSH. Drives bento's unattended Step 3 (BENTOAPPS) for the chosen apps, reconciles state against Portainer, verifies each app, and reports URLs + bootstrap artifacts. Use when the user says "add n8n to my server", "deploy chatwoot on my bento…
nirvana-os-hermes
Hermes runtime ONLY — the Nirvana-OS bridge for Hermes Agent. Every other runtime loads the first-class nirvana-os skill instead and must ignore this one. Lists and inspects the user's Nirvana-OS businesses (empresas) and squads and routes production briefs to the harness orchestrator via nrv dispatch. Trigger when…