Review the finished Worker against OWASP Top 10:2025, fix what is exploitable, prove each fix with a test, and report.
$ npx skills add receptron/mulmoterminal --skill blueprint-cloudflare-security -a claude-codeProject install by default; add -g for ~/.claude/skills/.
$ gh skill install receptron/mulmoterminal blueprint-cloudflare-security --agent claude-codeProject scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).
$ git clone --depth 1 https://github.com/receptron/mulmoterminal.git skills-src && mkdir -p .claude/skills && cp -r skills-src/blueprints/cloudflare/skills/security .claude/skills/blueprint-cloudflare-security && rm -rf skills-srcUse ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.
Claude Code skills documentation · loads skills from .claude/skills/
Install the "blueprint-cloudflare-security" agent skill from https://github.com/receptron/mulmoterminal/tree/main/blueprints/cloudflare/skills/security into .claude/skills/blueprint-cloudflare-security/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "blueprint-cloudflare-security", then confirm the skill loads.Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$skill-installer install https://github.com/receptron/mulmoterminal/tree/main/blueprints/cloudflare/skills/securityType this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.
$ npx skills add receptron/mulmoterminal --skill blueprint-cloudflare-security -a codexProject install goes to .agents/skills/; add -g for ~/.codex/skills/.
$ gh skill install receptron/mulmoterminal blueprint-cloudflare-security --agent codexProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/receptron/mulmoterminal.git skills-src && mkdir -p .agents/skills && cp -r skills-src/blueprints/cloudflare/skills/security .agents/skills/blueprint-cloudflare-security && rm -rf skills-srcUse ~/.agents/skills/ instead of .agents/skills for a personal install.
Codex skills documentation · loads skills from .agents/skills/
Install the "blueprint-cloudflare-security" agent skill from https://github.com/receptron/mulmoterminal/tree/main/blueprints/cloudflare/skills/security into .agents/skills/blueprint-cloudflare-security/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "blueprint-cloudflare-security", then confirm the skill loads.Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add receptron/mulmoterminal --skill blueprint-cloudflare-security -a cursorProject install goes to .agents/skills/; add -g for ~/.cursor/skills/.
$ gh skill install receptron/mulmoterminal blueprint-cloudflare-security --agent cursorProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/receptron/mulmoterminal.git skills-src && mkdir -p .cursor/skills && cp -r skills-src/blueprints/cloudflare/skills/security .cursor/skills/blueprint-cloudflare-security && rm -rf skills-srcUse ~/.cursor/skills/ instead of .cursor/skills for a personal install.
Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/
Install the "blueprint-cloudflare-security" agent skill from https://github.com/receptron/mulmoterminal/tree/main/blueprints/cloudflare/skills/security into .cursor/skills/blueprint-cloudflare-security/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "blueprint-cloudflare-security", then confirm the skill loads.Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gemini skills install https://github.com/receptron/mulmoterminal.git --path blueprints/cloudflare/skills/security--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.
$ npx skills add receptron/mulmoterminal --skill blueprint-cloudflare-security -a gemini-cliProject install goes to .agents/skills/; add -g for ~/.gemini/skills/.
$ gh skill install receptron/mulmoterminal blueprint-cloudflare-security --agent gemini-cliProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/receptron/mulmoterminal.git skills-src && mkdir -p .gemini/skills && cp -r skills-src/blueprints/cloudflare/skills/security .gemini/skills/blueprint-cloudflare-security && rm -rf skills-srcUse ~/.gemini/skills/ instead of .gemini/skills for a personal install, then run /skills reload.
Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/
Install the "blueprint-cloudflare-security" agent skill from https://github.com/receptron/mulmoterminal/tree/main/blueprints/cloudflare/skills/security into .gemini/skills/blueprint-cloudflare-security/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "blueprint-cloudflare-security", then confirm the skill loads.Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gh skill install receptron/mulmoterminal blueprint-cloudflare-securityInstalls for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).
$ npx skills add receptron/mulmoterminal --skill blueprint-cloudflare-security -a github-copilotProject install goes to .agents/skills/; add -g for ~/.copilot/skills/.
$ git clone --depth 1 https://github.com/receptron/mulmoterminal.git skills-src && mkdir -p .github/skills && cp -r skills-src/blueprints/cloudflare/skills/security .github/skills/blueprint-cloudflare-security && rm -rf skills-srcUse ~/.copilot/skills/ instead of .github/skills for a personal install. Commit .github/skills so cloud agent and code review can use it.
GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/
Install the "blueprint-cloudflare-security" agent skill from https://github.com/receptron/mulmoterminal/tree/main/blueprints/cloudflare/skills/security into .github/skills/blueprint-cloudflare-security/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "blueprint-cloudflare-security", then confirm the skill loads.GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add receptron/mulmoterminal --skill blueprint-cloudflare-security -a opencodeOpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.
$ gh skill install receptron/mulmoterminal blueprint-cloudflare-security --agent opencodeProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/receptron/mulmoterminal.git skills-src && mkdir -p .opencode/skills && cp -r skills-src/blueprints/cloudflare/skills/security .opencode/skills/blueprint-cloudflare-security && rm -rf skills-srcUse ~/.config/opencode/skills/ instead of .opencode/skills for a personal install.
OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/
Install the "blueprint-cloudflare-security" agent skill from https://github.com/receptron/mulmoterminal/tree/main/blueprints/cloudflare/skills/security into .opencode/skills/blueprint-cloudflare-security/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "blueprint-cloudflare-security", then confirm the skill loads.OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
blueprint-cloudflare-securityReview the finished Worker against OWASP Top 10:2025, fix what is exploitable, prove each fix with a test, and report.
Blueprint Cloudflare Security is an agent skill from receptron/mulmoterminal. Review the finished Worker against OWASP Top 10:2025, fix what is exploitable, prove each fix with a test, and report.
Its SKILL.md is about 1.2k tokens, which your agent loads only when the skill is triggered. It is a single SKILL.md file with no bundled scripts.
It sits in Security, covering Web application vulnerabilities. It works with Cloudflare and Cloudflare Workers. The repository describes itself as: Run multiple Claude Code and Codex sessions in parallel — a browser terminal grid that shows which agent needs you. Local, tmux-backed, MIT. The licence is MIT.
4 steps, taken from the first numbered list in SKILL.md.
Read from SKILL.md and the folder at commit 0b9f076. It shows what the files ask for, not the result of running them.
Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.
From allowed-tools in the SKILL.md frontmatter.
Shell commands in SKILL.md call:
yarnwranglergitFrom the folder's file list and the shell code blocks in SKILL.md.
No URLs in SKILL.md. Its commands use yarn, wrangler and git, which can reach the network depending on how they are called.
From URLs in SKILL.md, links to its own repository left out.
Names no API keys, tokens, secrets or passwords.
From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.
Blueprint Cloudflare Security loads about 1.2k tokens when it runs. Until then it costs about 37 tokens; SKILL.md has 661 words of instructions outside code blocks.
Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.
The automated check noted patterns worth knowing about, such as sudo or a known installer.
ngler secrets, and `.dev.vars` (and any `.env`) listed in `.gitignore`; cookies `HttpOnly`, `Secure`,- `.dev.vars` / `.env`, if present, ignored by `.gitignore`.Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.
The full file from receptron/mulmoterminal at commit 0b9f076, republished under its MIT licence (© receptron). 661 words, ~1,175 tokens.
.claude/skills/blueprint-cloudflare-security/SKILL.md (or your agent's skills folder).The app is built and runs. Before it is published, review it the way an attacker would read it, fix what is exploitable, and leave a report the person can read. The check does not take your word for it: it starts the Worker with wrangler dev and sends it the requests an attack would send.
.blueprint/spec.md (above all "必ず詰める点"), then src/worker/, src/client/,
wrangler.jsonc, public/_headers and package.json. Note who may do what, where input enters, what is stored.test/security.test.ts that fails without the fix..blueprint/security-review.md (format below).Severity: HIGH is directly exploitable (read or change someone's data, bypass sign-in, run code). MEDIUM needs a specific condition but the impact is real. LOW is defence in depth. Report a finding only when you can state how it is exploited and you are at least 70% sure. Do not report denial of service, rate limits, or missing validation on a field that cannot cause harm.
/api route enforces the spec's sign-in and roles in the
Worker; with accounts, a row is read or changed only by whoever may./api/*, and
public/_headers for the static files, which never go through the Worker; no permissive CORS.yarn audit --groups dependencies has no high or critical..dev.vars (and any .env) listed in .gitignore; cookies HttpOnly, Secure,
SameSite=Lax.console.log
reaches wrangler tail), without passwords, cookies or secrets./api from Origin: https://attacker.example → 403, before routing and sign-in./api with a malformed JSON body → 400, from the one place the Worker reads bodies, with no
stack trace or parser message./ and /api/health: Content-Security-Policy with frame-ancestors 'none', X-Content-Type-Options: nosniff,
no X-Powered-By..dev.vars / .env, if present, ignored by .gitignore..blueprint/security-review.md, in the spec's language. One section per category, its heading naming the id
(## A01 … through ## A10 …), every finding on a line of its own:
- HIGH fixed: <what was wrong, how it could be exploited> — <what changed, which test proves it>
- LOW accepted: <what, and why it is acceptable for this app>The state is fixed, open or accepted; a HIGH or MEDIUM may be neither open nor accepted. A category with
nothing to report says what was checked and "指摘なし".
Done when the check passes: the report covers A01–A10 with nothing HIGH or MEDIUM left open, the tests pass, the audit is clean, and the running Worker refuses the cross-site change and the malformed body and sends the headers.
.blueprint/spec.md first. It is the agreed specification; do not widen it.git init: a new repository loses the folder's trust and the next unattended step stops at Claude
Code's trust prompt. The user adds git themselves after the build if they want it.© receptron, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file
Just SKILL.md in blueprints/cloudflare/skills/security of receptron/mulmoterminal.
Open the folder on GitHubat commit 0b9f076
Blueprint Cloudflare Security next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.
| Skill | Stars | Used in | Tokens | Auto-check | Licence | Repo updated |
|---|---|---|---|---|---|---|
| Blueprint Cloudflare Security this skillreceptron/mulmoterminal | 237 | — | ~1.2k | Automated safety check: Notes | MIT | |
| Implementing Cloud Waf Rulesmukul975/Anthropic-Cybersecurity-Skills | 34k | — | ~2.9k | Automated safety check: Pass | Apache-2.0 | |
| Detecting SQL Injection Via Waf Logsmukul975/Anthropic-Cybersecurity-Skills | 34k | — | ~564 | Automated safety check: Pass | Apache-2.0 | |
| Hunt Cache Poisonelementalsouls/Claude-BugHunter | 4.8k | — | ~5.7k | Automated safety check: Pass | MIT | |
| Cloudflare Workers Securitysecondsky/claude-skills | 227 | — | ~1.9k | Automated safety check: Pass | MIT | |
| Cloudflare Browser Renderingcloudflare/moltworker | 10k | — | ~742 | Automated safety check: Pass | Apache-2.0 |
mukul975/Anthropic-Cybersecurity-Skills
Deploys and tunes Web Application Firewall rules on AWS WAF, Azure WAF, and Cloudflare, covering managed rule sets, custom business-logic rules, rate limiting, bot management, and false-positive…
mukul975/Anthropic-Cybersecurity-Skills
Analyze WAF (ModSecurity/AWS WAF/Cloudflare) logs to detect SQL injection attack campaigns.
elementalsouls/Claude-BugHunter
Hunting skill for cache poison vulnerabilities. An agent skill from elementalsouls/Claude-BugHunter.
secondsky/claude-skills
Cloudflare Workers security with authentication, CORS, rate limiting, input validation.
cloudflare/moltworker
Drives headless Chrome through Cloudflare Browser Rendering over a CDP WebSocket to take screenshots, navigate and scrape pages, and record multi-page videos.
hodgef/apiker
Comprehensive Cloudflare platform skill covering Workers, Pages, storage (KV, D1, R2), AI (Workers AI, Vectorize, Agents SDK), feature flags (Flagship), networking (Tunnel, Spectrum), security (WAF…
receptron/mulmoterminal
Help desk for "MulmoTerminal is broken". An agent skill from receptron/mulmoterminal.
receptron/mulmoterminal
Check what this project's humans have already been asked, and how they answered, before asking them something similar.
receptron/mulmoterminal
Decide which moments MulmoTerminal beeps or pushes for, and what each one plays — soundKinds, sounds and pushKinds in ~/.mulmoterminal/config.json, plus a per-project sound / sounds in…
receptron/mulmoterminal
Build a colour scheme of your own for MulmoTerminal — one that joins Midnight, Nord, Daylight and Solarized in Settings' theme picker and can then be pinned per project.
receptron/mulmoterminal
Answer each question from the named documents only, quoting where the answer is written, or saying plainly that the documents do not say — changing nothing yet.
receptron/mulmoterminal
Pair every article of the old version with its article in the new one, and say whether each changed, was added or was removed — writing .blueprint/comparison.json and changing no document.
Works with
Categories
Review the finished Worker against OWASP Top 10:2025, fix what is exploitable, prove each fix with a test, and report. Blueprint Cloudflare Security is an agent skill from receptron/mulmoterminal. Review the finished Worker against OWASP Top 10:2025, fix what is exploitable, prove each fix with a test, and report.
Blueprint Cloudflare Security fits situations like: tasks that involve Web application vulnerabilities.
Run `npx skills add receptron/mulmoterminal --skill blueprint-cloudflare-security -a claude-code`. Or copy the skill folder (blueprints/cloudflare/skills/security in receptron/mulmoterminal) into .claude/skills/blueprint-cloudflare-security in your project. Claude Code loads it when a task matches its description.
Run `npx skills add receptron/mulmoterminal --skill blueprint-cloudflare-security -a codex`. Or copy the skill folder (blueprints/cloudflare/skills/security in receptron/mulmoterminal) into .agents/skills/blueprint-cloudflare-security in your project. Codex loads it when a task matches its description.
Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add receptron/mulmoterminal --skill blueprint-cloudflare-security -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/blueprint-cloudflare-security, .gemini/skills/blueprint-cloudflare-security, .github/skills/blueprint-cloudflare-security and .opencode/skills/blueprint-cloudflare-security in your project.
Going by SKILL.md and its folder, Blueprint Cloudflare Security needs the command-line tools its instructions call (yarn, wrangler and git).
SKILL.md contains no URLs. Its commands use git, which can reach the network depending on how they are called. This is read from the text; nothing was executed.
Our automated static check of SKILL.md found notes only (mentions a .env file), nothing it rates as a warning. It is not a guarantee. Review the folder before installing.
Blueprint Cloudflare Security is published under the MIT licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.
About 1.2k tokens (SKILL.md is roughly 4.7k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.
Skills that share tags, products or a category with Blueprint Cloudflare Security: Implementing Cloud Waf Rules (mukul975/Anthropic-Cybersecurity-Skills, 34k stars), Detecting SQL Injection Via Waf Logs (mukul975/Anthropic-Cybersecurity-Skills, 34k stars), Hunt Cache Poison (elementalsouls/Claude-BugHunter, 4.8k stars) and Cloudflare Workers Security (secondsky/claude-skills, 227 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.
receptron (a GitHub organization) maintains it in receptron/mulmoterminal, which has 237 GitHub stars. The repository holds 30 skills in this directory. The repository was last updated on October 9, 2026.
Source: receptron/mulmoterminal on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.
