PlugWiki

Cloudflare One Migrations Skill for Claude: Plan a Move from Zscaler or Palo Alto

Makes Claude assess and plan a migration from Zscaler, Palo Alto or a legacy VPN to Cloudflare One, rule by rule.

Installs
95K
on skills.sh
Stars
3.2K
on GitHub
Files
1
besides SKILL.md
Updated
Oct 2026
last repo commit

cloudflare-one-migrations makes Claude plan a move to Cloudflare One. It asks for structured exports from your current stack, builds an inventory, maps each source rule to a Cloudflare resource with a confidence level, and lists what is partial or not migrated. It covers Zscaler ZIA and ZPA, Palo Alto and Prisma, and legacy VPN, SWG and SD-WAN setups.

The skill stages changes safely: a migration prefix, rules created disabled or in audit mode, pilots first, and log comparison before wider rollout. It tells Claude to retrieve current Cloudflare docs and API schemas before generating exact configuration. The folder has one reference file for skill feedback and no scripts.

Good for

  • Network and security engineers leaving Zscaler or Palo Alto
  • IT teams replacing a legacy VPN or secure web gateway
  • Consultants writing a migration assessment for a client

Install cloudflare-one-migrations

Claude Code

  1. 1

    Copy this prompt.

    Install the cloudflare-one-migrations skill in Claude Code. Run this command:

npx skills add https://github.com/cloudflare/skills --skill cloudflare-one-migrations

Then check that it loaded and tell me how to use it.
  2. 2

    Paste it into Claude Code. It shows the change and asks before running it.

Requires Node.js.

The README says the plugin installs Cloudflare guidance and the Cloudflare MCP server together, and that agents which only support the Agent Skills standard can install the skills separately. The skills CLI route installs no MCP server.

From the vendor's docs. Source.

What's in the skill

When it loads

Assess and plan migrations from existing VPN, SWG, or SASE platforms to Cloudflare One, including policy mapping, parity gaps, and rollout.

Sections in SKILL.md

  1. Workflow
  2. Exports To Ask For
  3. Mapping Heuristics
  4. Migration Assessment Prompts
  5. Source-Specific Traps
  6. Zscaler ZIA / SWG
  7. Zscaler ZPA / Private Access
  8. Palo Alto / Prisma / NGFW
  9. Gotchas
  10. Validation Gates
  11. Assessment Template
  12. Migration Assessment
  13. Skill feedback

Key facts

Author
Cloudflare (cloudflare/skills)
Repository
cloudflare/skills
Installs on skills.sh
95,036 (crawled 2026-11-02)
GitHub stars
3,244 (whole repo)
License
Apache-2.0
Last repo commit
2026-10-31
Files in the skill folder
2 files: SKILL.md and references/skill-feedback.md. No scripts.
skills.sh audits
Gen Agent Trust Hub: pass, Socket: pass, Snyk: pass
Works in (per README)
Claude Code, Codex, VS Code with GitHub Copilot, Cursor and other agents

What it includes

  • Identify the source, request exports, inventory, map, build dependencies, stage, account

    Workflow (7 steps)

  • Lists what to export from Zscaler ZIA, ZPA and Palo Alto or Prisma

    Exports to ask for

  • Where ZIA, ZPA, Palo Alto and VPN features usually land in Cloudflare One

    Mapping heuristics

  • Source coverage, rule volume, identity, TLS/DLP, connectivity and rollout readiness

    Assessment prompts

  • Known pitfalls for ZIA/SWG, ZPA and Palo Alto migrations

    Source-specific traps

  • Count checks per stage, review of partial mappings, pilot tests, rollback paths

    Validation gates

  • A fill-in Markdown template from source stack to rollback

    Assessment template

  • Drafts a public GitHub issue for the skill only after you approve the exact text

    Network · Skill feedback

From the official docs

Permissions

Medium risk

The skill tells Claude to create Cloudflare resources such as tunnels, Access apps and Gateway policies, and security rules are easy to get wrong. Give your agent read-only Cloudflare access while you review the mapping, and enable rules only after pilot checks.

What it can do

  • Read your data
  • Create and change things
  • Delete things
  • Read-only mode

Watch out for

  • It plans changes to security policy

    SKILL.md says to create rules disabled or in audit mode by default and to stage them with a prefix. Keep that default and review every partial or manual-review item before enabling anything.

  • It may post a public GitHub issue

    The skill-feedback step only runs after you approve the exact title and body. Decline if the report would reveal anything about your environment.

  • It asks for rule exports and logs

    Exports can hold internal hostnames, users and IP addresses. Share only what the mapping needs.

  • The plugin route also adds the Cloudflare MCP server

    The README says the plugin includes Cloudflare's main remote MCP server, and the repo's .mcp.json points it at https://mcp.cloudflare.com/mcp. The skills CLI route installs the skill without it.

Technical details
Talks toCloudflare docs and API (retrieved before generating configuration). github.com (only if you approve a feedback issue)
Scopes

  • Cloudflare account access, if you give your agent any

Questions

What does the cloudflare-one-migrations skill do?

It makes Claude plan a migration to Cloudflare One. Claude collects exports, inventories rules, maps each one to a Cloudflare resource, flags unsupported or partial mappings and sets up a staged rollout with validation gates.

How do I install it?

Use the install box at the top of this page. The Cloudflare README also documents plugin installs for Claude Code and Codex, VS Code, Cursor and a manual copy into your agent's skills folder.

Which source platforms does it cover?

SKILL.md names Zscaler ZIA, Zscaler ZPA, Palo Alto NGFW, Prisma and GlobalProtect, and legacy VPN, SWG and SD-WAN setups, with a section of traps for each of the first three.

Will it change my Cloudflare account?

SKILL.md has Claude create dependencies and rules in an order, with disabled or audit-mode rules by default and a migration prefix. Whether it can write depends on the Cloudflare access you give your agent, so keep that to read-only until you review the plan.

Is it safe?

It bundles no scripts. Its skill-feedback step drafts a public GitHub issue, and the reference file says never to post it until you have seen the exact title and body and approved it, and to strip credentials, account IDs and customer data first.

How is it different from the cloudflare-one skill?

The Cloudflare README lists cloudflare-one for designing, configuring and troubleshooting Cloudflare One deployments, and cloudflare-one-migrations for migration assessments, policy mapping and rollout plans.

Information

updated Nov 2, 2026

Repository
cloudflare/skills
Folder
skills/cloudflare-one-migrations

cloudflare/skillsskills.sh

Sources

Docs, issue trackers and discussions this page is built from.

Show all 5
  1. cloudflare/skills README · github.com
  2. .mcp.json · github.com
  3. skills CLI commands · github.com
  4. cloudflare-one-migrations SKILL.md · github.com
  5. skill-feedback.md · github.com

Updated Nov 2, 2026.