[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71CAVTN8JMNB0J5HMACZJYP":3,"skill-same:01M71CAVTN8JMNB0J5HMACZJYP":55},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":23,"linkOnly":24,"markdownContent":25,"markdownBody":26,"frontMatter":27,"refName":28,"commitSha":29,"skillDirectory":30,"forksCount":14,"repositoryHtmlUrl":31,"repositoryHomepageUrl":6,"ownerHtmlUrl":32,"ownerBlogUrl":6,"ownerDescription":33,"updatedAt":34,"install":35,"resources":48},"01M71CAVTN8JMNB0J5HMACZJYP","cloud-zerotrust-cloudflare",null,"Cloud Zerotrust Cloudflare.","DCx7C5\u002Fai-marketplace","DCx7C5","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42419559?v=4","01M71C01G2AZV3NTNGWAWSHJPP","DC","01M71C01GQW6G50S2BYMS7PP3E",0,"MIT","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fcloud-zerotrust-cloudflare\u002FSKILL.md",[],[19,20,21,22],"cloudflare","cloud","cloud zerotrust cloudflare","cybersecurity","2026-11-10 10:12:30",false,"---\nname: cloud-zerotrust-cloudflare\ndescription: \"Cloud Zerotrust Cloudflare.\"\ndomain: cybersecurity\n---\n\n|\n| Cloudflare Tunnel | Encrypted outbound-only connection from your infrastructure to Cloudflare's network, exposing internal services without opening inbound firewall ports |\n| Cloudflare Access | Identity-aware reverse proxy evaluating every request against access policies before granting access to protected applications |\n| WARP Client | Cloudflare's endpoint agent that routes device traffic through Cloudflare's network for policy enforcement and private network access |\n| Access Application | Configuration object defining a protected resource (self-hosted, SaaS, or infrastructure) with associated access policies |\n| Device Posture | Endpoint health signals (OS version, disk encryption, EDR status) evaluated as conditions in Access policies |\n| Cloudflare One | Unified SASE platform combining ZTNA (Access), SWG (Gateway), CASB, DLP, and RBI |\n\n## Tools & Systems\n\n- **Cloudflare Access**: Identity-aware application proxy providing per-request authorization\n- **Cloudflare Tunnel (cloudflared)**: Daemon creating encrypted tunnels from internal networks to Cloudflare edge\n- **WARP Client**: Cross-platform endpoint agent for device enrollment, DNS filtering, and private network routing\n- **Cloudflare Gateway**: Secure Web Gateway providing DNS\u002FHTTP filtering and DLP inspection\n- **Cloudflare Logpush**: Real-time log streaming to external SIEM and storage destinations\n- **Access for Infrastructure**: SSH and RDP access with short-lived certificates and session recording\n\n## Common Scenarios\n\n### Scenario: Startup with 200 Employees Deploying Zero Trust from Scratch\n\n**Context**: A SaaS startup with 200 employees and no existing VPN wants to provide secure access to internal tools (Grafana, internal APIs, staging environments) running on AWS. Budget is limited, and the team has no dedicated security staff.\n\n**Approach**:\n1. Start with Cloudflare Zero Trust free tier (up to 50 users) for proof of concept\n2. Deploy one `cloudflared` tunnel on an EC2 instance in the production VPC\n3. Expose Grafana, internal wiki, and staging apps through tunnel with DNS routing\n4. Configure Google Workspace as IdP for SSO authentication\n5. Create Access policies requiring @company.com email domain for all applications\n6. Add device posture checks for disk encryption and OS version\n7. Upgrade to paid plan and deploy WARP client to all employee laptops via MDM\n8. Enable Gateway DNS filtering and HTTP inspection for malware protection\n9. Configure Logpush to send access logs to Datadog for monitoring\n\n**Pitfalls**: Cloudflare root certificate must be installed on all devices for TLS inspection to work; some applications may break with TLS interception. Tunnel failover requires running multiple `cloudflared` instances or using Cloudflare's replicas feature. Access policies should always include a default deny rule. WebSocket applications may require specific tunnel configuration.\n\n## Output Format\n\n```\nCloudflare Zero Trust Deployment Report\n==================================================\nOrganization: StartupCorp\nTeam Name: startupcorp\nDeployment Date: 2026-02-23\n\nTUNNEL INFRASTRUCTURE:\n  Active Tunnels: 2 (primary + failover)\n  Tunnel Status: Healthy\n  Connected Edge: Washington DC, Ashburn\n  Ingress Routes: 8\n\nACCESS APPLICATIONS:\n  Self-Hosted Apps: 6\n  SaaS Apps: 3\n  SSH\u002FInfrastructure: 2\n  Total Policies: 15\n\nDEVICE ENROLLMENT:\n  Enrolled Devices: 187 \u002F 200\n  WARP Connected: 182 \u002F 187 (97.3%)\n  Posture Compliant: 175 \u002F 187 (93.6%)\n\nACCESS METRICS (last 30 days):\n  Total Requests: 89,432\n  Allowed: 88,756 (99.2%)\n  Blocked: 676 (0.8%)\n  Unique Users: 195\n  Countries: 12\n  Avg Session Duration: 6.2 hours\n```\n","|\n| Cloudflare Tunnel | Encrypted outbound-only connection from your infrastructure to Cloudflare's network, exposing internal services without opening inbound firewall ports |\n| Cloudflare Access | Identity-aware reverse proxy evaluating every request against access policies before granting access to protected applications |\n| WARP Client | Cloudflare's endpoint agent that routes device traffic through Cloudflare's network for policy enforcement and private network access |\n| Access Application | Configuration object defining a protected resource (self-hosted, SaaS, or infrastructure) with associated access policies |\n| Device Posture | Endpoint health signals (OS version, disk encryption, EDR status) evaluated as conditions in Access policies |\n| Cloudflare One | Unified SASE platform combining ZTNA (Access), SWG (Gateway), CASB, DLP, and RBI |\n\n## Tools & Systems\n\n- **Cloudflare Access**: Identity-aware application proxy providing per-request authorization\n- **Cloudflare Tunnel (cloudflared)**: Daemon creating encrypted tunnels from internal networks to Cloudflare edge\n- **WARP Client**: Cross-platform endpoint agent for device enrollment, DNS filtering, and private network routing\n- **Cloudflare Gateway**: Secure Web Gateway providing DNS\u002FHTTP filtering and DLP inspection\n- **Cloudflare Logpush**: Real-time log streaming to external SIEM and storage destinations\n- **Access for Infrastructure**: SSH and RDP access with short-lived certificates and session recording\n\n## Common Scenarios\n\n### Scenario: Startup with 200 Employees Deploying Zero Trust from Scratch\n\n**Context**: A SaaS startup with 200 employees and no existing VPN wants to provide secure access to internal tools (Grafana, internal APIs, staging environments) running on AWS. Budget is limited, and the team has no dedicated security staff.\n\n**Approach**:\n1. Start with Cloudflare Zero Trust free tier (up to 50 users) for proof of concept\n2. Deploy one `cloudflared` tunnel on an EC2 instance in the production VPC\n3. Expose Grafana, internal wiki, and staging apps through tunnel with DNS routing\n4. Configure Google Workspace as IdP for SSO authentication\n5. Create Access policies requiring @company.com email domain for all applications\n6. Add device posture checks for disk encryption and OS version\n7. Upgrade to paid plan and deploy WARP client to all employee laptops via MDM\n8. Enable Gateway DNS filtering and HTTP inspection for malware protection\n9. Configure Logpush to send access logs to Datadog for monitoring\n\n**Pitfalls**: Cloudflare root certificate must be installed on all devices for TLS inspection to work; some applications may break with TLS interception. Tunnel failover requires running multiple `cloudflared` instances or using Cloudflare's replicas feature. Access policies should always include a default deny rule. WebSocket applications may require specific tunnel configuration.\n\n## Output Format\n\n```\nCloudflare Zero Trust Deployment Report\n==================================================\nOrganization: StartupCorp\nTeam Name: startupcorp\nDeployment Date: 2026-02-23\n\nTUNNEL INFRASTRUCTURE:\n  Active Tunnels: 2 (primary + failover)\n  Tunnel Status: Healthy\n  Connected Edge: Washington DC, Ashburn\n  Ingress Routes: 8\n\nACCESS APPLICATIONS:\n  Self-Hosted Apps: 6\n  SaaS Apps: 3\n  SSH\u002FInfrastructure: 2\n  Total Policies: 15\n\nDEVICE ENROLLMENT:\n  Enrolled Devices: 187 \u002F 200\n  WARP Connected: 182 \u002F 187 (97.3%)\n  Posture Compliant: 175 \u002F 187 (93.6%)\n\nACCESS METRICS (last 30 days):\n  Total Requests: 89,432\n  Allowed: 88,756 (99.2%)\n  Blocked: 676 (0.8%)\n  Unique Users: 195\n  Countries: 12\n  Avg Session Duration: 6.2 hours\n```\n",{"name":5,"domain":22,"description":7},"main","a91f1293287ffa9f4f1b8f486cd6e835a1568c84","skills\u002Fcloud-zerotrust-cloudflare","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace","https:\u002F\u002Fgithub.com\u002FDCx7C5","#Python","2026-09-01 11:21:00",{"source":8,"skillName":5,"commands":36,"prompt":46,"zipAvailable":47},[37,40,43],{"tool":38,"command":39},"npx","npx skills add DCx7C5\u002Fai-marketplace --skill cloud-zerotrust-cloudflare",{"tool":41,"command":42},"bunx","bunx skills add DCx7C5\u002Fai-marketplace --skill cloud-zerotrust-cloudflare",{"tool":44,"command":45},"pnpm","pnpm dlx skills add DCx7C5\u002Fai-marketplace --skill cloud-zerotrust-cloudflare","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fcloud-zerotrust-cloudflare\u002FSKILL.md",true,[49],{"path":50,"resourceType":51,"resourceTypeDesc":52,"sizeBytes":53,"sourceHtmlUrl":54},"index.json","REFERENCE","参考文档",504,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fcloud-zerotrust-cloudflare\u002Findex.json",[56,81,104,126,148,164],{"skillNo":57,"name":58,"nameZh":6,"description":59,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":60,"categories":61,"keywords":62,"publishedAt":23},"01M71HAPZ01KQ30RKTB0FFSQ05","services-wmi-persistence-detect","Detect WMI event subscription persistence by enumerating ActiveScriptEventConsumer, CommandLineEventConsumer, and permanent subscriptions in the WMI repository.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fpersistence\u002Fdetect\u002FSKILL.md",[],[63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,22,80],"services","detect","services wmi persistence detect","wmi","persistence","de","cm","process","activescript","event","subscriptions","commandline-consumer","repository","subscription","event-subscription","t1546.003","forensics","process-forensics",{"skillNo":82,"name":83,"nameZh":6,"description":84,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":85,"categories":86,"keywords":87,"publishedAt":23},"01M71HAK6JTTTS229T17WJMMCG","services-wmi-exec-exploit","Perform lateral movement across Windows networks using WMI-based remote execution techniques including Impacket wmiexec.py, CrackMapExec, and native WMI commands for stealthy post-exploitation during red team engagements.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fexec\u002Fexploit\u002FSKILL.md",[],[88,63,89,66,90,91,92,22,93,94,95,96,97,98,68,99,100,101,102,103],"exploit","services wmi exec exploit","exec","remote","traffic","Bash","analysis","team","across","crackmapexec","native","command","lateral movement","read","lateral-movement","Impacket",{"skillNo":105,"name":106,"nameZh":6,"description":107,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":108,"categories":109,"keywords":110,"publishedAt":23},"01M71HAG6MHKNQV8KDZKMT4886","registry-artifact-extract","Extract and analyze Windows Registry hives to uncover user activity, installed software, autostart entries, and evidence of system compromise.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fregistry\u002Fartifact\u002Fextract\u002FSKILL.md",[],[111,112,113,114,115,116,22,93,117,94,118,119,68,101,120,121,122,123,124,125],"artifact","registry","registry artifact extract","extract","evidence-collection","artifact-analysis","collection","analyze","uncover","software","activity","digital-forensics","windows-registry","regripper","sonnet",{"skillNo":127,"name":128,"nameZh":6,"description":129,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":130,"categories":131,"keywords":132,"publishedAt":23},"01M71HACR4A8XTWTTSXK4124AA","processes-token-impersonate-detect","Detect Windows token impersonation and privilege abuse including SeImpersonatePrivilege exploitation via Potato attacks and token stealing techniques.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Ftoken\u002Fimpersonate\u002Fdetect\u002FSKILL.md",[],[64,133,134,135,136,137,138,69,139,22,80,140,141,142,143,144,145,146,147,68],"processes token impersonate detect","token","processes","attacks","windows","escalation","techniques","privilege-escalation","seimpersonate","token-impersonation","printspoofer","exploitation","potato","impersonation","via",{"skillNo":149,"name":150,"nameZh":6,"description":151,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":152,"categories":153,"keywords":154,"publishedAt":23},"01M71HAABSB4Z6QFSXEG00R4RK","processes-thread-injection-detect","Detect Windows thread injection techniques including CreateRemoteThread, QueueUserAPC, NtCreateThreadEx, and thread hijacking via process memory analysis.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fthread\u002Finjection\u002Fdetect\u002FSKILL.md",[],[155,156,64,157,135,137,158,69,159,139,22,80,94,160,161,162,163,147,68,70],"thread","processes thread injection detect","injection","memory","process-injection","api","apc-injection","thread-injection","nt-api",{"skillNo":165,"name":166,"nameZh":6,"description":167,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":168,"categories":169,"keywords":170,"publishedAt":23},"01M71HA7H311V5G14WMX58HQSS","processes-hollow-technique-detect","Detect process hollowing (RunPE) by identifying processes with mismatched image paths between PEB and VAD tree, or unmapped PE headers in memory.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fhollow\u002Ftechnique\u002Fdetect\u002FSKILL.md",[],[171,64,135,172,158,69,173,174,22,80,175,176,177,178,179,180,68,70,181,182],"processes hollow technique detect","tree","memory-forensics","process-hollow","peb","runpe","image","pe-header","in memory","with","mismatched","headers"]