@olegkoval/agent-skills 1.5.0 → 1.6.0

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "olko-agent-skills",
   "description": "Agent-agnostic skill catalog for Codex, Claude, Cursor, and other skill-aware tools.",
-  "version": "1.4.0",
+  "version": "1.5.1",
   "author": {
     "name": "Oleg Koval"
   },
@@ -23,6 +23,7 @@
     "./packages/software-development/starter-rules",
     "./packages/software-development/open-source-publisher",
     "./packages/marketing/viral-launch",
-    "./packages/marketing/search-console-indexing-audit"
+    "./packages/marketing/search-console-indexing-audit",
+    "./packages/software-development/cloudflare-block-countries"
   ]
 }

package/.cursor-plugin/index.json

@@ -75,6 +75,11 @@
       "name": "olko:search-console-indexing-audit",
       "source": "./packages/marketing/search-console-indexing-audit/adapters/cursor",
       "description": "Analyze Google Search Console Coverage CSV exports and correlate them with sitemap, robots, canonical, redirect, and noindex signals."
+    },
+    {
+      "name": "olko:cloudflare-block-countries",
+      "source": "./packages/software-development/cloudflare-block-countries/adapters/cursor",
+      "description": "Block specific countries via Cloudflare WAF Custom Rules using the Cloudflare API. Handles creating new rulesets and updating existing ones across single or multiple zones."
     }
   ]
 }

package/README.md

@@ -53,14 +53,7 @@ Use the olko:semantic-release-beta skill to add prereleases on a beta branch.
 
 The repository includes a generated Claude marketplace manifest at `.claude-plugin/marketplace.json`.
 
-For local development, clone the repo and point Claude Code at the plugin directory:
-
-```bash
-git clone https://github.com/oleg-koval/agent-skills.git
-claude --plugin-dir /path/to/agent-skills
-```
-
-If your Claude Code environment supports GitHub marketplace installs for this repo, add the marketplace source first:
+**For marketplace installs:**
 
 ```text
 /plugin marketplace add oleg-koval/agent-skills
@@ -72,7 +65,16 @@ Then install the catalog plugin:
 /plugin install olko-agent-skills@olko-agent-skills
 ```
 
-Live Claude marketplace install is not yet validated for this repo.
+**For local development:**
+
+Clone the repo and point Claude Code at the plugin directory:
+
+```bash
+git clone https://github.com/oleg-koval/agent-skills.git
+claude --plugin-dir /path/to/agent-skills
+```
+
+See [Publishing to Marketplaces](#publishing-to-marketplaces) below for full submission details.
 
 </details>
 
@@ -81,7 +83,15 @@ Live Claude marketplace install is not yet validated for this repo.
 
 The repository includes a generated Cursor plugin index at `.cursor-plugin/index.json` and per-package Cursor adapters under `packages/*/*/adapters/cursor/`.
 
-For a single project, copy the relevant `SKILL.md` or adapter content into `.cursor/rules/`, or reference the full package directory from your Cursor rules.
+**For plugin marketplace:**
+
+Install from Cursor's extension marketplace using the published repository.
+
+**For a single project:**
+
+Copy the relevant `SKILL.md` or adapter content into `.cursor/rules/`, or reference the full package directory from your Cursor rules.
+
+See [Publishing to Marketplaces](#publishing-to-marketplaces) for registry submission.
 
 </details>
 
@@ -95,7 +105,15 @@ Use the generated repository instructions and prompt files:
 .github/prompts/*.prompt.md
 ```
 
-These files are generated from `catalog/skills.json` and can be copied into a repository that should use the same skill guidance.
+**To use in your GitHub workspace:**
+
+Copy `.github/copilot-instructions.md` to your repository and enable Copilot. It will automatically apply skill guidance.
+
+**To customize per-skill:**
+
+Use files from `.github/prompts/*.prompt.md` in your Copilot configuration.
+
+See [Publishing to Marketplaces](#publishing-to-marketplaces) for integration details.
 
 </details>
 
@@ -269,38 +287,119 @@ Use the olko:docs-index-keeper skill to set up docs index automation in this rep
 Use the olko:semantic-release-beta skill to add prereleases on a beta branch.
 ```
 
-### Claude
+Status: **Stable** — ready for daily use
 
-The repository includes a generated root manifest at `.claude-plugin/marketplace.json` and per-package Claude adapter stubs under `packages/*/*/adapters/claude/`.
+### Claude Code
 
-Current status:
+The repository includes a generated marketplace manifest at `.claude-plugin/marketplace.json` and per-package Claude adapter stubs under `packages/*/*/adapters/claude/`.
 
-- suitable for local packaging and iteration
-- not yet validated against a live Claude marketplace install flow
+**Local development:**
+
+```bash
+git clone https://github.com/oleg-koval/agent-skills.git
+claude --plugin-dir /path/to/agent-skills
+```
+
+**Marketplace installation:**
+
+See [Publishing to Marketplaces → Claude Marketplace](#claude-marketplace) for submission and user installation instructions.
+
+Status: **Ready for marketplace** — fully generated manifests, ready to publish
 
 ### Cursor
 
-The repository includes a generated root plugin index at `.cursor-plugin/index.json` and per-package Cursor adapter stubs under `packages/*/*/adapters/cursor/`.
+The repository includes a generated plugin index at `.cursor-plugin/index.json` and per-package Cursor adapter stubs under `packages/*/*/adapters/cursor/`.
 
-Current status:
+See [Publishing to Marketplaces → Cursor Plugin Registry](#cursor-plugin-registry) for submission instructions.
 
-- suitable for local packaging and iteration
-- not yet validated against a live Cursor plugin install flow
+Status: **Ready for marketplace** — plugin index generated and ready to submit
 
 ### GitHub Copilot
 
-The repository includes generated Copilot repository instructions at `.github/copilot-instructions.md` and one reusable prompt file per skill under `.github/prompts/`.
+The repository includes generated repository instructions at `.github/copilot-instructions.md` and per-skill prompt files under `.github/prompts/`.
+
+To use in your GitHub workspace, copy `.github/copilot-instructions.md` to your repository.
 
-Current status:
+See [Publishing to Marketplaces → GitHub Copilot](#github-copilot) for integration details.
 
-- suitable for repository-level Copilot customization
-- generated from the canonical package catalog
-- not yet validated against GitHub Copilot in a live GitHub workspace
+Status: **Ready to use** — copy instructions to any GitHub repository
 
 ### Source sync
 
 `./scripts/sync-from-sources.sh` syncs package content only for catalog entries that explicitly define `sourcePath`. If no package has `sourcePath`, the script exits successfully and reports that there is nothing to sync.
 
+## Publishing to Marketplaces
+
+### Claude Marketplace
+
+The repository includes a generated marketplace manifest at `.claude-plugin/marketplace.json` that is compatible with Claude Code's plugin system.
+
+**To submit to Claude marketplace:**
+
+1. Ensure the repository is public and contains this structure:
+   ```
+   ├── .claude-plugin/
+   │   └── marketplace.json    # Generated from catalog/skills.json
+   └── packages/
+       └── {category}/{skill}/
+           ├── SKILL.md        # Required canonical definition
+           └── adapters/
+               └── claude/     # Optional Claude-specific wrapper
+   ```
+
+2. Push to GitHub with a public repository:
+   ```bash
+   git push origin main
+   ```
+
+3. Submit the repository URL to Claude's plugin marketplace:
+   - In Claude Code: `/plugin marketplace add oleg-koval/agent-skills`
+   - Or visit the Claude plugin marketplace and add `https://github.com/oleg-koval/agent-skills`
+
+4. The marketplace will:
+   - Read `.claude-plugin/marketplace.json` for plugin metadata
+   - Index all skills from `catalog/skills.json`
+   - Auto-register skills by their `name` field
+   - Use `adapters: ["claude"]` entries to provide Claude-specific hints
+
+**After publishing:**
+- Users install with: `/plugin install olko-agent-skills@olko-agent-skills`
+- All 12 skills become available as `olko:*` lookup names in Claude Code
+
+### Cursor Plugin Registry
+
+Cursor plugin index is generated at `.cursor-plugin/index.json`.
+
+**To submit to Cursor:**
+
+1. Ensure Cursor plugin metadata is present:
+   - `.cursor-plugin/index.json` (generated)
+   - `packages/*/*/adapters/cursor/` (optional Cursor-specific guidance)
+
+2. Submit the repository to Cursor's plugin marketplace with the `.cursor-plugin/` manifest
+
+3. Users install from Cursor's extension marketplace and reference skills by lookup name
+
+### GitHub Copilot
+
+Generated Copilot instructions are at `.github/copilot-instructions.md` and per-skill prompts under `.github/prompts/`.
+
+**To use in a GitHub workspace:**
+
+1. Copy `.github/copilot-instructions.md` to your repository
+2. Copilot reads this file automatically when enabled
+3. Per-skill prompts can be referenced or imported into custom Copilot configurations
+
+### Codex
+
+Codex installation uses symlinks:
+
+```bash
+./scripts/install-codex-symlinks.sh
+```
+
+Codex looks up skills by `olko:*` lookup names from the installed symlink directories.
+
 ## Local validation
 
 Rebuild generated manifests:
@@ -315,6 +414,12 @@ Validate the neutral catalog and generated root manifests:
 ./scripts/validate-catalog.sh
 ```
 
+Run both before pushing marketplace updates:
+
+```bash
+./scripts/build-adapters.sh && ./scripts/validate-catalog.sh
+```
+
 ## Smoke-tested workflows
 
 The following package workflows have been smoke-tested locally before first push:

package/catalog/skills.json

@@ -306,6 +306,26 @@
         "cursor",
         "copilot"
       ]
+    },
+    {
+      "name": "cloudflare-block-countries",
+      "lookupName": "olko:cloudflare-block-countries",
+      "category": "software-development",
+      "path": "packages/software-development/cloudflare-block-countries",
+      "description": "Block specific countries via Cloudflare WAF Custom Rules using the Cloudflare API. Handles creating new rulesets and updating existing ones across single or multiple zones.",
+      "tags": [
+        "cloudflare",
+        "waf",
+        "security",
+        "geo-blocking",
+        "firewall"
+      ],
+      "adapters": [
+        "codex",
+        "claude",
+        "cursor",
+        "copilot"
+      ]
     }
   ]
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@olegkoval/agent-skills",
-  "version": "1.5.0",
+  "version": "1.6.0",
   "private": false,
   "publishConfig": {
     "access": "public"

package/packages/software-development/cloudflare-block-countries/SKILL.md

@@ -0,0 +1,175 @@
+---
+name: cloudflare-block-countries
+description: 'Block specific countries via Cloudflare WAF Custom Rules using the Cloudflare API. Use when user wants to geo-block traffic, block countries in Cloudflare, set up WAF country rules, or mentions blocking regions. Handles both creating new rulesets and updating existing ones.'
+license: MIT
+allowed-tools: Bash
+compatibility: Codex, Claude Code, Cursor, and other Agent Skills compatible tools. Requires curl and jq.
+metadata:
+  author: Oleg Koval
+  tags:
+    - cloudflare
+    - waf
+    - security
+    - geo-blocking
+    - firewall
+---
+
+# Cloudflare Country Block via WAF Custom Rules
+
+Block traffic from specific countries using Cloudflare WAF Custom Rules and the Cloudflare API.
+
+## Prerequisites
+
+- Cloudflare API Token with `Zone:Rulesets:Edit` permission
+- Zone ID for the target domain
+- `curl` and `jq` installed
+
+## Workflow
+
+### 1. Get Zone IDs
+
+```bash
+curl -s -X GET \
+  "https://api.cloudflare.com/client/v4/zones?account.id=YOUR_ACCOUNT_ID&status=active" \
+  -H "Authorization: Bearer YOUR_API_TOKEN" \
+  -H "Content-Type: application/json" | jq '.result[] | {name: .name, id: .id}'
+```
+
+### 2. Check Existing Custom Firewall Rulesets
+
+```bash
+curl -s -X GET \
+  "https://api.cloudflare.com/client/v4/zones/YOUR_ZONE_ID/rulesets" \
+  -H "Authorization: Bearer YOUR_API_TOKEN" \
+  -H "Content-Type: application/json" | \
+  jq '.result[] | select(.phase == "http_request_firewall_custom")'
+```
+
+If the output is empty — no existing ruleset. Go to **3a**. If a ruleset exists, note its `id` and go to **3b**.
+
+### 3a. Create NEW Ruleset with Block Rule
+
+```bash
+curl -s -X POST \
+  "https://api.cloudflare.com/client/v4/zones/YOUR_ZONE_ID/rulesets" \
+  -H "Authorization: Bearer YOUR_API_TOKEN" \
+  -H "Content-Type: application/json" \
+  --data '{
+    "name": "default",
+    "description": "WAF Custom Rules",
+    "kind": "zone",
+    "phase": "http_request_firewall_custom",
+    "rules": [
+      {
+        "action": "block",
+        "description": "Block traffic from sanctioned countries",
+        "enabled": true,
+        "expression": "(ip.src.country in {\"RU\" \"BY\" \"IR\" \"KP\"})"
+      }
+    ]
+  }' | jq '.success'
+```
+
+### 3b. Update EXISTING Ruleset
+
+```bash
+curl -s -X PUT \
+  "https://api.cloudflare.com/client/v4/zones/YOUR_ZONE_ID/rulesets/RULESET_ID" \
+  -H "Authorization: Bearer YOUR_API_TOKEN" \
+  -H "Content-Type: application/json" \
+  --data '{
+    "description": "WAF Custom Rules",
+    "rules": [
+      {
+        "action": "block",
+        "description": "Block traffic from sanctioned countries",
+        "enabled": true,
+        "expression": "(ip.src.country in {\"RU\" \"BY\" \"IR\" \"KP\"})"
+      }
+    ]
+  }' | jq '.success'
+```
+
+### 4. Verify the Rule is Active
+
+```bash
+curl -s -X GET \
+  "https://api.cloudflare.com/client/v4/zones/YOUR_ZONE_ID/rulesets/RULESET_ID" \
+  -H "Authorization: Bearer YOUR_API_TOKEN" \
+  -H "Content-Type: application/json" | jq '.result.rules'
+```
+
+## Country Codes Reference
+
+| Code | Country |
+|------|---------|
+| `RU` | Russia |
+| `BY` | Belarus |
+| `IR` | Iran |
+| `KP` | North Korea |
+| `CN` | China |
+| `CU` | Cuba |
+| `SY` | Syria |
+| `VE` | Venezuela |
+
+## WAF Expression Examples
+
+```
+# Block multiple countries
+(ip.src.country in {"RU" "BY" "IR" "KP"})
+
+# Block country + specific ASN
+(ip.src.country eq "RU") or (ip.geoip.asnum eq 12345)
+
+# Block all except allowlisted IPs
+(ip.src.country in {"RU" "BY"}) and not (ip.src in {1.2.3.4/32})
+```
+
+## Multi-Zone Script
+
+To apply the same block rule across multiple zones:
+
+```bash
+#!/usr/bin/env bash
+API_TOKEN="YOUR_API_TOKEN"
+ZONES=("ZONE_ID_1" "ZONE_ID_2" "ZONE_ID_3")
+EXPRESSION='(ip.src.country in {"RU" "BY" "IR" "KP"})'
+
+for ZONE_ID in "${ZONES[@]}"; do
+  EXISTING=$(curl -s -X GET \
+    "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/rulesets" \
+    -H "Authorization: Bearer $API_TOKEN" \
+    -H "Content-Type: application/json" | \
+    jq -r '.result[] | select(.phase == "http_request_firewall_custom") | .id')
+
+  if [ -z "$EXISTING" ]; then
+    METHOD="POST"
+    URL="https://api.cloudflare.com/client/v4/zones/$ZONE_ID/rulesets"
+    DATA=$(jq -n --arg expr "$EXPRESSION" '{
+      name: "default", description: "WAF Custom Rules",
+      kind: "zone", phase: "http_request_firewall_custom",
+      rules: [{action: "block", description: "Block sanctioned countries", enabled: true, expression: $expr}]
+    }')
+  else
+    METHOD="PUT"
+    URL="https://api.cloudflare.com/client/v4/zones/$ZONE_ID/rulesets/$EXISTING"
+    DATA=$(jq -n --arg expr "$EXPRESSION" '{
+      description: "WAF Custom Rules",
+      rules: [{action: "block", description: "Block sanctioned countries", enabled: true, expression: $expr}]
+    }')
+  fi
+
+  RESULT=$(curl -s -X "$METHOD" "$URL" \
+    -H "Authorization: Bearer $API_TOKEN" \
+    -H "Content-Type: application/json" \
+    --data "$DATA" | jq '.success')
+
+  echo "Zone $ZONE_ID: $RESULT"
+done
+```
+
+## Notes
+
+- `PUT` on an existing ruleset **replaces all rules** in it. Include all rules in the payload if the ruleset already has other rules.
+- WAF Custom Rules require a Cloudflare plan that supports rulesets (Free includes basic WAF; Pro/Business/Enterprise for full custom rules).
+- Changes are applied globally within seconds; no cache purge needed.

package/packages/software-development/cloudflare-block-countries/adapters/claude/plugin.json

@@ -0,0 +1,5 @@
+{
+  "name": "olko-cloudflare-block-countries",
+  "description": "Block specific countries via Cloudflare WAF Custom Rules using the Cloudflare API. Handles creating new rulesets and updating existing ones across single or multiple zones.",
+  "skills": "./skills"
+}

package/packages/software-development/cloudflare-block-countries/adapters/claude/skills/cloudflare-block-countries/SKILL.md

@@ -0,0 +1,177 @@
+<!-- Generated by scripts/build-adapters.sh. Do not edit directly. -->
+
+---
+name: cloudflare-block-countries
+description: 'Block specific countries via Cloudflare WAF Custom Rules using the Cloudflare API. Use when user wants to geo-block traffic, block countries in Cloudflare, set up WAF country rules, or mentions blocking regions. Handles both creating new rulesets and updating existing ones.'
+license: MIT
+allowed-tools: Bash
+compatibility: Codex, Claude Code, Cursor, and other Agent Skills compatible tools. Requires curl and jq.
+metadata:
+  author: Oleg Koval
+  tags:
+    - cloudflare
+    - waf
+    - security
+    - geo-blocking
+    - firewall
+---
+
+# Cloudflare Country Block via WAF Custom Rules
+
+Block traffic from specific countries using Cloudflare WAF Custom Rules and the Cloudflare API.
+
+## Prerequisites
+
+- Cloudflare API Token with `Zone:Rulesets:Edit` permission
+- Zone ID for the target domain
+- `curl` and `jq` installed
+
+## Workflow
+
+### 1. Get Zone IDs
+
+```bash
+curl -s -X GET \
+  "https://api.cloudflare.com/client/v4/zones?account.id=YOUR_ACCOUNT_ID&status=active" \
+  -H "Authorization: Bearer YOUR_API_TOKEN" \
+  -H "Content-Type: application/json" | jq '.result[] | {name: .name, id: .id}'
+```
+
+### 2. Check Existing Custom Firewall Rulesets
+
+```bash
+curl -s -X GET \
+  "https://api.cloudflare.com/client/v4/zones/YOUR_ZONE_ID/rulesets" \
+  -H "Authorization: Bearer YOUR_API_TOKEN" \
+  -H "Content-Type: application/json" | \
+  jq '.result[] | select(.phase == "http_request_firewall_custom")'
+```
+
+If the output is empty — no existing ruleset. Go to **3a**. If a ruleset exists, note its `id` and go to **3b**.
+
+### 3a. Create NEW Ruleset with Block Rule
+
+```bash
+curl -s -X POST \
+  "https://api.cloudflare.com/client/v4/zones/YOUR_ZONE_ID/rulesets" \
+  -H "Authorization: Bearer YOUR_API_TOKEN" \
+  -H "Content-Type: application/json" \
+  --data '{
+    "name": "default",
+    "description": "WAF Custom Rules",
+    "kind": "zone",
+    "phase": "http_request_firewall_custom",
+    "rules": [
+      {
+        "action": "block",
+        "description": "Block traffic from sanctioned countries",
+        "enabled": true,
+        "expression": "(ip.src.country in {\"RU\" \"BY\" \"IR\" \"KP\"})"
+      }
+    ]
+  }' | jq '.success'
+```
+
+### 3b. Update EXISTING Ruleset
+
+```bash
+curl -s -X PUT \
+  "https://api.cloudflare.com/client/v4/zones/YOUR_ZONE_ID/rulesets/RULESET_ID" \
+  -H "Authorization: Bearer YOUR_API_TOKEN" \
+  -H "Content-Type: application/json" \
+  --data '{
+    "description": "WAF Custom Rules",
+    "rules": [
+      {
+        "action": "block",
+        "description": "Block traffic from sanctioned countries",
+        "enabled": true,
+        "expression": "(ip.src.country in {\"RU\" \"BY\" \"IR\" \"KP\"})"
+      }
+    ]
+  }' | jq '.success'
+```
+
+### 4. Verify the Rule is Active
+
+```bash
+curl -s -X GET \
+  "https://api.cloudflare.com/client/v4/zones/YOUR_ZONE_ID/rulesets/RULESET_ID" \
+  -H "Authorization: Bearer YOUR_API_TOKEN" \
+  -H "Content-Type: application/json" | jq '.result.rules'
+```
+
+## Country Codes Reference
+
+| Code | Country |
+|------|---------|
+| `RU` | Russia |
+| `BY` | Belarus |
+| `IR` | Iran |
+| `KP` | North Korea |
+| `CN` | China |
+| `CU` | Cuba |
+| `SY` | Syria |
+| `VE` | Venezuela |
+
+## WAF Expression Examples
+
+```
+# Block multiple countries
+(ip.src.country in {"RU" "BY" "IR" "KP"})
+
+# Block country + specific ASN
+(ip.src.country eq "RU") or (ip.geoip.asnum eq 12345)
+
+# Block all except allowlisted IPs
+(ip.src.country in {"RU" "BY"}) and not (ip.src in {1.2.3.4/32})
+```
+
+## Multi-Zone Script
+
+To apply the same block rule across multiple zones:
+
+```bash
+#!/usr/bin/env bash
+API_TOKEN="YOUR_API_TOKEN"
+ZONES=("ZONE_ID_1" "ZONE_ID_2" "ZONE_ID_3")
+EXPRESSION='(ip.src.country in {"RU" "BY" "IR" "KP"})'
+
+for ZONE_ID in "${ZONES[@]}"; do
+  EXISTING=$(curl -s -X GET \
+    "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/rulesets" \
+    -H "Authorization: Bearer $API_TOKEN" \
+    -H "Content-Type: application/json" | \
+    jq -r '.result[] | select(.phase == "http_request_firewall_custom") | .id')
+
+  if [ -z "$EXISTING" ]; then
+    METHOD="POST"
+    URL="https://api.cloudflare.com/client/v4/zones/$ZONE_ID/rulesets"
+    DATA=$(jq -n --arg expr "$EXPRESSION" '{
+      name: "default", description: "WAF Custom Rules",
+      kind: "zone", phase: "http_request_firewall_custom",
+      rules: [{action: "block", description: "Block sanctioned countries", enabled: true, expression: $expr}]
+    }')
+  else
+    METHOD="PUT"
+    URL="https://api.cloudflare.com/client/v4/zones/$ZONE_ID/rulesets/$EXISTING"
+    DATA=$(jq -n --arg expr "$EXPRESSION" '{
+      description: "WAF Custom Rules",
+      rules: [{action: "block", description: "Block sanctioned countries", enabled: true, expression: $expr}]
+    }')
+  fi
+
+  RESULT=$(curl -s -X "$METHOD" "$URL" \
+    -H "Authorization: Bearer $API_TOKEN" \
+    -H "Content-Type: application/json" \
+    --data "$DATA" | jq '.success')
+
+  echo "Zone $ZONE_ID: $RESULT"
+done
+```
+
+## Notes
+
+- `PUT` on an existing ruleset **replaces all rules** in it. Include all rules in the payload if the ruleset already has other rules.
+- WAF Custom Rules require a Cloudflare plan that supports rulesets (Free includes basic WAF; Pro/Business/Enterprise for full custom rules).
+- Changes are applied globally within seconds; no cache purge needed.

package/packages/software-development/cloudflare-block-countries/adapters/codex/README.md

@@ -0,0 +1,3 @@
+# Codex adapter
+
+Use the canonical skill directly from `packages/software-development/cloudflare-block-countries/SKILL.md`.

package/packages/software-development/cloudflare-block-countries/adapters/cursor/plugin.json

@@ -0,0 +1,6 @@
+{
+  "name": "olko:cloudflare-block-countries",
+  "version": "0.1.0",
+  "description": "Block specific countries via Cloudflare WAF Custom Rules using the Cloudflare API. Handles creating new rulesets and updating existing ones across single or multiple zones.",
+  "skills": "skills/"
+}

package/packages/software-development/cloudflare-block-countries/adapters/cursor/skills/cloudflare-block-countries/SKILL.md

@@ -0,0 +1,177 @@
+<!-- Generated by scripts/build-adapters.sh. Do not edit directly. -->
+
+---
+name: cloudflare-block-countries
+description: 'Block specific countries via Cloudflare WAF Custom Rules using the Cloudflare API. Use when user wants to geo-block traffic, block countries in Cloudflare, set up WAF country rules, or mentions blocking regions. Handles both creating new rulesets and updating existing ones.'
+license: MIT
+allowed-tools: Bash
+compatibility: Codex, Claude Code, Cursor, and other Agent Skills compatible tools. Requires curl and jq.
+metadata:
+  author: Oleg Koval
+  tags:
+    - cloudflare
+    - waf
+    - security
+    - geo-blocking
+    - firewall
+---
+
+# Cloudflare Country Block via WAF Custom Rules
+
+Block traffic from specific countries using Cloudflare WAF Custom Rules and the Cloudflare API.
+
+## Prerequisites
+
+- Cloudflare API Token with `Zone:Rulesets:Edit` permission
+- Zone ID for the target domain
+- `curl` and `jq` installed
+
+## Workflow
+
+### 1. Get Zone IDs
+
+```bash
+curl -s -X GET \
+  "https://api.cloudflare.com/client/v4/zones?account.id=YOUR_ACCOUNT_ID&status=active" \
+  -H "Authorization: Bearer YOUR_API_TOKEN" \
+  -H "Content-Type: application/json" | jq '.result[] | {name: .name, id: .id}'
+```
+
+### 2. Check Existing Custom Firewall Rulesets
+
+```bash
+curl -s -X GET \
+  "https://api.cloudflare.com/client/v4/zones/YOUR_ZONE_ID/rulesets" \
+  -H "Authorization: Bearer YOUR_API_TOKEN" \
+  -H "Content-Type: application/json" | \
+  jq '.result[] | select(.phase == "http_request_firewall_custom")'
+```
+
+If the output is empty — no existing ruleset. Go to **3a**. If a ruleset exists, note its `id` and go to **3b**.
+
+### 3a. Create NEW Ruleset with Block Rule
+
+```bash
+curl -s -X POST \
+  "https://api.cloudflare.com/client/v4/zones/YOUR_ZONE_ID/rulesets" \
+  -H "Authorization: Bearer YOUR_API_TOKEN" \
+  -H "Content-Type: application/json" \
+  --data '{
+    "name": "default",
+    "description": "WAF Custom Rules",
+    "kind": "zone",
+    "phase": "http_request_firewall_custom",
+    "rules": [
+      {
+        "action": "block",
+        "description": "Block traffic from sanctioned countries",
+        "enabled": true,
+        "expression": "(ip.src.country in {\"RU\" \"BY\" \"IR\" \"KP\"})"
+      }
+    ]
+  }' | jq '.success'
+```
+
+### 3b. Update EXISTING Ruleset
+
+```bash
+curl -s -X PUT \
+  "https://api.cloudflare.com/client/v4/zones/YOUR_ZONE_ID/rulesets/RULESET_ID" \
+  -H "Authorization: Bearer YOUR_API_TOKEN" \
+  -H "Content-Type: application/json" \
+  --data '{
+    "description": "WAF Custom Rules",
+    "rules": [
+      {
+        "action": "block",
+        "description": "Block traffic from sanctioned countries",
+        "enabled": true,
+        "expression": "(ip.src.country in {\"RU\" \"BY\" \"IR\" \"KP\"})"
+      }
+    ]
+  }' | jq '.success'
+```
+
+### 4. Verify the Rule is Active
+
+```bash
+curl -s -X GET \
+  "https://api.cloudflare.com/client/v4/zones/YOUR_ZONE_ID/rulesets/RULESET_ID" \
+  -H "Authorization: Bearer YOUR_API_TOKEN" \
+  -H "Content-Type: application/json" | jq '.result.rules'
+```
+
+## Country Codes Reference
+
+| Code | Country |
+|------|---------|
+| `RU` | Russia |
+| `BY` | Belarus |
+| `IR` | Iran |
+| `KP` | North Korea |
+| `CN` | China |
+| `CU` | Cuba |
+| `SY` | Syria |
+| `VE` | Venezuela |
+
+## WAF Expression Examples
+
+```
+# Block multiple countries
+(ip.src.country in {"RU" "BY" "IR" "KP"})
+
+# Block country + specific ASN
+(ip.src.country eq "RU") or (ip.geoip.asnum eq 12345)
+
+# Block all except allowlisted IPs
+(ip.src.country in {"RU" "BY"}) and not (ip.src in {1.2.3.4/32})
+```
+
+## Multi-Zone Script
+
+To apply the same block rule across multiple zones:
+
+```bash
+#!/usr/bin/env bash
+API_TOKEN="YOUR_API_TOKEN"
+ZONES=("ZONE_ID_1" "ZONE_ID_2" "ZONE_ID_3")
+EXPRESSION='(ip.src.country in {"RU" "BY" "IR" "KP"})'
+
+for ZONE_ID in "${ZONES[@]}"; do
+  EXISTING=$(curl -s -X GET \
+    "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/rulesets" \
+    -H "Authorization: Bearer $API_TOKEN" \
+    -H "Content-Type: application/json" | \
+    jq -r '.result[] | select(.phase == "http_request_firewall_custom") | .id')
+
+  if [ -z "$EXISTING" ]; then
+    METHOD="POST"
+    URL="https://api.cloudflare.com/client/v4/zones/$ZONE_ID/rulesets"
+    DATA=$(jq -n --arg expr "$EXPRESSION" '{
+      name: "default", description: "WAF Custom Rules",
+      kind: "zone", phase: "http_request_firewall_custom",
+      rules: [{action: "block", description: "Block sanctioned countries", enabled: true, expression: $expr}]
+    }')
+  else
+    METHOD="PUT"
+    URL="https://api.cloudflare.com/client/v4/zones/$ZONE_ID/rulesets/$EXISTING"
+    DATA=$(jq -n --arg expr "$EXPRESSION" '{
+      description: "WAF Custom Rules",
+      rules: [{action: "block", description: "Block sanctioned countries", enabled: true, expression: $expr}]
+    }')
+  fi
+
+  RESULT=$(curl -s -X "$METHOD" "$URL" \
+    -H "Authorization: Bearer $API_TOKEN" \
+    -H "Content-Type: application/json" \
+    --data "$DATA" | jq '.success')
+
+  echo "Zone $ZONE_ID: $RESULT"
+done
+```
+
+## Notes
+
+- `PUT` on an existing ruleset **replaces all rules** in it. Include all rules in the payload if the ruleset already has other rules.
+- WAF Custom Rules require a Cloudflare plan that supports rulesets (Free includes basic WAF; Pro/Business/Enterprise for full custom rules).
+- Changes are applied globally within seconds; no cache purge needed.