Cloudflare Skills
cloudflare/skillsCloudflare's official 19-skill pack for building on Workers, Durable Objects, the Agents SDK, Cloudflare One and more, with an optional bundled MCP server.
Generates an interactive bash script that walks a human through manual steps such as provisioning, credentials and CI secrets, writing values to .env and GitHub secrets.
A practical idea executed with a reusable template and sensible limits (the agent does not run the wizard or invent steps).
wizard is for procedures only a person can perform: provisioning infrastructure, collecting credentials, clicking through an unfamiliar third-party dashboard, or running a one-off migration. The agent first reads the repo (.env.example, README, docker-compose, framework config and every secrets or vars reference in GitHub workflows) to list the stages and the values each produces, confirms that list with you, and traces the exact path for each stage, such as which URL to open and where a value is shown. It must not invent steps it does not know.
It then copies template.sh and writes only the stage section. The template library is fixed and provides stage-by-stage progress with screen clearing, confirmation gates, cross-platform URL opening including WSL, hidden entry for secrets, idempotent .env updates, gh secret and gh variable writes, and a closing summary. The agent verifies with bash -n and shellcheck if available, makes the script executable and does not run it end to end itself, because it opens browsers and asks for secrets. Wizards are ephemeral by default and committed only if you want a repeatable setup. The skill is about 4.7 KB plus the template script.
A 4.7 KB SKILL.md plus a substantial shell template library, but no tests or evals.
The skill splits the work into four phases. Each phase ends with a stated "done when" condition, which tells you when the agent is ready to move on.
.env, .env.example, .env.*, the README, docker-compose*, framework config and .github/workflows/*. For a migration or cutover, it works out the current state, the target state and the irreversible actions between them. It then shows you the ordered stages. You can add, drop or reorder them. This phase is done when the agent knows three things about every captured value: where you get it, where it is written (.env, a GitHub secret, both, or nowhere, since some stages are pure actions), and whether it is secret or public.template.sh to the target path and replaces the example stage with one stage per step, in dependency order. It also sets TOTAL_STAGES to match the number of stages.Example requests that fit the skill's description:
You will get better results if you correct the stage list in phase 1. That is the point where the agent asks you to confirm, and every later phase builds on that list.
The skill folder holds three files: SKILL.md, agents/openai.yaml and template.sh. Everything above the STAGES marker in template.sh is the same library in every wizard. The skill tells the agent never to hand-edit it. The agent writes only the stage section, using these helpers:
| Helper | Purpose in a stage |
|---|---|
stage |
Starts a new stage and clears the screen so only the current step shows |
say / step |
Prints instructions to the person running the script |
open_url |
Opens a page in the browser, including under WSL |
ask |
Reads a visible, non-secret value |
ask_secret |
Reads a value with hidden entry |
write_env |
Writes a value into .env without duplicating it |
set_secret / set_var |
Writes a GitHub secret or variable through gh |
pause / confirm |
Waits for the person, or asks for confirmation before continuing |
The skill also sets rules for using these helpers:
ask_secret for anything secret.write_env for every value that should persist.set_secret only for values CI actually needs, not for every captured value.confirm before any irreversible action.A wizard is a bash script, so you need bash. The GitHub CLI (gh) is optional and only matters for stages that write secrets or variables. Without it, values can still go to .env. If shellcheck is installed, the agent runs it during verification. If not, the agent relies on bash -n alone.
The agent does not run the finished wizard itself. Instead it traces the script statically. Every value from the scoping phase must be captured and end up where that phase said it would. Every set_secret name must exactly match a secrets.* reference in the CI workflows. You can repeat that check yourself before you run anything. Open the stage section, list each set_secret name, and search .github/workflows/ for the same names. A mismatch means CI will look for a secret the wizard never created.
The template's comments describe how ask behaves on re-runs. It offers the existing .env value as the default, so pressing Enter keeps it. Together with idempotent .env writes, this makes it reasonable to run a wizard a second time after you fix one stage. The same comment says ask fails at end of input when it gets nothing. Run the script in an interactive terminal, not with piped or redirected input.
If you commit a wizard as the repeatable setup path, the skill suggests linking it from the README. That way the next person runs the script instead of asking an AI to explain the setup again.
Skill for generating interactive bash wizards that walk you through manual setup steps such as collecting API keys and setting CI secrets. The shared template reads and writes your .env file and can set GitHub Actions secrets for the current repo through gh, and the agent authors the stages and URLs for each wizard, so read a generated wizard before you run it. The template itself makes no hidden network calls.
gh secret set, gh variable set) using your gh login; gh is not part of the skill.template.sh:157The skill folder (3 files) on Oct 29, 2026. Not a full review: it relies on code outside the repository: gh (GitHub CLI) invoked by set_secret / set_var.
NVIDIA SkillSpector static scan: 2 pattern hits (Privilege Escalation 1, MCP Least Privilege 1). The SkillSpector credential hit (template.sh:106) is a comment about reading the existing .env value as an input default; the 'no tool scope' hit is because the template reads and writes env files. Secrets are read with hidden input, written only to the local .env and to the repo's own GitHub secrets, and are not sent to any other host.
A review, not a certification. Skills change after we check them — read the files before installing.
MIT — commercial use allowed (stated for the parent repository).
Not really. Wizards exist for steps that need a human present.
Cloudflare's official 19-skill pack for building on Workers, Durable Objects, the Agents SDK, Cloudflare One and more, with an optional bundled MCP server.
Supabase's official skills: a general Supabase skill for Auth, RLS, CLI and MCP, and a Postgres best-practices skill with 34 rule files.
Neon's official skills for Lakebase Postgres and its Auth, Functions, Object Storage, AI Gateway and Realtime services, with branch-first workflows and evals.
A 15-skill development methodology that makes coding agents clarify the goal, write a plan, work through it with subagents and verify before calling it done.
wizard is a Matt Pocock skill that creates an interactive bash script for manual setup procedures. The script opens each URL, tells you what to copy, stores values in .env or GitHub secrets, and confirms each stage.
Install mattpocock/skills with claude plugin install mattpocock-skills@claude-plugins-official or npx skills@latest add mattpocock/skills, then ask for a wizard for the procedure you need.
The skill tells the agent not to run the generated script itself. You should read the generated script before running it, since it can write secrets to .env and GitHub.
They are ephemeral by default, saved to a scratch or scripts path and deleted after the job. You commit one only if you want a repeatable setup path in the repo.
The skill says no. The library above the STAGES marker should stay identical in every wizard, and the agent only writes the stage section. Changes belong in the stages, built from the provided helpers.
According to the template's comments, ask offers the value already in .env as the default, and pressing Enter keeps it. .env writes are idempotent, so re-running a wizard after fixing one stage should not duplicate entries.
Only for stages that write GitHub secrets or variables through set_secret or set_var. Stages that write to .env or that are pure actions need only bash.